lforite

SELECT * FROM MYTABLE

lforite

  "HasProject" should {
    "return true for any user who has this project" in {
      forAll("projectId", "allProjects") { (projectId: UUID, allProjects: Set[UUID]) =>
        val projects = (allProjects + projectId).toSeq
  
        HasProject(projectId).evaluate(
          Token(..., projectIds = projectIds)
        ) mustBe true
      }
    }

lforite

"&& should respect AND boolean logic" in forAll() { (boolean1: Boolean, boolean2: Boolean) =>
  val anyToken = Token(...)
  val predicate1 = new AuthorizationPredicate {
    override def evaluate(token: token): Boolean = boolean1
  }
  val predicate2 = new AuthorizationPredicate {
    override def evaluate(token: token): Boolean = boolean2
  }
  
  (predicate1 && predicate2).evaluate(anyToken) mustBe (boolean1 && boolean2)

lforite

import AuthorizationOps._

(
  (HasClient(request.clientId) && 
     HasProjects(request.projects)) && 
    (HasPermission("data.write") || ("data.all"))
).authorize(token) {
  // your code if authorized
}

lforite

implicit AuthorizationOps(predicate: AuthorizationPredicate) { 
   def authorize[T](token: Token)(f: => Future[T]): Future[T] {
     if(predicate.evaluate(token)) {
        f()
      } else {
       Future.failed(AuthorizationException("..."))
      }
   }
}

lforite

(
  HasClient(request.clientId) && 
    HasProjects(request.projects) && 
    (
      HasPermission("data.write") || 
      HasPermission("data.all")
    )
).evaluate(token)

lforite

trait AuthorizationPredicate { self =>
  def evaluate(token: Token): Boolean
   
  def &&(predicate: AuthorizationPredicate): AuthorizationPredicate = new AuthorizationPredicate {
    override def evaluate(token: Token): Boolean = self.evaluate(token) && predicate.evaluate(token)
  }

  def ||(predicate: AuthorizationPredicate): AuthorizationPredicate = new AuthorizationPredicate {
    override def evaluate(token: token): Boolean = self.evaluate(token) || predicate.evaluate(token)
  }

lforite

case class HasPermission(permission: String) extends AuthorizationPredicate {
    override def evaluate(token: Token): Boolean = token.permissions.contains(permission)
}

case class HasPermissions(permissions: List[String]) extends AuthorizationPredicate {
    override def evaluate(token: Token): Boolean = permission.forall(token.permissions.contains)
}

case class HasClient(clientId: UUID) extends AuthorizationPredicate {
    override def evaluate(token: Token): Boolean = token.clientId == clientId

lforite

val alwaysTruePredicate = new AuthorizationPredicate {
  override def evaluate(token: Token): Boolean = true
}
val isAuthorized = alwaysTruePredicate.evaluate(token) //will always be true

lforite

trait AuthorizationPredicate {
  def evaluate(token: Token): Boolean
}