|
| 1 | +package main |
| 2 | + |
| 3 | +import ( |
| 4 | + "context" |
| 5 | + "fmt" |
| 6 | + "log" |
| 7 | + "os" |
| 8 | + "time" |
| 9 | + |
| 10 | + "github.com/pangeacyber/pangea-go/pangea-sdk/v3/pangea" |
| 11 | + "github.com/pangeacyber/pangea-go/pangea-sdk/v3/service/authz" |
| 12 | +) |
| 13 | + |
| 14 | +const ( |
| 15 | + namespaceFolder = "folder" |
| 16 | + namespaceUser = "user" |
| 17 | + relationOwner = "owner" |
| 18 | + relationEditor = "editor" |
| 19 | + relationReader = "reader" |
| 20 | +) |
| 21 | + |
| 22 | +func main() { |
| 23 | + var timeNow = time.Now() |
| 24 | + var timeStr = timeNow.Format("20060102_150405") |
| 25 | + var folder1 = "folder_1_" + timeStr |
| 26 | + var folder2 = "folder_2_" + timeStr |
| 27 | + var user1 = "user_1_" + timeStr |
| 28 | + var user2 = "user_2_" + timeStr |
| 29 | + |
| 30 | + // Load Pangea token from environment variables |
| 31 | + token := os.Getenv("PANGEA_AUTHZ_TOKEN") |
| 32 | + if token == "" { |
| 33 | + log.Fatal("Unauthorized: No token present.") |
| 34 | + } |
| 35 | + |
| 36 | + ctx, cancelFn := context.WithTimeout(context.Background(), 120*time.Second) |
| 37 | + defer cancelFn() |
| 38 | + |
| 39 | + // create a new AuthZ client with pangea token and domain |
| 40 | + client := authz.New(&pangea.Config{ |
| 41 | + Token: token, |
| 42 | + Domain: os.Getenv("PANGEA_DOMAIN"), |
| 43 | + QueuedRetryEnabled: true, |
| 44 | + PollResultTimeout: 120 * time.Second, |
| 45 | + Retry: true, |
| 46 | + RetryConfig: &pangea.RetryConfig{ |
| 47 | + RetryMax: 4, |
| 48 | + }, |
| 49 | + }) |
| 50 | + |
| 51 | + // Create tuples |
| 52 | + fmt.Println("Creating tuples...") |
| 53 | + _, err := client.TupleCreate(ctx, &authz.TupleCreateRequest{ |
| 54 | + Tuples: []authz.Tuple{ |
| 55 | + authz.Tuple{ |
| 56 | + Resource: authz.Resource{ |
| 57 | + Namespace: namespaceFolder, |
| 58 | + ID: folder1, |
| 59 | + }, |
| 60 | + Relation: relationReader, |
| 61 | + Subject: authz.Subject{ |
| 62 | + Namespace: namespaceUser, |
| 63 | + ID: user1, |
| 64 | + }, |
| 65 | + }, |
| 66 | + authz.Tuple{ |
| 67 | + Resource: authz.Resource{ |
| 68 | + Namespace: namespaceFolder, |
| 69 | + ID: folder1, |
| 70 | + }, |
| 71 | + Relation: relationEditor, |
| 72 | + Subject: authz.Subject{ |
| 73 | + Namespace: namespaceUser, |
| 74 | + ID: user2, |
| 75 | + }, |
| 76 | + }, |
| 77 | + authz.Tuple{ |
| 78 | + Resource: authz.Resource{ |
| 79 | + Namespace: namespaceFolder, |
| 80 | + ID: folder2, |
| 81 | + }, |
| 82 | + Relation: relationEditor, |
| 83 | + Subject: authz.Subject{ |
| 84 | + Namespace: namespaceUser, |
| 85 | + ID: user1, |
| 86 | + }, |
| 87 | + }, |
| 88 | + authz.Tuple{ |
| 89 | + Resource: authz.Resource{ |
| 90 | + Namespace: namespaceFolder, |
| 91 | + ID: folder2, |
| 92 | + }, |
| 93 | + Relation: relationOwner, |
| 94 | + Subject: authz.Subject{ |
| 95 | + Namespace: namespaceUser, |
