francium-lupe

def update_post(user, post)
	if not user.admin?
		raise Forbidden, "you must be an admin to update this post"
	end
	...
end

francium-lupe

const requiredRoles = {
  '/vehicle/lock-vehicle': new Set(['admin', 'manager', 'booked-user']),
  '/vehicle/unlock-vehicle': new Set(['admin', 'manager', 'booked-user']),
  '/vehicle/update': new Set(['admin', 'manager']),
  '/vehicle/update-authorized-users': new Set(['admin'])
};

francium-lupe

if (endpoint && endpoint in requiredRoles) {
  if (!roles.find(role => requiredRoles[endpoint].has(role))) {
    throw new BadRequest(
      `User not authorized for action ${actionName}, has roles "${roles}"`
    );
  }
}

francium-lupe

actor User {}

# "admin" is a global role that applies to all vehicles
global {
  roles = ["admin"];
}

resource Vehicle {
  permissions = ["security", "update", "updateAuthorizedUsers"];
  roles = ["admin", "manager", "booked-user"];

francium-lupe

actor User {}

resource Vehicle {
  permissions = ["security", "update", "updateAuthorizedUsers"];
  roles = ["admin", "manager", "booked-user"];

  "security" if "booked-user";
  "update" if "manager";
  "updateAuthorizedUsers" if "admin";

francium-lupe

import { Oso } from 'oso';

class User {
  constructor(roles) {
    this.roles = roles;
  }
}
class Vehicle {
  constructor(id) {
    this.id = id;

francium-lupe

function getRolesForUser(user) {
  if (user._id.toString() === this.userId.toString()) {
    return ['booked-user'];
  }
  return [];
}

francium-lupe

actor User {}

global {
  roles = ["admin"];
}

resource Vehicle {
  permissions = ["security", "update", "updateAuthorizedUsers"];
  roles = ["admin", "manager", "driver"];
  relations = { currentlyBookedBy: User };

francium-lupe

const express = require('express');
const app = express();
app.use(express.json());
app.use(function(req, res, next) {
  console.log(new Date(), req.method, req.url);
  next();
});

const threads = [];
const users = [];

francium-lupe

def update_post(user, post)
	if not user.admin?
		raise Forbidden, "you must be an admin to update this post"
	end
	...
end