simple-zanzibar 0.2.0

A simplified Rust implementation of Google's Zanzibar authorization system with DSL support
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97

//! Tests for the core evaluation logic.

use simple_zanzibar::{
    ZanzibarService,
    error::ZanzibarError,
    model::{
        NamespaceConfig, Object, Relation, RelationConfig, RelationTuple, User, UsersetExpression,
    },
};

/// Creates a `ZanzibarService` pre-populated with a common test configuration.
fn create_test_service() -> ZanzibarService {
    let mut service = ZanzibarService::new();

    let doc_namespace = NamespaceConfig::new("doc")
        .with_relation(RelationConfig::new(Relation::new("parent")))
        .with_relation(RelationConfig::new(Relation::new("owner")))
        .with_relation(RelationConfig::new(Relation::new("viewer")).with_rewrite(
            UsersetExpression::Union(vec![
                UsersetExpression::This,
                UsersetExpression::ComputedUserset {
                    relation: Relation::new("owner"),
                },
                UsersetExpression::TupleToUserset {
                    tupleset_relation: Relation::new("parent"),
                    computed_userset_relation: Relation::new("viewer"),
                },
            ]),
        ));
    service.add_config(doc_namespace);

    let folder_namespace =
        NamespaceConfig::new("folder").with_relation(RelationConfig::new(Relation::new("viewer")));
    service.add_config(folder_namespace);

    service
}

#[test]
fn test_should_check_direct_access() -> Result<(), ZanzibarError> {
    let mut service = create_test_service();
    let doc1 = Object::new("doc", "1");
    let alice = User::user_id("alice");
    let owner_rel = Relation::new("owner");

    service.write_tuple(RelationTuple::new(
        doc1.clone(),
        owner_rel.clone(),
        alice.clone(),
    ))?;

    assert!(service.check(&doc1, &owner_rel, &alice)?);
    Ok(())
}

#[test]
fn test_should_check_computed_userset() -> Result<(), ZanzibarError> {
    let mut service = create_test_service();
    let doc1 = Object::new("doc", "1");
    let alice = User::user_id("alice");
    let owner_rel = Relation::new("owner");
    let viewer_rel = Relation::new("viewer");

    service.write_tuple(RelationTuple::new(doc1.clone(), owner_rel, alice.clone()))?;

    // Alice is an owner, so she should also be a viewer via ComputedUserset.
    assert!(service.check(&doc1, &viewer_rel, &alice)?);
    Ok(())
}

#[test]
fn test_should_check_hierarchical_access() -> Result<(), ZanzibarError> {
    let mut service = create_test_service();

    let folder_a = Object::new("folder", "A");
    let doc1 = Object::new("doc", "1");
    let bob = User::user_id("bob");
    let viewer_rel = Relation::new("viewer");

    // Bob can view Folder A
    service.write_tuple(RelationTuple::new(
        folder_a.clone(),
        viewer_rel.clone(),
        bob.clone(),
    ))?;

    // Doc 1 is in Folder A
    service.write_tuple(RelationTuple::new(
        doc1.clone(),
        Relation::new("parent"),
        User::userset(folder_a, Relation::new("viewer")),
    ))?;

    // Assert that Bob can view Doc 1 due to inheritance.
    assert!(service.check(&doc1, &viewer_rel, &bob)?);
    Ok(())
}