iam-policies

const { IdentityBasedPolicy, ResourceBasedPolicy } = require('iam-policies');

const allowExample = new IdentityBasedPolicy([
  {
    effect: 'allow', // optional, defaults to allow
    resource: ['secrets:${user.id}:*'], // embedded value by context
    action: ['read', 'write']
  },
  {
    resource: ['bd:company:*'],
    action: 'create'
  }
]);

const contextForAllowExample = { user: { id: 456 } };

allowExample.evaluate({
  action: 'read',
  resource: 'secrets:456:ultraSecret',
  context: contextForAllowExample
}); // true
allowExample.evaluate({
  action: 'create',
  resource: 'secrets:456:ultraSecret',
  context: contextForAllowExample
}); // false
allowExample.evaluate({
  action: 'create',
  resource: 'bd:company:account',
  context: contextForAllowExample
}); // true
allowExample.evaluate({
  action: 'read',
  resource: 'bd:company:account',
  context: contextForAllowExample
}); // false

const denyExample = new IdentityBasedPolicy([
  {
    resource: ['secrets:${user.bestFriends}:*'],
    action: 'read'
  },
  {
    effect: 'deny',
    resource: 'secrets:123:*',
    action: 'read'
  }
]);

const contextForDenyExample = { user: { bestFriends: [123, 563, 1211] } };

denyExample.evaluate({
  action: 'read',
  resource: 'secrets:563:super-secret',
  context: contextForDenyExample
}); // true
denyExample.evaluate({
  action: 'read',
  resource: 'secrets:123:super-secret',
  context: contextForDenyExample
}); // false

const notActionExample = new IdentityBasedPolicy([
  {
    resource: 'bd:company:*',
    notAction: 'update'
  }
]);

notActionExample.evaluate({
  action: 'delete',
  resource: 'bd:company:account'
}); // true
notActionExample.evaluate({
  action: 'update',
  resource: 'bd:company:account'
}); // false

const notResourceExample = new IdentityBasedPolicy([
  {
    notResource: ['bd:roles:*'],
    action: 'update'
  }
]);

notResourceExample.evaluate({
  action: 'update',
  resource: 'photos'
}); // true
notResourceExample.evaluate({
  action: 'update',
  resource: 'bd:roles:admin'
}); // false

const adminExample = new IdentityBasedPolicy([
  {
    resource: '*',
    action: '*'
  }
]);

adminExample.evaluate({
  action: 'read',
  resource: 'someResource'
}); // true
adminExample.evaluate({
  action: 'write',
  resource: 'otherResource'
}); // true

const conditions = {
  greaterThan: function(data, expected) {
    return data > expected;
  }
};

const conditionExample = new IdentityBasedPolicy(
  [
    {
      resource: 'secrets:*',
      action: ['read', 'write'],
      condition: {
        greaterThan: {
          'user.age': 18
        }
      }
    }
  ],
  conditions
);

conditionExample.evaluate({
  action: 'read',
  resource: 'secrets:code',
  context: { user: { age: 19 } }
}); // true
conditionExample.evaluate({
  action: 'read',
  resource: 'secrets:admin:super-secret',
  context: {
    user: { age: 18 }
  }
}); // false

const principalExample = new ResourceBasedPolicy([
  {
    principal: '1',
    effect: 'allow',
    resource: ['secrets:user:*'],
    action: ['read', 'write']
  },
  {
    principal: { id: '2' },
    resource: 'bd:company:*',
    notAction: 'update'
  }
]);

principalExample.evaluate({
  principal: '1',
  action: 'read',
  resource: 'secrets:user:name'
}); // true
principalExample.evaluate({
  principal: '2',
  action: 'read',
  resource: 'secrets:user:super-secret'
}); // false
principalExample.evaluate({
  principal: '2',
  action: 'read',
  resource: 'bd:company:name',
  principalType: 'id'
}); // true
principalExample.evaluate({
  principal: '2',
  action: 'update',
  resource: 'bd:company:name',
  principalType: 'id'
}); // false

const notPrincipalExample = new ResourceBasedPolicy([
  {
    notPrincipal: ['1', '2'],
    resource: ['secrets:bd:*'],
    action: 'read'
  },
  {
    notPrincipal: { id: '3' },
    resource: 'secrets:admin:*',
    action: 'read'
  }
]);

notPrincipalExample.evaluate({
  principal: '3',
  action: 'read',
  resource: 'secrets:bd:tables'
}); // true
notPrincipalExample.evaluate({
  principal: '1',
  action: 'read',
  resource: 'secrets:bd:tables'
}); // false
notPrincipalExample.evaluate({
  principal: '1',
  action: 'read',
  resource: 'secrets:admin:friends',
  principalType: 'id'
}); // true
notPrincipalExample.evaluate({
  principal: '3',
  action: 'read',
  resource: 'secrets:admin:friends',
  principalType: 'id'
}); // false

const canAndCannotStatements = [
  {
    effect: 'allow', // again, this is optional, as it already defaults to allow
    resource: ['website:${division.companyId}:${division.countryId}:*/*'],
    action: ['create', 'update', 'delete']
  },
  {
    effect: 'deny',
    resource: ['website:${division.companyId}:${division.countryId}:city/lima'],
    action: 'delete'
  }
];

const inclusivePolicy = new IdentityBasedPolicy(canAndCannotStatements);

const contextCanAndCannot = {
  division: {
    companyId: 123,
    countryId: 456
  }
};

const canAndCannotDeniedArgument = {
  action: 'delete',
  resource: 'website:123:456:city/lima',
  context: contextCanAndCannot
};

inclusivePolicy.evaluate(canAndCannotDeniedArgument); // false
// So far, we are not sure whether the argument is denied or not present.

inclusivePolicy.can(canAndCannotDeniedArgument); // true
// It's present as an allow policy, so it must be explicitly denied, right?

inclusivePolicy.cannot(canAndCannotDeniedArgument); // true
// I knew it!

const canAndCannotNotPresentArgument = {
  action: 'read',
  resource: 'website:123:456:}city/lima',
  context: contextCanAndCannot
};

inclusivePolicy.evaluate(canAndCannotNotPresentArgument); // false
// Again, the user doesn't have access here, but why? Let's investigate..

inclusivePolicy.can(canAndCannotNotPresentArgument); // false
// It's not present as an allow policy, but is it explicitly denied?

inclusivePolicy.cannot(canAndCannotNotPresentArgument); // false
// Nope, it just isn't there.

const { IdentityBasedPolicy } = require('iam-policies');

const identityBasedPolicy = new IdentityBasedPolicy(
  Statement,
  conditionResolver
);

const { ResourceBasedPolicy } = require('iam-policies');

const resourceBasedPolicy = new ResourceBasedPolicy(
  Statement,
  conditionResolver
);

const { getValueFromPath } = require('iam-policies');

const value = getValueFromPath(data, path, defaultValue);

const { applyContext } = require('iam-policies');

const embeddedStr = applyContext(str, context);