Support string paramters and string literal arguments in permits definition

[stonelgh]

The below shows off a naive GCP IAM style authorization model (without conditions and deny policy support).

class Perm implements Namespace {}
class User implements Namespace {}

class Role implements Namespace {
    related: {
      perms: (Perm | SubjectSet<Role, "perms">)[]
    }
  
    permits = {
      has_perm: (ctx: Context, perm: string): boolean => this.related.perms.includes(perm),
    }
}

class Policy implements Namespace {
    related: {
      roles: Role[]
      users: (User | SubjectSet<Group, "members">)[]
    }
  
    permits = {
      has_perm: (ctx: Context, perm: string): boolean => this.related.users.includes(ctx.subject) &&
        this.related.roles.traverse((p) => p.permits.has_perm(ctx, perm)),
    }
}

class Group implements Namespace {
    related: {
      parents: Group[]
      members: (User | SubjectSet<Group, "members">)[]
      policies: Policy[]
    }
  
    permits = {
      check: (ctx: Context, perm: string): boolean => this.related.parents.traverse((p) => p.permits.check(ctx, perm)) ||
        this.related.policies.traverse((p) => p.permits.has_perm(ctx, perm)),
    }
}

class ResourceA implements Namespace {
  related: {
    owners: Group[]
    policies: Policy[]
  }

  permits = {
    check: (ctx: Context, perm: string): boolean => this.related.owners.traverse((p) => p.permits.check(ctx, perm)) ||
      this.related.policies.traverse((p) => p.permits.check(ctx, perm)),
    get: (ctx: Context): boolean => this.permits.check(ctx, "resourceA.get"),
    edit: (ctx: Context): boolean => this.permits.check(ctx, "resourceA.edit"),
  }
}

Given the following relations:

Role:viewer#[email protected]

Policy:viewer#roles@Role:viewer#
Policy:viewer#users@User:bob#

Group:x#members@User:mark#
Group:x#policies@Policy:viewer2#

Policy:viewer2#roles@Role:viewer#
Policy:viewer2#users@User:sandy#

ResourceA:id-1#policies@Policy:viewer#
ResourceA:id-1#owners@Group:x#

The following check will return Allowed:

ResourceA:id-1#get@User:bob
ResourceA:id-1#get@User:sandy

Without the string parameters and string literal arguments support, it will be very hard to implement the model.

[arieltorti]

@stonelgh did you ever find a workaround for this ?

[stonelgh]

We use a trick as implemented by this PR: #1123