hi i use sequelize and cerbos but i have a problem my postcrud.js

What is the error or the problem?

throw new Error("You are not authorized to visit this resource");

Do you think this request should be authorised?

i dont understand you say i share you yaml files or use express static share policy file to browse

Sorry, I was referring to Cerbos policies which define access rules for resources and/or principals.

i share you yaml files

Can you please point me to these? I see the JS code and the request JSON object but not any yaml file.

this sis resourse.yaml apiVersion: api.cerbos.dev/v1 resourcePolicy: version: "default" importDerivedRoles: - common_roles resource: "blogpost" rules: - actions: ['view:all'] effect: EFFECT_ALLOW derivedRoles: - all_users - actions: ['view:single'] effect: EFFECT_ALLOW roles: - moderator - member - actions: ['create'] effect: EFFECT_ALLOW derivedRoles: - member_only - actions: ['update'] effect: EFFECT_ALLOW derivedRoles: - owner - moderator_only condition: match: any: of: - expr: request.resource.attr.flagged == false && request.principal.attr.role == "member" - expr: request.resource.attr.flagged == true && request.principal.attr.role == "moderator" - actions: ['delete'] effect: EFFECT_ALLOW derivedRoles: - owner - actions: ['flag'] effect: EFFECT_ALLOW derivedRoles: - moderator_only

Here’s the Cerbos playground with your policies. “create” action is allowed as expected. 1. Can you please share the Cerbos log? 2. I’m curious about what’s in the

cerbosCheck

object. Please

console.log

and share it.

when i console.log(cerbosCheck). CheckResourcesResult { resource: { id: 'undefined', kind: 'blogpost', policyVersion: 'default', scope: '' }, actions: { create: 'EFFECT_DENY' }, validationErrors: [], metadata: undefined }

I’ve got a working example. 1. Run cerbos

docker run --rm --name cerbos -d -v $(pwd)/cerbos/policies:/policies -p 3592:3592 -p 3593:3593  <http://ghcr.io/cerbos/cerbos:0.26.0|ghcr.io/cerbos/cerbos:0.26.0>

2. Slightly modified

authorization.js

:

const { GRPC } = require("@cerbos/grpc");

// The Cerbos PDP instance
const cerbos = new GRPC("localhost:3593", {
    tls: false,
});

module.exports = async (user, action, resourceAtrr = {}) => {
    const cerbosObject = {
        principal: {
            id: user.id.toString(),
            roles: [user?.role || "unknown"],
            attributes: user,
        },
        
        resource: {
            kind: "blogpost",
            id: resourceAtrr?.id + "" || "new",
            attributes: resourceAtrr,
        },
        
        actions: [action],
    };
    
    const cerbosCheck = await cerbos.checkResource(cerbosObject);

    return cerbosCheck.isAllowed(action);
};

3. Run the following script:

const authorise = require("./authorization");

(async function() {
  let user = {id: 1, role: "member", blocked: false};
  let r = await authorise(user, "create", {});
  console.log("allowed:", r);
}())

Prints

allowed: true

.

thanks so much i delete policyVersion: "default", it is work

1. Do you mean my version of

authorization.js

and my script give you

allowed: false

in your environment? 2. I assume you run Cerbos with the command I posted previously. Please post the output of

docker logs cerbos

command. 3. Which nodejs version are you using?