Class CedarPermissionsManager

Hierarchy

Implements

Constructors

Properties

_cedarEndpoint?: string
_entityDataEndpoint?: string
_isAuthorizedEndpoint?: string
_policyEndpoint?: string
_roleEdges?: string
schemaManager: SchemaManager

Methods

  • This method builds and returns a Cedar query object.

    Returns

    a Cedar query object.

    Parameters

    • principal: Object

      The principal in the authorisation request. This is the actor and is typically a User.

    • action: String

      The action in the authorisatiton request. This is the verb; what the principal wants to do to the resource.

    • resource: Object

      The resource in the authorisation request. This is the entity being acted on.

    Returns Object

  • This method is used to build the entity data object which will be sent to cedar

    Returns

    The complete entity data object formatted for Cedar.

    Parameters

    • context: KosmosUserContext<object> & {
          src?: string;
      }

      The Kosmos context.

    • principal: Object

      The principal in the authorisation request. This is the actor and is typically a User.

    • resource: Object

      The resource in the authorisation request. This is the entity being acted on.

    • sourceVertex: undefined | Object
    • destinationVertex: undefined | Object
    • requestData: undefined | Object

      The data included in the original request being handled.

    • connectToVertices: undefined | ConnectionToAdd[]

      The Kosmos connectToVertices object, which contains vertices that will be connected to.

    • dataSourceWrapper: DataSourceWrapper

      The Kosmos DataSourceWrapper object.

    Returns Promise<any>

  • This method is used to build the principal entity "attributes" object. Attributes can be "existing" (already exist in storage) or "new" (being added by the current request).

    Returns

    An entity attributes object.

    Parameters

    • context: KosmosUserContext<object> & {
          src?: string;
      }

      The Kosmos context.

    • principal: Object

      The principal object.

    • dataSourceWrapper: DataSourceWrapper

      The Kosmos DataSourceWrapper object.

    Returns Promise<any>

  • This method is used to build the principal's entity data object which will be sent to cedar

    Returns

    The principal's entity data object.

    Parameters

    • context: KosmosUserContext<object> & {
          src?: string;
      }

      The Kosmos context.

    • principal: Object

      The principal in the authorisation request. This is the actor and is typically a User.

    • dataSourceWrapper: DataSourceWrapper

      The Kosmos DataSourceWrapper object.

    Returns Promise<any>

  • This method is used to build the principal entity "parents" object.

    Returns

    An entity parents array.

    Parameters

    • context: KosmosUserContext<object> & {
          src?: string;
      }

      The Kosmos context.

    • principal: Object

      The principal object.

    • dataSourceWrapper: DataSourceWrapper

      The Kosmos DataSourceWrapper object.

    Returns Promise<ParentItem[]>

  • This method is used to build the resource entity "attributes" object. Attributes can be "existing" (already exist in storage) or "new" (being added by the current request).

    Returns

    An entity attributes object.

    Parameters

    • context: KosmosUserContext<object> & {
          src?: string;
      }

      The Kosmos context.

    • resource: Object

      The resource object.

    • requestData: undefined | Object

      The data included in the original request being handled.

    • connectToVertices: undefined | ConnectionToAdd[]

      The Kosmos connectToVertices object, which contains vertices that will be connected to.

    • dataSourceWrapper: DataSourceWrapper

      The Kosmos DataSourceWrapper object.

    Returns Promise<any>

  • This method is used to build the resource's entity data object which will be sent to cedar

    Returns

    The resource's entity data object.

    Parameters

    • context: KosmosUserContext<object> & {
          src?: string;
      }

      The Kosmos context.

    • resource: Object

      The resource in the authorisation request. This is the entity being acted on.

    • sourceVertex: undefined | Object
    • destinationVertex: undefined | Object
    • requestData: undefined | Object

      The data included in the original request being handled.

    • connectToVertices: undefined | ConnectionToAdd[]

      The Kosmos connectToVertices object, which contains vertices that will be connected to.

    • dataSourceWrapper: DataSourceWrapper

      The Kosmos DataSourceWrapper object.

    • useEntityTypeAsCedarId: boolean = true

    Returns Promise<any>

  • This method is used to build the resource entity "parents" object. Currently if we're handling a resource, we don't need to fetch any parents (this could change in the future).

    Returns

    An empty parents array.

