apiVersion: api.cerbos.dev/v1
resourcePolicy:
  version: "1"
  importDerivedRoles:
    - hm_employee
  resource: "businessassets"
  rules:
    - actions: ['read']
      effect: EFFECT_ALLOW
      derivedRoles:
        - internal_user
    - actions: ['read']
      effect: EFFECT_ALLOW
      condition:
        match:
          expr: "read:businessassets" in request.aux_data.jwt.scope.split(" ")

curl -POST -H "Content-type: application/json" -d '{
  "requestId":  "1",
  "actions":  ["read"],
  "resource":  {
    "policyVersion": "1",
    "kind":  "businessassets",
    "instances": {
      "prod": {}
    }
  },
  "principal":  {
    "id":  "user01",
    "policyVersion": "1",
    "roles":  ["valid_user"]
  },
  "includeMeta": true,
  "aux_Data": { 
    "jwt": {
        "token": "myjwt....redacted"
	}
  }
}' 'theurl'

{
  "requestId": "1",
  "resourceInstances": {
    "prod": {
      "actions": {
        "read": "EFFECT_DENY"
      }
    }
  },
  "meta": {
    "resourceInstances": {
      "prod": {
        "actions": {
          "read": {
            "matchedPolicy": "NO_MATCH"
          }
        },
        "effectiveDerivedRoles": []
      }
    }
  }
}

auxData

{
  "requestId": "test",
  "actions": [
    "defer"
  ],
  "principal": {
    "id": "john",
    "policyVersion": "20210210",
    "roles": [
      "employee"
    ],
    "attr": {
      "department": "marketing",
      "geography": "GB",
      "team": "design"
    }
  },
  "resource": {
    "kind": "leave_request",
    "policyVersion": "20210210",
    "instances": {
      "XX125": {
        "attr": {
          "department": "marketing",
          "geography": "GB",
          "id": "XX125",
          "owner": "john",
          "team": "design"
        }
      }
    }
  },
  "auxData": {
    "jwt": {
      "token": "eyJhbGciOiJFUzM4NCIsImtpZCI6IjE5TGZaYXRFZGc4M1lOYzVyMjNndU1KcXJuND0iLCJ0eXAiOiJKV1QifQ.eyJhdWQiOlsiY2VyYm9zLWp3dC10ZXN0cyJdLCJjdXN0b21BcnJheSI6WyJBIiwiQiIsIkMiXSwiY3VzdG9tSW50Ijo0MiwiY3VzdG9tTWFwIjp7IkEiOiJBQSIsIkIiOiJCQiIsIkMiOiJDQyJ9LCJjdXN0b21TdHJpbmciOiJmb29iYXIiLCJleHAiOjE5NDk5MzQwMzksImlzcyI6ImNlcmJvcy10ZXN0LXN1aXRlIn0.WN_tOScSpd_EI-P5EI1YlagxEgExSfBjAtcrgcF6lyWj1lGpR_GKx9goZEp2p_t5AVWXN_bjz_sMUmJdJa4cVd55Qm1miR-FKu6oNRHnSEWdMFmnArwPw-YDJWfylLFX"
    }
  }
}

- actions: ["defer"]
      effect: EFFECT_ALLOW
      roles: ["employee"]
      condition:
        match:
          all:
            of:
              - expr: '"cerbos-jwt-tests" in request.aux_data.jwt.aud'
              - expr: '"A" in request.aux_data.jwt.customArray'

