npm install --save iam-policies

yarn add iam-policies

const { IdentityBasedPolicy, ResourceBasedPolicy } = require("iam-policies")

const allowExample = new IdentityBasedPolicy([
  {
    effect: "allow", // 可选的， 默认值'allow'
    resource: ["secrets:${user.id}:*"], // 嵌入值
    action: ["read", "write"]
  },
  {
    resource: ["bd:company:*"],
    action: "create"
  }
])

const contextForAllowExample = { user: { id: 456 } }

allowExample.evaluate({
  action: "read",
  resource: "secrets:456:ultraSecret",
  context: contextForAllowExample
}) // true
allowExample.evaluate({
  action: "create",
  resource: "secrets:456:ultraSecret",
  context: contextForAllowExample
}) // false
allowExample.evaluate({
  action: "create",
  resource: "bd:company:account",
  context: contextForAllowExample
}) // true
allowExample.evaluate({
  action: "read",
  resource: "bd:company:account",
  context: contextForAllowExample
}) // false

const denyExample = new IdentityBasedPolicy([
  {
    resource: ["secrets:${user.bestFriends}:*"],
    action: "read"
  },
  {
    effect: "deny",
    resource: "secrets:123:*",
    action: "read"
  }
])

const contextForDenyExample = { user: { bestFriends: [123, 563, 1211] } }

denyExample.evaluate({
  action: "read",
  resource: "secrets:563:super-secret",
  context: contextForDenyExample
}) // true
denyExample.evaluate({
  action: "read",
  resource: "secrets:123:super-secret",
  context: contextForDenyExample
}) // false

const notActionExample = new IdentityBasedPolicy([
  {
    resource: "bd:company:*",
    notAction: "update"
  }
])

notActionExample.evaluate({
  action: "delete",
  resource: "bd:company:account"
}) // true
notActionExample.evaluate({
  action: "update",
  resource: "bd:company:account"
}) // false

const notResourceExample = new IdentityBasedPolicy([
  {
    notResource: ["bd:roles:*"],
    action: "update"
  }
])

notResourceExample.evaluate({
  action: "update",
  resource: "photos"
}) // true
notResourceExample.evaluate({
  action: "update",
  resource: "bd:roles:admin"
}) // false

const adminExample = new IdentityBasedPolicy([
  {
    resource: "*",
    action: "*"
  }
])

adminExample.evaluate({
  action: "read",
  resource: "someResource"
}) // true
adminExample.evaluate({
  action: "write",
  resource: "otherResource"
}) // true

const conditions = {
  greaterThan: function (data, expected) {
    return data > expected
  }
}

const conditionExample = new IdentityBasedPolicy(
  [
    {
      resource: "secrets:*",
      action: ["read", "write"],
      condition: {
        greaterThan: {
          "user.age": 18
        }
      }
    }
  ],
  conditions
)

conditionExample.evaluate({
  action: "read",
  resource: "secrets:code",
  context: { user: { age: 19 } }
}) // true
conditionExample.evaluate({
  action: "read",
  resource: "secrets:admin:super-secret",
  context: {
    user: { age: 18 }
  }
}) // false

const principalExample = new ResourceBasedPolicy([
  {
    principal: "1",
    effect: "allow",
    resource: ["secrets:user:*"],
    action: ["read", "write"]
  },
  {
    principal: { id: "2" },
    resource: "bd:company:*",
    notAction: "update"
  }
])

principalExample.evaluate({
  principal: "1",
  action: "read",
  resource: "secrets:user:name"
}) // true
principalExample.evaluate({
  principal: "2",
  action: "read",
  resource: "secrets:user:super-secret"
}) // false
principalExample.evaluate({
  principal: "2",
  action: "read",
  resource: "bd:company:name",
  principalType: "id"
}) // true
principalExample.evaluate({
  principal: "2",
  action: "update",
  resource: "bd:company:name",
  principalType: "id"
}) // false

const notPrincipalExample = new ResourceBasedPolicy([
  {
    notPrincipal: ["1", "2"],
    resource: ["secrets:bd:*"],
    action: "read"
  },
  {
    notPrincipal: { id: "3" },
    resource: "secrets:admin:*",
    action: "read"
  }
])

notPrincipalExample.evaluate({
  principal: "3",
  action: "read",
  resource: "secrets:bd:tables"
}) // true
notPrincipalExample.evaluate({
  principal: "1",
  action: "read",
  resource: "secrets:bd:tables"
}) // false
notPrincipalExample.evaluate({
  principal: "1",
  action: "read",
  resource: "secrets:admin:friends",
  principalType: "id"
}) // true
notPrincipalExample.evaluate({
  principal: "3",
  action: "read",
  resource: "secrets:admin:friends",
  principalType: "id"
}) // false

const canAndCannotStatements = [
  {
    effect: "allow", // 可选的， 默认值'allow
    resource: ["website:${division.companyId}:${division.countryId}:*/*"],
    action: ["create", "update", "delete"]
  },
  {
    effect: "deny",
    resource: ["website:${division.companyId}:${division.countryId}:city/lima"],
    action: "delete"
  }
]

const inclusivePolicy = new IdentityBasedPolicy(canAndCannotStatements)

const contextCanAndCannot = {
  division: {
    companyId: 123,
    countryId: 456
  }
}

const canAndCannotDeniedArgument = {
  action: "delete",
  resource: "website:123:456:city/lima",
  context: contextCanAndCannot
}

inclusivePolicy.evaluate(canAndCannotDeniedArgument) // false
// 到这里， 我们还不确定参数是被拒绝还是不存在

inclusivePolicy.can(canAndCannotDeniedArgument) // true
// 是一个存在的允许政策， 所以应该是被拒绝了， 是吧？

inclusivePolicy.cannot(canAndCannotDeniedArgument) // true
// 事实证明， 我是对的。

const canAndCannotNotPresentArgument = {
  action: "read",
  resource: "website:123:456:}city/lima",
  context: contextCanAndCannot
}

inclusivePolicy.evaluate(canAndCannotNotPresentArgument) // false
// 在这里用户没有访问权限， 但是为什么呐， 我们看看

inclusivePolicy.can(canAndCannotNotPresentArgument) // false
// 这不是一个存在的允许政策， 但是是被拒绝了吗？

inclusivePolicy.cannot(canAndCannotNotPresentArgument) // false
// 不是的， 它不在那。

const { IdentityBasedPolicy } = require("iam-policies")

const identityBasedPolicy = new IdentityBasedPolicy(
  Statement,
  conditionResolver
)

const { ResourceBasedPolicy } = require("iam-policies")

const resourceBasedPolicy = new ResourceBasedPolicy(
  Statement,
  conditionResolver
)

const { getValueFromPath } = require("iam-policies")

const value = getValueFromPath(data, path)

const { applyContext } = require("iam-policies")

const embeddedStr = applyContext(str, context)