    Returns Promise<ParentItem[]>

  • This method is used to get a principal's "existing" attributes from storage. Attributes can be "existing" (already exist in storage) or "new" (being added by the current request).

    Returns

    An entity attributes object containing "existing" attributes.

    Parameters

    • context: KosmosUserContext<object> & {
          src?: string;
      }

      The Kosmos context.

    • entity: Object
    • dataSourceWrapper: DataSourceWrapper

      The Kosmos DataSourceWrapper object.

    Returns Promise<Object>

  • This method is used to get a resource's "existing" attributes from storage. Attributes can be "existing" (already exist in storage) or "new" (being added by the current request).

    Returns

    An entity attributes object containing "existing" attributes.

    Parameters

    • context: KosmosUserContext<object> & {
          src?: string;
      }

      The Kosmos context.

    • entity: Object
    • dataSourceWrapper: DataSourceWrapper

      The Kosmos DataSourceWrapper object.

    Returns Promise<Object>

  • This method is used to get the full group hierarchy for a given entity.

    Returns

    an object containing a groupHierarcy array.

    Parameters

    • context: KosmosUserContext<object> & {
          src?: string;
      }

      The Kosmos context.

    • entityId: string

      The ID of the entity to get the group hierarchy for.

    • entityType: string
    • dataSourceWrapper: DataSourceWrapper

      The Kosmos DataSourceWrapper object.

    Returns Promise<any>

  • This method is used to get group memberships (including membership roles) for an entity.

    Returns

    an object containing group membership

    Parameters

    • context: KosmosUserContext<object> & {
          src?: string;
      }

      The Kosmos context.

    • entityId: string

      The ID of the entity to get group membership for.

    • dataSourceWrapper: DataSourceWrapper

      The Kosmos DataSourceWrapper object.

    Returns Promise<any>

  • This method is used to get a resource's "new" attributes. Attributes can be "existing" (already exist in storage) or "new" (being added by the current request).

    Returns

    An entity attributes object containing "new" attributes.

    Parameters

    • context: KosmosUserContext<object> & {
          src?: string;
      }

      The Kosmos context.

    • requestData: undefined | Object

      The data included in the original request being handled.

    • connectToVertices: undefined | ConnectionToAdd[]

      The Kosmos connectToVertices object, which contains vertices that will be connected to.

    • dataSourceWrapper: DataSourceWrapper

      The Kosmos DataSourceWrapper object.

    Returns Promise<any>

  • This method is used to run the cedar policy check. The entity data is preloaded in cedar as the initial step. Then we check to see if the principal is authorised to perform the action on the resource.

    Preloading entity data is required for cedar-agent. However, for AWS Verified permissions, entity data is included in a single authorisation request.

    Returns

    Cedar's authorisation result: returns true for 'Allow' and false for 'Deny'.

    Parameters

    • principal: Object

      The principal in the authorisation request. This is the actor and is typically a User.

    • action: string

      The action that the principal wants to perform on the resource.

    • resource: Object

      The resource in the authorisation request. This is the entity being acted on.

    • entityData: any

      The entity data object which includes additional info for the request such as principal/resource data.

    • cedarQuery: any

      The formatted query (principal, action, resource) for Cedar to authorise.

    Returns Promise<boolean>

  • This method compares the authorisation results from Cedar & Kosmos and logs a mismatch as an error.

    Returns

    The comparison result: either true for a match or false for a mismatch.

    Parameters

    • cedarAccessDecision: CedarAccessDecision

      The decision from Cedar: true for 'Allow' and false for 'Deny'.

    • kosmosAccessDecision: boolean

      The decision from Kosmos: true for 'Allow' and false for 'Deny'.

    Returns boolean

  • This method is used to authorise a create edge request using Cedar policies.

    Returns

    Cedar's authorisation result: returns true for 'Allow' and false for 'Deny'.

    Parameters

    • context: KosmosUserContext<object> & {
          src?: string;
      }

      The Kosmos context.

    • principal: Object

      The principal in the authorisation request. This is the actor and is typically a User.

    • resource: Object

      The resource in the authorisation request. This is the edge entity being acted on.

    • sourceVertex: Object

      The source vertex involved in the relationship being deleted.

    • destinationVertex: Object

      The destination vertex involved in the relationship being deleted.

