New atom type: Set about biscuit HOT 5 CLOSED

it could reduce the number of facts we have to write but I worry a bit about the expected usage. If there's a Set atom type, how would we make a rule that generate a fact containing one? At best it would copy another set, while we might want to get intersection, union or difference operations too?

from biscuit.

how would we make a rule that generate a fact containing one?

I'm not sure to see what you mean here, for me it's the same as for other atom types:

# copy the set
*new($usernames) <- users(#ambient, $usernames)

# create a new one ?
*new(["a", "b"]) <- users(#ambient, $usernames)

On intersection / union / diff support, I'm not sure how it could go, as it doesn't fit in constraints. It sounds more like a new operation kind allowing to compute a new value and reinject it in the program.

For constraints on Set, I don't need anything more than "contains only" and "doesn't contains any" at the moment.

from biscuit.

So creation would only be for a static set? I feel it would be more useful with set operations. On that topic ( I'll make it a separate issue), I'd like to support it, maybe as a new Expression atom type. That would allow constructing or combining values more easily.

Like, set construction could be:
set_result(insert($set, $val)) <- set_result($set), value($val)

from biscuit.

Yes, right now my use case is limited to static sets. Perhaps operations could get useful in more complex scenarios / attenuation use cases, but right now, I'd favor keeping it simple, at least to have it run and see how it behave. Same for expressions, I'd hold on it for now. I'll probably come back to it once I'll have gathered some feedback and limitations on running what we currently have!

from biscuit.

I'm adding sets to the spec: f5169d2
Rust: biscuit-auth/biscuit-rust@bb47508

one slight difference with your implementation, sets are added to the v1 format only

from biscuit.