{
  "log.level": "error",
  "@timestamp": "2021-12-15T08:41:54.978Z",
  "log.logger": "cerbos.blob",
  "message": "Failed to check for updates",
  "bucket": "<gs://abac-policies>",
  "workDir": "/root/tmp/cerbos/work",
  "error": "failed to convert data to JSON: yaml: line 16: did not find expected key"
}

apiVersion: api.cerbos.dev/v1
resourcePolicy:
  version: "1"
  importDerivedRoles:
    - special_roles
  resource: "businessassets"
  rules:
    - actions: ['read']
      effect: EFFECT_ALLOW
      derivedRoles:
        - hm_employee
    - actions: ['read']
      effect: EFFECT_ALLOW
      roles: ["valid_user"]
      condition:
        match:
          expr: |-
            "read:businessassets" in request.auxdata.jwt.scope.split(" ")

auxdata

{
  "log.level": "error",
  "@timestamp": "2021-12-15T08:52:04.991Z",
  "log.logger": "cerbos.compiler",
  "message": "Failed to recompile",
  "id": {},
  "error": "1 compilation errors:\nresourcePolicy_businessassets.yaml: Invalid expression in resource rule 'rule-002' (failed to compile `\"read:businessassets\" in request.auxData.jwt.scope.split(\" \")` [undefined field 'auxData'])"
}

apiVersion: "api.cerbos.dev/v1"
description: "Dynamic role to determine if this is a HM employee."
derivedRoles:
  name: platform_roles
  definitions:
    - name: hm_employee
      parentRoles: ["naked_user"]
      condition: 
        match:
          expr: request.aux_data.jwt.is_hm_employee == "TRUE"
    - name: explore
      parentRoles: ["naked_user"]
      condition: 
        match:
          expr: request.aux_data.jwt.hm_account_status == "Explore"
    - name: expand
      parentRoles: ["naked_user"]
      condition: 
        match:
          expr: request.aux_data.jwt.hm_account_status == "Expand"
    - name: experience
      parentRoles: ["naked_user"]
      condition: 
        match:
          expr: request.aux_data.jwt.hm_account_status == "Experience"

apiVersion: api.cerbos.dev/v1
resourcePolicy:
  version: "1"
  importDerivedRoles:
    - platform_roles
  resource: "businessassets"
  rules:
    - name: allow_readbusinessassets_is_employee
      actions: ['read']
      effect: EFFECT_ALLOW
      derivedRoles:
        - hm_employee
    - name: allow_readbusinessassets_from_scope
      actions: ['read']
      effect: EFFECT_ALLOW
      roles: ["naked_user"]
      condition:
        match:
          expr: |-
            "read:businessassets" in request.aux_data.jwt.scope.split(" ")

apiVersion: "api.cerbos.dev/v1"
description: "Dynamic role to determine if this is a HM employee."
derivedRoles:
  name: platform_roles
  definitions:
    - name: hm_employee
      parentRoles: ["naked_user"]
      condition: 
        match:
          all:
            of:
              - expr: request.aux_data.jwt.is_hm_employee == "TRUE"
              #- expr: !(request.aux_data.jwt.hm_account_status in ['Expand', 'Explore', 'Experience'])
    - name: explore
      parentRoles: ["naked_user"]
      condition: 
        match:
          any:
            of:
              - expr: request.aux_data.jwt.hm_account_status == "Explore"
              - expr: request.aux_data.jwt.is_hm_employee != "TRUE"
    - name: expand
      parentRoles: ["naked_user"]
      condition: 
        match:
          all:
            of:
              - expr: request.aux_data.jwt.hm_account_status == "Expand"
              - expr: request.aux_data.jwt.is_hm_employee != "TRUE"
    - name: experience
      parentRoles: ["naked_user"]
      condition: 
        match:
          all:
            of:
              - expr: request.aux_data.jwt.hm_account_status == "Experience"
              - expr: request.aux_data.jwt.is_hm_employee != "TRUE"

{
  "requestId": "1",
  "resourceInstances": {
    "prod": {
      "actions": {
        "read": "EFFECT_DENY"
      }
    }
  },
  "meta": {
    "resourceInstances": {
      "prod": {
        "actions": {
          "read": {
            "matchedPolicy": "resource.businessassets.v1"
          }
        },
        "effectiveDerivedRoles": []
      }
    }
  }
}

auxData

aux_data