iam-policies

const { IdentityBasedPolicy, ResourceBasedPolicy } = require('iam-policies');

const allowExample = new IdentityBasedPolicy([
  {
    effect: 'allow', // optional, defaults to allow
    resource: ['secrets:${user.id}:*'], // embedded value by context
    action: ['read', 'write'],
  },
  {
    resource: ['bd:company:*'],
    action: 'create',
  },
]);

const contextForAllowExample = { user: { id: 456 } };

allowExample.evaluate({
  action: 'read',
  resource: 'secrets:456:ultrasecret',
  context: contextForAllowExample,
});// true
allowExample.evaluate({
  action: 'create',
  resource: 'secrets:456:ultrasecret',
  context: contextForAllowExample,
});// false
allowExample.evaluate({
  action: 'create',
  resource: 'bd:company:account',
  context: contextForAllowExample,
});// true
allowExample.evaluate({
  action: 'read',
  resource: 'bd:company:account',
  context: contextForAllowExample,
});// false

const denyExample = new IdentityBasedPolicy([
  {
    resource: ['secrets:${user.bestfriends}:*'],
    action: 'read',
  },
  {
    effect: 'deny',
    resource: 'secrets:123:*',
    action: 'read',
  },
]);

const contextForDenyExample = { user: { bestfriends: [123, 563, 1211] } };

denyExample.evaluate({
  action: 'read',
  resource: 'secrets:563:super-secret',
  context: contextForDenyExample,
});// true
denyExample.evaluate({
  action: 'read',
  resource: 'secrets:123:super-secret',
  context: contextForDenyExample,
});// false

const notActionExample = new IdentityBasedPolicy([
  {
    resource: 'bd:company:*',
    notAction: 'update',
  },
]);

notActionExample.evaluate({
  action: 'delete',
  resource: 'bd:company:account',
});// true
notActionExample.evaluate({
  action: 'update',
  resource: 'bd:company:account',
});// false

const notResourceExample = new IdentityBasedPolicy([
  {
    notResource: ['bd:roles:*'],
    action: 'update',
  },
]);

notResourceExample.evaluate({
  action: 'update',
  resource: 'photos'
});// true
notResourceExample.evaluate({
  action: 'update',
  resource: 'bd:roles:admin',
});// false

const adminExample = new IdentityBasedPolicy([
  {
    resource: '*',
    action: '*',
  },
]);

adminExample.evaluate({
  action: 'read',
  resource: 'someResource'
});// true
adminExample.evaluate({
  action: 'write',
  resource: 'otherResource'
});// true

const conditions = {
  greatherThan: function(data, expected) {
    return data > expected;
  },
};

const conditionExample = new IdentityBasedPolicy(
  [
    {
      resource: 'secrets:*',
      action: ['read', 'write'],
      condition: {
        greatherThan: {
          'user.age': 18,
        },
      },
    },
  ],
  conditions
);

conditionExample.evaluate({
  action: 'read',
  resource: 'secrets:sshhh',
  context: { user: { age: 19 } },
});// true
conditionExample.evaluate({
  action: 'read',
  resource: 'secrets:admin:super-secret',
  context: {
    user: { age: 18 },
  },
});// false

const principalExample = new ResourceBasedPolicy([
  {
    principal: '1',
    effect: 'allow',
    resource: ['secrets:user:*'],
    action: ['read', 'write'],
  },
  {
    principal: { id: '2' },
    resource: 'bd:company:*',
    notAction: 'update',
  },
]);

principalExample.evaluate({
  principal: '1',
  action: 'read',
  resource: 'secrets:user:name',
});// true
principalExample.evaluate({
  principal: '2',
  action: 'read',
  resource: 'secrets:user:super-secret',
});// false
principalExample.evaluate({
  principal: '2',
  action: 'read',
  resource: 'bd:company:name',
  principalType: 'id',
});// true
principalExample.evaluate({
  principal: '2',
  action: 'update',
  resource: 'bd:company:name',
  principalType: 'id',
});// false

const notPrincipalExample = new ResourceBasedPolicy([
  {
    notPrincipal: ['1', '2'],
    resource: ['secrets:bd:*'],
    action: 'read',
  },
  {
    notPrincipal: { id: '3' },
    resource: 'secrets:admin:*',
    action: 'read',
  },
]);

notPrincipalExample.evaluate({
  principal: '3',
  action: 'read',
  resource: 'secrets:bd:tables',
});// true
notPrincipalExample.evaluate({
  principal: '1',
  action: 'read',
  resource: 'secrets:bd:tables',
});// false
notPrincipalExample.evaluate({
  principal: '1',
  action: 'read',
  resource: 'secrets:admin:friends',
  principalType: 'id',
});// true
notPrincipalExample.evaluate({
  principal: '3',
  action: 'read',
  resource: 'secrets:admin:friends',
  principalType: 'id',
});// false

const canAndCannotStatements = [
  {
    effect: 'allow', // again, this is optional, as it already defaults to allow
    resource: [
      'website:${division.companyId}:${division.countryId}:*/*',
    ],
    action: ['create', 'update', 'delete'],
  },
  {
    effect: 'deny',
    resource: [
      'website:${division.companyId}:${division.countryId}:city/lima',
    ],
    action: 'delete',
  },
];

const inclusivePolicy = new IdentityBasedPolicy(canAndCannotStatements);

const contextCanAndCannot = {
  division: {
    companyId: 123,
    countryId: 456
  },
};

const canAndCannotDeniedArgument = {
  action: 'delete',
  resource: 'website:123:456:city/lima',
  context: contextCanAndCannot,
};

inclusivePolicy.evaluate(canAndCannotDeniedArgument);// false
// So far, we are not sure whether the argument is denied or not present.

inclusivePolicy.can(canAndCannotDeniedArgument);// true
// It's present as an allow policy, so it must be explicitly denied, right?

inclusivePolicy.cannot(canAndCannotDeniedArgument);// true
// I knew it!

const canAndCannotNotPresentArgument = {
  action: 'read',
  resource: 'website:123:456:}city/lima',
  context: contextCanAndCannot,
};

inclusivePolicy.evaluate(canAndCannotNotPresentArgument);// false
// Again, the user doesn't have access here, but why? Let's investigate..

inclusivePolicy.can(canAndCannotNotPresentArgument);// false
// It's not present as an allow policy, but is it explicitly denied?

inclusivePolicy.cannot(canAndCannotNotPresentArgument);// false
// Nope, it just isn't there.

const { IdentityBasedPolicy } = require('iam-policies')

const identityBasedPolicy = new IdentityBasedPolicy(Statement,conditionResolver)

const { ResourceBasedPolicy } = require('iam-policies')

const resourceBasedPolicy = new ResourceBasedPolicy(Statement,conditionResolver)

const { getValueFromPath } = require('iam-policies')

const value = getValueFromPath(data, path)

const { applyContext } = require('iam-policies')

const embeddedStr = applyContext(str, context)