| 96 | + ID: user2, |
| 97 | + }, |
| 98 | + }, |
| 99 | + }, |
| 100 | + }) |
| 101 | + if err != nil { |
| 102 | + log.Fatalf("Unexpected error.", err) |
| 103 | + } |
| 104 | + fmt.Println("Tuples created.") |
| 105 | + |
| 106 | + // Tuple list with resource |
| 107 | + fmt.Println("Listing tuples with resource...") |
| 108 | + filter := authz.NewFilterUserList() |
| 109 | + filter.ResourceNamespace().Set(pangea.String(namespaceFolder)) |
| 110 | + filter.ResourceID().Set(pangea.String(folder1)) |
| 111 | + |
| 112 | + rListWithResource, err := client.TupleList(ctx, &authz.TupleListRequest{ |
| 113 | + Filter: filter.Filter(), |
| 114 | + }) |
| 115 | + if err != nil { |
| 116 | + log.Fatalf("Unexpected error.", err) |
| 117 | + } |
| 118 | + |
| 119 | + fmt.Printf("Got %d tuples.\n", rListWithResource.Result.Count) |
| 120 | + for i, tuple := range rListWithResource.Result.Tuples { |
| 121 | + fmt.Printf("Tuple #%d\n", i) |
| 122 | + fmt.Printf("\tNamespace: %s\n", tuple.Subject.Namespace) |
| 123 | + fmt.Printf("\tID: %s\n", tuple.Subject.ID) |
| 124 | + } |
| 125 | + |
| 126 | + // Tuple list with subject |
| 127 | + filter = authz.NewFilterUserList() |
| 128 | + fmt.Println("Listing tuples with subject...") |
| 129 | + filter.SubjectNamespace().Set(pangea.String(namespaceUser)) |
| 130 | + filter.SubjectID().Set(pangea.String(user1)) |
| 131 | + |
| 132 | + rListWithSubject, err := client.TupleList(ctx, &authz.TupleListRequest{ |
| 133 | + Filter: filter.Filter(), |
| 134 | + }) |
| 135 | + if err != nil { |
| 136 | + log.Fatalf("Unexpected error.", err) |
| 137 | + } |
| 138 | + |
| 139 | + fmt.Printf("Got %d tuples.\n", rListWithSubject.Result.Count) |
| 140 | + for i, tuple := range rListWithResource.Result.Tuples { |
| 141 | + fmt.Printf("Tuple #%d\n", i) |
| 142 | + fmt.Printf("\tNamespace: %s\n", tuple.Subject.Namespace) |
| 143 | + fmt.Printf("\tID: %s\n", tuple.Subject.ID) |
| 144 | + } |
| 145 | + |
| 146 | + // Tuple delete |
| 147 | + fmt.Println("Deleting tuples...") |
| 148 | + _, err = client.TupleDelete(ctx, &authz.TupleDeleteRequest{ |
| 149 | + Tuples: []authz.Tuple{ |
| 150 | + authz.Tuple{ |
| 151 | + Resource: authz.Resource{ |
| 152 | + Namespace: namespaceFolder, |
| 153 | + ID: folder1, |
| 154 | + }, |
| 155 | + Relation: relationReader, |
| 156 | + Subject: authz.Subject{ |
| 157 | + Namespace: namespaceUser, |
| 158 | + ID: user1, |
| 159 | + }, |
| 160 | + }, |
| 161 | + }, |
| 162 | + }) |
| 163 | + if err != nil { |
| 164 | + log.Fatalf("Unexpected error.", err) |
| 165 | + } |
| 166 | + fmt.Println("Delete success.") |
| 167 | + |
| 168 | + // Check no debug |
| 169 | + fmt.Println("Checking tuple...") |
| 170 | + rCheck, err := client.Check(ctx, &authz.CheckRequest{ |
| 171 | + Resource: authz.Resource{ |
| 172 | + Namespace: namespaceFolder, |
| 173 | + ID: folder1, |
| 174 | + }, |
