diff --git a/examples/v0/example.go b/examples/v0/example.go deleted file mode 100644 index a5b5109..0000000 --- a/examples/v0/example.go +++ /dev/null @@ -1,123 +0,0 @@ -package main - -import ( - "context" - "log" - - v0 "github.com/authzed/authzed-go/proto/authzed/api/v0" - "github.com/authzed/authzed-go/v0" -) - -const ( - documentNS = "yourtenant/document" - userNS = "yourtenant/user" -) - -func main() { - // Create an Authzed client. - client, err := authzed.NewClient( - "grpc.authzed.com:443", - authzed.Token("t_your_token_here_1234567deadbeef"), - authzed.SystemCerts(authzed.VerifyCA), - ) - if err != nil { - log.Fatalf("unable to initialize client: %s", err) - } - - // Create some objects that will be protected by Authzed. - aDoc := createObject(documentNS, "doc1") - anOwner := createObject(userNS, "theowner")("...") - anEditor := createObject(userNS, "userwhocanedit")("...") - aViewer := createObject(userNS, "viewonlyuser")("...") - - // Create some tuples that represent roles granted between users and objects. - resp, err := client.Write(context.Background(), &v0.WriteRequest{ - Updates: []*v0.RelationTupleUpdate{ - createTuple(tuple(aDoc("owner"), anOwner)), - createTuple(tuple(aDoc("contributor"), anEditor)), - createTuple(tuple(aDoc("viewer"), aViewer)), - }, - }) - if err != nil { - log.Fatalf("unable to write tuples: %s", err) - } - - // Save the revision from the Write for future requests in order to enforce - // that responses are at least as fresh as our last write. - // - // We recommend saving this from any call to Write or ContentChangeCheck, - // and storing it alongside the object referenced in the write or check (in this case aDoc)" - // - // For more info see: - // https://docs.authzed.com/authz/new-enemy - whenPermsChanged := resp.Revision - - // Run some permission checks on the written data. - aNobody := createObject(userNS, "randomnobody")("...") - expected := []checkData{ - {permission: aDoc("read"), user: anOwner, hasAccess: true}, - {permission: aDoc("write"), user: anOwner, hasAccess: true}, - {permission: aDoc("delete"), user: anOwner, hasAccess: true}, - {permission: aDoc("read"), user: anEditor, hasAccess: true}, - {permission: aDoc("write"), user: anEditor, hasAccess: true}, - {permission: aDoc("delete"), user: anEditor, hasAccess: false}, - {permission: aDoc("read"), user: aViewer, hasAccess: true}, - {permission: aDoc("write"), user: aViewer, hasAccess: false}, - {permission: aDoc("delete"), user: aViewer, hasAccess: false}, - {permission: aDoc("read"), user: aNobody, hasAccess: true}, - {permission: aDoc("write"), user: aNobody, hasAccess: false}, - {permission: aDoc("delete"), user: aNobody, hasAccess: false}, - } - - for _, test := range expected { - testResp, err := client.Check(context.Background(), &v0.CheckRequest{ - TestUserset: test.permission, - User: &v0.User{UserOneof: &v0.User_Userset{ - Userset: test.user, - }}, - AtRevision: whenPermsChanged, // Guarantee checks occur on data fresher than the write. - }) - if err != nil { - log.Fatalf("unable to run check request: %s", err) - } - - hasAccess := testResp.GetMembership() == v0.CheckResponse_MEMBER - if hasAccess != test.hasAccess { - log.Fatalf("check returned the wrong result: %v", test) - } - } -} - -type checkData struct { - permission *v0.ObjectAndRelation - user *v0.ObjectAndRelation - hasAccess bool -} - -func createObject(namespace, objectID string) func(string) *v0.ObjectAndRelation { - return func(relation string) *v0.ObjectAndRelation { - return &v0.ObjectAndRelation{ - Namespace: namespace, - ObjectId: objectID, - Relation: relation, - } - } -} - -func tuple(onr *v0.ObjectAndRelation, userset *v0.ObjectAndRelation) *v0.RelationTuple { - return &v0.RelationTuple{ - ObjectAndRelation: onr, - User: &v0.User{ - UserOneof: &v0.User_Userset{ - Userset: userset, - }, - }, - } -} - -func createTuple(tpl *v0.RelationTuple) *v0.RelationTupleUpdate { - return &v0.RelationTupleUpdate{ - Operation: v0.RelationTupleUpdate_CREATE, - Tuple: tpl, - } -} diff --git a/examples/v0/yourtenant.yaml b/examples/v0/yourtenant.yaml deleted file mode 100644 index 44355e9..0000000 --- a/examples/v0/yourtenant.yaml +++ /dev/null @@ -1,71 +0,0 @@ -# This file contains the namespace configuration for basic example. - -# This section contains the tenant configuration itself. -namespace_configs: -- | - name: "yourtenant/user" - -- | - name: "yourtenant/document" - - relation { - name: "read" - - userset_rewrite { - union { - child { computed_userset { relation: "viewer" } } - child { computed_userset { relation: "contributor" } } - child { computed_userset { relation: "owner" } } - } - } - } - relation { - name: "write" - - userset_rewrite { - union { - child { computed_userset { relation: "contributor" } } - child { computed_userset { relation: "owner" } } - } - } - } - relation { - name: "delete" - - userset_rewrite { - union { - child { computed_userset { relation: "owner" } } - } - } - } - - relation { - name: "viewer" - } - relation { - name: "contributor" - } - relation { - name: "owner" - } - -# This section contains example tuples that will be written to the tenant, -# which can be used to validate the tenant configuration offline. -validation_tuples: -- yourtenant/document:doc1#owner@yourtenant/user:theowner#... -- yourtenant/document:doc1#contributor@yourtenant/user:userwhocanedit#... -- yourtenant/document:doc1#viewer@yourtenant/user:viewonlyuser#... - -# This section contains validation blocks that check the specific membership -# of the various grantable permissions. Validation will fail if the list of -# entities computed to have access differs in any way from the list declared. -validation: - yourtenant/document:doc1#read: - - '[yourtenant/user:viewonlyuser#...] is ' - - '[yourtenant/user:userwhocanedit#...] is ' - - '[yourtenant/user:theowner#...] is ' - yourtenant/document:doc1#write: - - '[yourtenant/user:userwhocanedit#...] is ' - - '[yourtenant/user:theowner#...] is ' - yourtenant/document:doc1#delete: - - '[yourtenant/user:theowner#...] is ' diff --git a/examples/v1alpha1/schema_write_example.go b/examples/v1alpha1/schema_write_example.go deleted file mode 100644 index 5c80cac..0000000 --- a/examples/v1alpha1/schema_write_example.go +++ /dev/null @@ -1,37 +0,0 @@ -package main - -import ( - "context" - "log" - - pb "github.com/authzed/authzed-go/proto/authzed/api/v1alpha1" - authzed "github.com/authzed/authzed-go/v1alpha1" - "github.com/authzed/grpcutil" -) - -const schema = `definition blog/user {} - -definition blog/post { - relation reader: blog/user - relation writer: blog/user - - permission read = reader + writer - permission write = writer -}` - -func main() { - client, err := authzed.NewClient( - "grpc.authzed.com:443", - grpcutil.WithBearerToken("t_your_token_here_1234567deadbeef"), - grpcutil.WithSystemCerts(false), - ) - if err != nil { - log.Fatalf("unable to initialize client: %s", err) - } - - request := &pb.WriteSchemaRequest{Schema: schema} - _, err = client.WriteSchema(context.Background(), request) - if err != nil { - log.Fatalf("failed to write schema: %s", err) - } -}