Writing a Library for Authorization: Vesta

Source Code

Why Create Library

Existing Library Being Too Complex

When working on my project for feelwell.id I need to create an authorization system where only a person assigned to the document are able to modify the document, so it's something like Google Drive's Authorization system. Research is conducted beforehand: I try to see existing libraries which helps with role assigning. Permify pops up as one of the results. It is based on Zanzibar, Google's authorization system. Seeing the complexity of the system though, learning it seems to take more time than needed. Hence, a simpler authorization system would be worth it.

System Explanation

The system is simple: you create a table called Relation with the definition of Subject and Object. The Subject and Object both have a type just in case you have multiple domains. You also have an API to Grant / Revoke / Check. Grant gives a permission to a subject to a given object, Revoke takes away the permission from the subject to a given object, Check determines whether the subject has access to the given object. In order for Check to work, you Register what Evaluators need to be run when Check is being called. For example, here I have list of actions and the list of evaluators that it calls. As you'll see in the example below, the code is relatively simple, and also you'll have fine-grained control as to how you want the object to be accessible.

Example

schema.RegisterAll(neurocommerce.ObjectTypeWorkOrder,
    map[aura.Action]aura.Evaluator{
        // 1.
        neurocommerce.ActionWorkOrderCreate: aura.And(HasRole(neurocommerce.RoleMember)),
        // 2. 
        neurocommerce.ActionWorkOrderUpdate: aura.Direct(neurocommerce.RelationWorkOrderOwner, neurocommerce.ObjectTypeMember),
        // 3.
        neurocommerce.ActionWorkOrderViewDetail: aura.Or(
            aura.Direct(neurocommerce.RelationWorkOrderOwner, neurocommerce.ObjectTypeMember),
            aura.Direct(neurocommerce.RelationWorkOrderAssigned, neurocommerce.ObjectTypeMember),
            HasRole(neurocommerce.RoleSuperAdmin)),
    })

• When creating, the user needs to have role member. That simple
• When updating, the user needs to be an owner. The owner is defined as: you have a Relation row in your Database, where the subjectType = 'member' and relation = 'owner'
• When viewing, the user needs to have a row where subjectType = 'member' and relation = 'owner' or subjectType = ' member' and relation = 'assigned' or they are a super admin

Learning Experience

Creating this takes quite some time, I guess it's around 2 weeks. But it's quite fun regardless and I learned a lot from it. If there's any suggestion you may contact me at my website