| 175 | + Action: "reader", |
| 176 | + Subject: authz.Subject{ |
| 177 | + Namespace: namespaceUser, |
| 178 | + ID: user2, |
| 179 | + }, |
| 180 | + }) |
| 181 | + if err != nil { |
| 182 | + log.Fatalf("Unexpected error.", err) |
| 183 | + } |
| 184 | + |
| 185 | + if rCheck.Result.Allowed { |
| 186 | + fmt.Println("Subject IS allowed to read resource") |
| 187 | + } else { |
| 188 | + fmt.Println("Subject is NOT allowed to read resource") |
| 189 | + } |
| 190 | + |
| 191 | + // Check debug |
| 192 | + fmt.Println("Checking tuple with debug enabled...") |
| 193 | + rCheck, err = client.Check(ctx, &authz.CheckRequest{ |
| 194 | + Resource: authz.Resource{ |
| 195 | + Namespace: namespaceFolder, |
| 196 | + ID: folder1, |
| 197 | + }, |
| 198 | + Action: "editor", |
| 199 | + Subject: authz.Subject{ |
| 200 | + Namespace: namespaceUser, |
| 201 | + ID: user2, |
| 202 | + }, |
| 203 | + Debug: pangea.Bool(true), |
| 204 | + }) |
| 205 | + if err != nil { |
| 206 | + log.Fatalf("Unexpected error.", err) |
| 207 | + } |
| 208 | + |
| 209 | + if rCheck.Result.Allowed { |
| 210 | + fmt.Println("Subject IS allowed to edit resource") |
| 211 | + } else { |
| 212 | + fmt.Println("Subject is NOT allowed to edit resource") |
| 213 | + } |
| 214 | + if rCheck.Result.Debug != nil { |
| 215 | + fmt.Printf("Debug data: %s\n", pangea.Stringify(*rCheck.Result.Debug)) |
| 216 | + } |
| 217 | + |
| 218 | + // List resources |
| 219 | + fmt.Println("Listing resources...") |
| 220 | + rListResources, err := client.ListResources(ctx, &authz.ListResourcesRequest{ |
| 221 | + Namespace: namespaceFolder, |
| 222 | + Action: relationEditor, |
| 223 | + Subject: authz.Subject{ |
| 224 | + Namespace: namespaceUser, |
| 225 | + ID: user2, |
| 226 | + }, |
| 227 | + }) |
| 228 | + if err != nil { |
| 229 | + log.Fatalf("Unexpected error.", err) |
| 230 | + } |
| 231 | + |
| 232 | + fmt.Printf("Got %d resources.\n", len(rListResources.Result.IDs)) |
| 233 | + for i, id := range rListResources.Result.IDs { |
| 234 | + fmt.Printf("Resource #%d. ID: %s\n", i, id) |
| 235 | + } |
| 236 | + |
| 237 | + // List subjects |
| 238 | + fmt.Println("Listing subjects...") |
| 239 | + rListSubjects, err := client.ListSubjects(ctx, &authz.ListSubjectsRequest{ |
| 240 | + Resource: authz.Resource{ |
| 241 | + Namespace: namespaceFolder, |
| 242 | + ID: folder2, |
| 243 | + }, |
| 244 | + Action: relationEditor, |
| 245 | + }) |
| 246 | + if err != nil { |
| 247 | + log.Fatalf("Unexpected error.", err) |
| 248 | + } |
| 249 | + |
| 250 | + fmt.Printf("Got %d subjects.\n", len(rListSubjects.Result.Subjects)) |
| 251 | + for i, subject := range rListSubjects.Result.Subjects { |
| 252 | + fmt.Printf("Tuple #%d\n", i) |
| 253 | + fmt.Printf("\tNamespace: %s\n", subject.Namespace) |
| 254 | + fmt.Printf("\tID: %s\n", subject.ID) |
| 255 | + } |
| 256 | + |
| 257 | +} |
0 commit comments