cerbos - campaign - authorization

derived_roles_campaign.yaml

---
apiVersion: "api.cerbos.dev/v1"
derivedRoles:
  name: campaign_roles
  definitions:
    - name: campaign_owner
      parentRoles: ["user"]
      condition:
        match:
          expr: request.resource.attr.campaign.owner == request.principal.id

derived_roles_common.yaml

---
apiVersion: "api.cerbos.dev/v1"
derivedRoles:
  name: common_roles
  definitions:
    - name: admin
      parentRoles: ['admin']
    - name: owner
      parentRoles: ["user"]
      condition:
        match:
          expr: request.resource.attr.owner == request.principal.id

request_body.json

{
  "requestId":  "0011",
	"includeMeta": true,
  "actions":  ["create"],
  "resource":  {
    "kind":  "campaign_keyword:object",
    "instances": {
      "0": {
        "attr":  {
					"id": "0",
					"campaign": {
						"owner": "alicia"
					}
        }
      }
    }
  },
  "principal":  {
    "id":  "alicia",
    "roles":  ["user"]
  }
}

resource_campaign.yaml

---
apiVersion: api.cerbos.dev/v1
resourcePolicy:
  version: "default"
  importDerivedRoles:
    - common_roles
  resource: "campaign:object"
  rules:
    - actions: ['create']
      effect: EFFECT_ALLOW
      roles:
      - user

    # UPDATE Policies
    # Currently on the display names of the campaigns can be updated
    # by the admins or the owners of the campaigns.
    - actions: ['update:displayName']
      effect: EFFECT_ALLOW
      derivedRoles:
        - owner

resource_campaign_keyword.yaml

---
apiVersion: api.cerbos.dev/v1
resourcePolicy:
  version: "default"

  # When I omit `common_roles` below, the principal gets the `campaign_owner`
  # derived role successfully. Otherwise the user doesn't get any derived role.
  importDerivedRoles:
  - campaign_roles
  - common_roles

  resource: "campaign_keyword:object"
  rules:
    - actions: ["create"]
      effect: EFFECT_ALLOW
      derivedRoles:
      - campaign_owner

    - actions: ["delete"]
      effect: EFFECT_ALLOW
      derivedRoles:
        - campaign_owner