npm install --save iam-policies

yarn add iam-policies

// @deno-types="https://raw.githubusercontent.com/roggervalf/iam-policies/master/dist/main.d.ts"
import {
  ActionBasedPolicy,
  IdentityBasedPolicy,
  ResourceBasedPolicy
} from "https://raw.githubusercontent.com/roggervalf/iam-policies/master/dist/main.es.js"

// @deno-types="https://deno.land/x/iam_policies@master/dist/main.d.ts"
import {
  ActionBasedPolicy,
  IdentityBasedPolicy,
  ResourceBasedPolicy
} from "https://deno.land/x/iam_policies@master/dist/main.es.js"

const {
  ActionBasedPolicy,
  IdentityBasedPolicy,
  ResourceBasedPolicy
} = require("iam-policies")

const allowExample = new IdentityBasedPolicy({
  statements: [
    {
      effect: "allow", // optional, defaults to allow
      resource: ["secrets:${user.id}:*"], // embedded value by context
      action: ["read", "write"]
    },
    {
      resource: ["bd:company:*"],
      action: "create"
    }
  ]
})

const contextForAllowExample = { user: { id: 456 } }

allowExample.evaluate({
  action: "read",
  resource: "secrets:456:ultraSecret",
  context: contextForAllowExample
}) // true
allowExample.evaluate({
  action: "create",
  resource: "secrets:456:ultraSecret",
  context: contextForAllowExample
}) // false
allowExample.evaluate({
  action: "create",
  resource: "bd:company:account",
  context: contextForAllowExample
}) // true
allowExample.evaluate({
  action: "read",
  resource: "bd:company:account",
  context: contextForAllowExample
}) // false

const denyExample = new IdentityBasedPolicy({
  statements: [
    {
      resource: ["secrets:${user.bestFriends}:*"],
      action: "read"
    },
    {
      effect: "deny",
      resource: "secrets:123:*",
      action: "read"
    }
  ]
})

const contextForDenyExample = { user: { bestFriends: [123, 563, 1211] } }

denyExample.evaluate({
  action: "read",
  resource: "secrets:563:super-secret",
  context: contextForDenyExample
}) // true
denyExample.evaluate({
  action: "read",
  resource: "secrets:123:super-secret",
  context: contextForDenyExample
}) // false

const notActionExample = new IdentityBasedPolicy({
  statements: [
    {
      resource: "bd:company:*",
      notAction: "update"
    }
  ]
})

notActionExample.evaluate({
  action: "delete",
  resource: "bd:company:account"
}) // true
notActionExample.evaluate({
  action: "update",
  resource: "bd:company:account"
}) // false

const notResourceExample = new IdentityBasedPolicy({
  statements: [
    {
      notResource: ["bd:roles:*"],
      action: "update"
    }
  ]
})

notResourceExample.evaluate({
  action: "update",
  resource: "photos"
}) // true
notResourceExample.evaluate({
  action: "update",
  resource: "bd:roles:admin"
}) // false

const adminExample = new IdentityBasedPolicy({
  statements: [
    {
      resource: "*",
      action: "*"
    }
  ]
})

adminExample.evaluate({
  action: "read",
  resource: "someResource"
}) // true
adminExample.evaluate({
  action: "write",
  resource: "otherResource"
}) // true

const conditionResolver = {
  greaterThan: function (data, expected) {
    return data > expected
  }
}

const conditionExample = new IdentityBasedPolicy({
  statements: [
    {
      resource: "secrets:*",
      action: ["read", "write"],
      condition: {
        greaterThan: {
          "user.age": 18
        }
      }
    }
  ],
  conditionResolver
})

conditionExample.evaluate({
  action: "read",
  resource: "secrets:code",
  context: { user: { age: 19 } }
}) // true
conditionExample.evaluate({
  action: "read",
  resource: "secrets:admin:super-secret",
  context: {
    user: { age: 18 }
  }
}) // false

