Support template placeholders in conditions about cedar HOT 10 CLOSED

Stepping back from the original request:

I wonder if a better solution might be some form of template group which puts together multiple templates so they can be instantiated as a unit? Then you could write multiple policies like you have done above, but as a group that can be linked all at once?

from cedar.

Let's be clear about exactly the scope of this issue -- I think that OP is specifically looking for just allowing the existing ?principal and ?resource placeholders in template conditions. @iamatjlovelock's example requires additional placeholders and, more importantly perhaps, placeholders for values other than entity references, which would be significantly more implementation work and maybe have other ramifications. IMO it would be better to discuss those feature requests in a separate issue (@iamatjlovelock feel free to make one).

from cedar.

Hi again! We're working on transitioning to a formal RFC process like many other language projects. See the README at https://github.com/cedar-policy/rfcs. In support of this transition, I've written up this issue and the discussion in this thread as cedar-policy/rfcs#3. Feel free to suggest any edits you like. Going forward, let's continue discussion there, per the RFC process outlined in the README. Thanks!

from cedar.

It looks like you want more than just slots in conditions, you also want to allow slots in more locations in an expression. In particular, we do not currently allow the following:

@id("AdminNavigate")
permit(
  principal == ?principal,
  action == Action::"Navigate", 
  ?resource in resource); // allow access up the tree for navigation

That's because ?resource needs to be on the RHS of the in, not the LHS.

from cedar.

As I mentioned above, the current implementation appears to support what I'm asking for already, despite the docs saying it doesn't. It both honors template placeholders in the conditions, and honors ?resource on both the LHS and RHS.

Here's a toy example:
mini-entities.txt
mini-roles.txt
mini-schema.txt
mini-template-linked.txt

Policy template:

@id("Admin")
permit(
  principal == ?principal,
  action, 
  resource
)
when {
    // write in descendants
    (resource in ?resource && action == FS::Action::"Write")

    // list in ancestors
    || (?resource in resource && action == FS::Action::"List")
};

Entity graph:

• FS::Disk::"SSD"
  • FS::Folder::"Downloads"
    • FS::File::"package.zip"
  • FS::Folder::"Photos" <-- Alice is admin of this
    • FS::File::"vacation.jpg"

Run like:

cargo run authorize \
    --policies mini-roles.txt \
    --schema mini-schema.txt \
    --entities mini-entities.txt \
    --template-linked mini-template-linked.txt \
    --principal 'FS::Person::"Alice"' \
    --action 'FS::Action::"List"' \
    --resource 'FS::Disk::"SSD"'

from cedar.

I wonder if a better solution might be some form of template group which puts together multiple templates so they can be instantiated as a unit? Then you could write multiple policies like you have done above, but as a group that can be linked all at once?

I'd love template groups. The when { A || B || C } I'm using is awkward.

I'd still want to have ?resource allowed on both the LHS and RHS (as it seems it already is).

from cedar.

we do not currently allow the following:

I'm not sure what version you are using, but I just cloned the most recent version and tried to get the CLI to parse this policy

permit(
  principal == ?principal,
  action == Action::"Navigate", 
  ?resource in resource); // allow access up the tree for navigation

and it fails saying that ?resource is unrecognized. If I move the ? to the RHS it works. I guess this support was rolled back recently, to match the docs. @anwarmamat ?

For template groups: I've filed a separate issue for that: #106

from cedar.

I was on 960394d5da664ce2dba383270e29fa2a8683e4bd From May 18. Looks like support for placeholders in conditions was removed here:
9772870

from cedar.

I've definitely seen this request for placeholders in template conditions for simpler use cases. In particular to create time bound policies using a template.

The when clause for the template would be something like : when { context.currentDate < ?expiryDate }

from cedar.

I'll go ahead and close this issue in favor of the linked RFC.

from cedar.