Matthew Ebeweber
09/27/2022, 7:06 PMTAGGED_READ_ONLY
that is for entities with tag=foo
. Similarly you might have the same role conditioned on tag=bar
. The tag itself is arbitrary depending on customer requirements. On the flip side a resource might have a basket of tags. I want to avoid creating a role for each tag combination (using a git store for policies right now).
The role + tag need to be considered together. So right now I've got something like this. However, something like this works at the evaluation step if a resource is present, but doesn't translate well when doing query planning. Is there a way to represent this that query planning might better understand ?
P.attr.taggedRoles.exists(
tr,
tr.role == 'TAGGED_READ_ONLY' && tr.tag in R.attr.tags
)
Dennis (Cerbos)
09/27/2022, 8:38 PM{ role, tag }
. If it can be shaped as a map { role: [tag] }
the expression can be rewritten:
P.attr.taggedRoles['TAGGED_READ_ONLY'].exists(t, t in R.attr.tags)
.
Or
intersect(P.attr.taggedRoles['TAGGED_READ_ONLY'], R.attr.tags)
.
The main idea is P.attr.taggedRoles['TAGGED_READ_ONLY']
can be evaluated in the query planner, so the produced AST won’t contain any reference to the role.Matthew Ebeweber
09/27/2022, 9:08 PMhasIntersection(P.attr.taggedRoles['foo'], R.attr.tags)
Dennis (Cerbos)
09/27/2022, 9:21 PMP.attr.taggedRoles[‘foo’] in R.attr.tags can be. But limits the number of tags you might have associated with one of these roles.That should work, but I guess having a single tag per role is not ideal.
Matthew Ebeweber
09/27/2022, 9:24 PMDennis (Cerbos)
09/27/2022, 9:28 PMexists
method is known.
For example, [1, 2, -3].exists(t, t > R.attr.value)
can be translated to 1 > R.attr.value OR 2 > R.attr.value OR -3 > R.attr.value
.
I believe this can be handled by the queryPlanToPrismaexists
to expr1 OR expr2 OR … exprN
can be done by queryPlanToPrisma.Matthew Ebeweber
09/27/2022, 9:32 PMFor example,This translation would require knowing the [1, 2, 3] ahead of time though correct? If it's part of the principal it's unknown until call time.can be translated to[1, 2, -3].exists(t, t > R.attr.value)
.1 > R.attr.value OR 2 > R.attr.value OR -3 > R.attr.value
Dennis (Cerbos)
09/27/2022, 9:33 PMMatthew Ebeweber
09/27/2022, 9:38 PMP.attr['taggedRoles'].exists(t, t in R.attr.tags)
can be done or cannot be done?Dennis (Cerbos)
09/27/2022, 9:43 PMFor example,I meant this as a runtime optimisation by cerbos. In your policies, you writecan be translated to[1, 2, -3].exists(t, t > R.attr.value)
.1 > R.attr.value OR 2 > R.attr.value OR -3 > R.attr.value
P.attr['taggedRoles'].exists(t, t in R.attr.tags)
I meant this as a runtime optimisation by cerbos.Possible optimisation. It hasn’t been implemented.
Alex Olivier (Cerbos)
09/27/2022, 10:19 PMif the queryPlanToPrisma isn’t able to translate it returns an empty objectThis is handled now also and throws an exception. I will check for you use case specifically tomorrow
Matthew Ebeweber
09/27/2022, 10:30 PM