is it possible to call cerbos with a list of actions and get back all resources with corresponding EFFECT_ALLOW for each action in the list?

The closest thing is the PlanResources API, which will give you back a query plan to match all the resources for which a particular action would be allowed. However, it only takes a single action at a time, not a list of actions, and you have to evaluate the resulting AST. If you have a relatively small set of resources and they are known ahead of time, then you can pass multiple resources and actions to a single CheckResources API call and get back all the corresponding decisions.

so in the example shown in the docs, when i call

PlanResources

, i still need to supply a

"resource": { }

JSON. how does that give back a query plan to match all the resources ?

Nope, you need to at least specify the

kind

of resource, so that Cerbos knows which policies to use

hmmmmmm................

You can also specify some resource attributes, which is useful if you already know some criteria that you are filtering on.

apiVersion: api.cerbos.dev/v1
resourcePolicy:
  resource: asset_profile_assets
  version: development
  importDerivedRoles:

so in this case my kind would be asset_profile_assets then

Got it, yep sounds like you want

CheckResources

.

because of

KIND_*

returned by

PlanResources

? i.e. the AST

CheckResources

is for answering the question "can this principal do these actions to these resources?", which is the most common use case for authz.

PlanResources

is to help answer the question "which resources can the principal do this action to?", which is useful for authorizing e.g. listing pages. You can turn the AST that it returns into a query for your database. If you were to use

CheckResources

for this use case, you might have to load every row from your database, and feed them into Cerbos to filter them down into the list that the user is actually allowed to see.

aaaaha ok. that makes sense

Fair - perhaps it's more accurate to say that

PlanResources

answers the question "under what conditions can this principal do this action to resources of this kind?", and it gives you one of three answers: "always" (

KIND_ALWAYS_ALLOWED

), "never" (

KIND_ALWAYS_DENIED

), or "it depends" (

KIND_CONDITIONAL

, with an AST of the conditions).

ok that was confusing for me at first but your 2nd explanation makes it crystal clear. thank you andrew!

No problem, happy to help 🙂