Hey guys, I’m trying to nest hierarichal permissions. I thought I could use derived policies and the compiler seems to like it but my unit test suggests the permissions aren’t inherited. (I’m assigning a single role in my test principle with the expectation that the derived role is inherited) So, Long question short, can a parent role also be a derived role?

apiVersion: "api.cerbos.dev/v1"
description: |-
  Permissions based roles
derivedRoles:
  name: line_ip_roles
  definitions:
    - name: viewer
      parentRoles: ["user"]
      condition:
        match:
          all:
            of:
              - expr: ...

    - name: reader
      parentRoles: ["viewer"]
      condition:
        match:
          all:
            of:
              - expr: ...

    - name: editor
      parentRoles: ["reader"]
      condition:
        match:
          expr: ...
---

apiVersion: api.cerbos.dev/v1
resourcePolicy:
  version: "default"
  resource: "line:ip"
  rules:
    - actions:
        - view
      effect: EFFECT_ALLOW
      roles:
        - viewer
  
    - actions:
        - read
      effect: EFFECT_ALLOW
      roles:
        - reader

    - actions:
        - edit
      effect: EFFECT_ALLOW
      roles:
        - editor

so if my test principal has the

reader

role, I would have thought he’d also have the

viewer

role but that doesn’t seem to be the case. Is this not supported or am I just doing something daft?

Hi Joe 👋 Derived roles aren't implicitly inherited--there's a required, explicit import step and then a dedicated field in the resource policy rules (

derivedRoles

rather than

roles

). This allows you to namespace derived role definitions (and reuse derived role names, etc). You can see an example of this in the resource policy example in the docs; namely, the annotations

4

(import statement) and

8

(the rule/derived role mapping).

Fantastic. Thanks @Sam Lock (Cerbos)

As it stands, no, there's no way to inherit. Each derived role is independent. The approach would be to apply more than one derived role to a given rule (composition rather than inheritance!) What is the particular "inheritance" case, out of interest?

thanks for getting back to me. I ended up doing as you suggested so its all good. We have a load of rules about accessing certain content. These rules are applied through a role hierarchy. I thought if I created a derived

viewer

role, I could inherit the rules applied and extend through a further derived

editor

role or similar.