Hey @Gavin Ray - Happy Friday. How can we help you with Cerbos?

Heya, saw Cerbos mentioned on HackerNews recently. Watched the Prisma demo you did. It looked really interesting I had a question about the Query Planner API, if you don't mind

Sure

I'm trying to understand how a scenario like the below might work: • You have tabular data, say a CSV file of

user

rows • A REST API is generated on top of the tabular data, to read the rows • I make a Cerbos policy, saying that the

id

column of a row must match the

user_id

claim of a JWT I've signed Would the Query Planner give me a way to programmatically push this predicate into my CSV filtering logic, or say a SQL string that was generated -- or how does it work? 🤔

Yup that is exactly how it works. You would have a Cerbos policy for a

User

resource that says the

read

action is allowed with a condition of the

request.resource.id == request.principal.id

(or you can send the whole JWT)

apiVersion: api.cerbos.dev/v1
resourcePolicy:
  version: default
  resource: user_resource
  rules:
    - actions:
        - "read"
      effect: EFFECT_ALLOW
      roles:
        - USER
      condition:
        # ensure the ID field of the user is requal to the ID of the user making the request
        match:
          expr: request.resource.id == request.principal.id

Here is an example https://play.cerbos.dev/p/nDT6Y0KVilOQd6262f1485AffybQAqYd Whilst not support in the playground just yet, the Query Plan request would look like this:

{
  "requestId": "123123",
  "action": "read",
  "principal": {
    "id": "123",
    "roles": [
      "USER"
    ],
    "attr": {}
  },
  "resource": {
    "kind": "user_resource"
  }
}

and the response

{
  "requestId": "123123",
  "action": "read",
  "resourceKind": "user_resource",
  "filter": {
    "kind": "KIND_CONDITIONAL",
    "condition": {
      "expression": {
        "operator": "eq",
        "operands": [
          {
            "variable": "request.resource.id"
          },
          {
            "value": "123"
          }
        ]
      }
    }
  }
}

This response is a standard format which you can use to apply a ‘filter’ to the data returned. Here is a cURL to the playground PDP instance if you want to try it:

curl --location --request POST '<https://demo-pdp.cerbos.cloud/api/x/plan/resources>' \
--header 'Playground-Instance: nDT6Y0KVilOQd6262f1485AffybQAqYd' \
--header 'Content-Type: application/json' \
--data-raw '{
    "requestId": "123123",
    "action": "read",
    "principal": {
        "id": "123",
        "roles": [
            "USER"
        ],
        "attr": {}
    },
    "resource": {
        "kind": "user_resource"
    }
}'

Oh wow -- thank you! And then the business logic would take the response, and visit the

expression

AST to translate the filters into whatever domain-specific functionality you need?

function convertCerbosFilterToSQL(filterExpr, requestObject) {

Correct!