const principalExample = new ResourceBasedPolicy({
  statements: [
    {
      principal: "1",
      effect: "allow",
      resource: ["secrets:user:*"],
      action: ["read", "write"]
    },
    {
      principal: { id: "2" },
      resource: "bd:company:*",
      notAction: "update"
    }
  ]
})

principalExample.evaluate({
  principal: "1",
  action: "read",
  resource: "secrets:user:name"
}) // true
principalExample.evaluate({
  principal: "2",
  action: "read",
  resource: "secrets:user:super-secret"
}) // false
principalExample.evaluate({
  principal: "2",
  action: "read",
  resource: "bd:company:name",
  principalType: "id"
}) // true
principalExample.evaluate({
  principal: "2",
  action: "update",
  resource: "bd:company:name",
  principalType: "id"
}) // false

const notPrincipalExample = new ResourceBasedPolicy({
  statements: [
    {
      notPrincipal: ["1", "2"],
      resource: ["secrets:bd:*"],
      action: "read"
    },
    {
      notPrincipal: { id: "3" },
      resource: "secrets:admin:*",
      action: "read"
    }
  ]
})

notPrincipalExample.evaluate({
  principal: "3",
  action: "read",
  resource: "secrets:bd:tables"
}) // true
notPrincipalExample.evaluate({
  principal: "1",
  action: "read",
  resource: "secrets:bd:tables"
}) // false
notPrincipalExample.evaluate({
  principal: "1",
  action: "read",
  resource: "secrets:admin:friends",
  principalType: "id"
}) // true
notPrincipalExample.evaluate({
  principal: "3",
  action: "read",
  resource: "secrets:admin:friends",
  principalType: "id"
}) // false

const canAndCannotStatements = [
  {
    effect: "allow", // again, this is optional, as it already defaults to allow
    resource: ["website:${division.companyId}:${division.countryId}:*/*"],
    action: ["create", "update", "delete"]
  },
  {
    effect: "deny",
    resource: ["website:${division.companyId}:${division.countryId}:city/lima"],
    action: "delete"
  }
]

const inclusivePolicy = new IdentityBasedPolicy({
  statements: canAndCannotStatements
})

const contextCanAndCannot = {
  division: {
    companyId: 123,
    countryId: 456
  }
}

const canAndCannotDeniedArgument = {
  action: "delete",
  resource: "website:123:456:city/lima",
  context: contextCanAndCannot
}

inclusivePolicy.evaluate(canAndCannotDeniedArgument) // false
// So far, we are not sure whether the argument is denied or not present.

inclusivePolicy.can(canAndCannotDeniedArgument) // true
// It's present as an allow policy, so it must be explicitly denied, right?

inclusivePolicy.cannot(canAndCannotDeniedArgument) // true
// I knew it!

const canAndCannotNotPresentArgument = {
  action: "read",
  resource: "website:123:456:}city/lima",
  context: contextCanAndCannot
}

inclusivePolicy.evaluate(canAndCannotNotPresentArgument) // false
// Again, the user doesn't have access here, but why? Let's investigate..

inclusivePolicy.can(canAndCannotNotPresentArgument) // false
// It's not present as an allow policy, but is it explicitly denied?

inclusivePolicy.cannot(canAndCannotNotPresentArgument) // false
// Nope, it just isn't there.

const { ActionBasedPolicy } = require("iam-policies")

const actionBasedPolicy = new ActionBasedPolicy({
  statements,
  conditionResolver,
  context
})

const { IdentityBasedPolicy } = require("iam-policies")

const identityBasedPolicy = new IdentityBasedPolicy({
  statements,
  conditionResolver
})

const { ResourceBasedPolicy } = require("iam-policies")

const resourceBasedPolicy = new ResourceBasedPolicy({
  statements,
  conditionResolver,
  context
})

const { getValueFromPath } = require("iam-policies")

const value = getValueFromPath(data, path, defaultValue)

const { applyContext } = require("iam-policies")

const embeddedStr = applyContext(str, context)