surrealdb-sql 1.1.0

Full type definitions for the SurrealQL query language
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

use std::str::FromStr;

use cedar_policy::PolicySet;
use once_cell::sync::Lazy;

pub static POLICY_SET: Lazy<PolicySet> = Lazy::new(|| {
	PolicySet::from_str(
    r#"
    // All roles can view all resources on the same level hierarchy or below
    permit(
        principal,
        action == Action::"View", 
        resource
    ) when {
        principal.roles.containsAny([Role::"Viewer", Role::"Editor", Role::"Owner"]) &&
        resource.level in principal.level
    };

    // Editor role can edit all non-IAM resources on the same level hierarchy or below
    permit(
        principal,
        action == Action::"Edit",
        resource
    ) when {
        principal.roles.contains(Role::"Editor") &&
        resource.level in principal.level &&
        ["Namespace", "Database", "Scope", "Table", "Document", "Option", "Function", "Analyzer", "Parameter", "Event", "Field", "Index"].contains(resource.type)
    };

    // Owner role can edit all resources on the same level hierarchy or below
    permit(
        principal,
        action == Action::"Edit",
        resource
    ) when {
        principal.roles.contains(Role::"Owner") &&
        resource.level in principal.level
    };
"#).unwrap()
});