zift 0.2.2

Scan codebases for embedded authorization logic and generate Policy as Code (Rego/OPA today)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82

[rule]
id = "py-permission-check-call"
languages = ["python"]
category = "abac"
confidence = "high"
description = "Permission or capability check method call (e.g. user.can(\"delete\"))"
# Catches the allow-style ABAC family: `can`, `is_allowed`, `allows`,
# `has_access`, `check_access`, `has_permission`, `check_permission`.
# Deny-style methods (`cannot`, `denies`) are intentionally excluded —
# the rego template below is allow-style, and emitting it for a deny
# call would invert the semantics. Deep mode picks up those calls.
# Django's `has_perm`/`has_perms` are also excluded — they have a
# dedicated RBAC-flavored rule (`py-has-perm-call`) so the same call
# doesn't surface as both abac and rbac findings. The anchored
# alternation below already excludes both groups.
query = """
(call
  function: (attribute
    attribute: (identifier) @method)
  arguments: (argument_list
    (string (string_content) @permission))
) @match
"""

[rule.predicates.method]
match = "^(can|has_permission|check_permission|is_allowed|allows|has_access|check_access)$"

[rule.rego_template]
template = """
default allow := false

allow if {
    input.action == "{{permission}}"
}
"""


[rule.cedar_template]
template = """
permit (
    principal,
    action,
    resource
)
when {
    action == Action::"{{permission}}"
};
"""
[[rule.tests]]
input = """
if user.can("delete"):
    delete_resource()
"""
expect_match = true

[[rule.tests]]
input = """
if policy.is_allowed("read"):
    read()
"""
expect_match = true

[[rule.tests]]
input = """
if account.has_access("billing"):
    show_billing()
"""
expect_match = true

[[rule.tests]]
input = """
if user.has_perm("blog.add_post"):
    create_post()
"""
expect_match = false

[[rule.tests]]
input = """
if cache.has_value("foo"):
    use_it()
"""
expect_match = false