    • properties: Object

      The edge property data included in the original request being handled.

    • dataSourceWrapper: DataSourceWrapper

      The Kosmos DataSourceWrapper object.

    • connectToVertices: never[] = []

    Returns Promise<any>

  • This method is used to authorise a create request using Cedar policies.

    Returns

    Cedar's authorisation result: returns true for 'Allow' and false for 'Deny'.

    Parameters

    • context: KosmosUserContext<object> & {
          src?: string;
      }

      The Kosmos context.

    • principal: Object

      The principal in the authorisation request. This is the actor and is typically a User.

    • resource: Object

      The resource in the authorisation request. This is the entity being acted on.

    • requestData: Object

      The data included in the original request being handled.

    • connectToVertices: ConnectionToAdd[]
    • dataSourceWrapper: DataSourceWrapper

      The Kosmos DataSourceWrapper object.

    Returns Promise<any>

  • This method is used to authorise a delete edge request using Cedar policies.

    Returns

    Cedar's authorisation result: returns true for 'Allow' and false for 'Deny'.

    Parameters

    • context: KosmosUserContext<object> & {
          src?: string;
      }

      The Kosmos context.

    • principal: Object

      The principal in the authorisation request. This is the actor and is typically a User.

    • resource: Object

      The resource in the authorisation request. This is the edge entity being acted on.

    • sourceVertex: Object

      The source vertex involved in the relationship being deleted.

    • destinationVertex: Object

      The destination vertex involved in the relationship being deleted.

    • dataSourceWrapper: DataSourceWrapper

      The Kosmos DataSourceWrapper object.

    • connectToVertices: never[] = []

      The Kosmos connectToVertices array.

    Returns Promise<any>

  • This method is used to authorise a delete request using Cedar policies.

    Returns

    Cedar's authorisation result: returns true for 'Allow' and false for 'Deny'.

    Parameters

    • context: KosmosUserContext<object> & {
          src?: string;
      }

      The Kosmos context.

    • principal: Object

      The principal in the authorisation request. This is the actor and is typically a User.

    • resource: Object

      The resource in the authorisation request. This is the entity being acted on.

    • dataSourceWrapper: DataSourceWrapper

      The Kosmos DataSourceWrapper object.

    Returns Promise<boolean>

  • This method is used to authorise any custom actions outside of the standard CRUD on vertices and edges. E.g. the "UpdateSynonyms" action.

    Returns

    Cedar's authorisation result: returns true for 'Allow' and false for 'Deny'.

    Parameters

    • context: KosmosUserContext<object> & {
          src?: string;
      }

      The Kosmos context.

    • principal: Object

      The principal in the authorisation request. This is the actor and is typically a User.

    • action: string

      The action that the principal wants to perform on the resource.

    • resource: Object

      The resource in the authorisation request. This is the edge entity being acted on.

    • requestData: Object

      Any additional request data relevant to the authorisation decision.

    • dataSourceWrapper: DataSourceWrapper

      The Kosmos DataSourceWrapper object.

    Returns Promise<any>

  • This method is used to authorise a an update edge (properties) request using Cedar policies.

    Returns

    Cedar's authorisation result: returns true for 'Allow' and false for 'Deny'.

    Parameters

    • context: KosmosUserContext<object> & {
          src?: string;
      }

      The Kosmos context.

    • principal: Object

      The principal in the authorisation request. This is the actor and is typically a User.

    • resource: Object

      The resource in the authorisation request. This is the edge entity being acted on.

    • sourceVertex: Object

      The source vertex involved in the relationship being deleted.

    • destinationVertex: Object

      The destination vertex involved in the relationship being deleted.

    • properties: Object

      The edge property data included in the original request being handled.

    • dataSourceWrapper: DataSourceWrapper

      The Kosmos DataSourceWrapper object.

    Returns Promise<any>

  • This method is used to authorise an update request using Cedar policies.

    Returns

    Cedar's authorisation result: returns true for 'Allow' and false for 'Deny'.

    Parameters

    • context: KosmosUserContext<object> & {
          src?: string;
      }

      The Kosmos context.

    • principal: Object

      The principal in the authorisation request. This is the actor and is typically a User.

    • resource: Object

      The resource in the authorisation request. This is the entity being acted on.

    • requestData: Object

      The data included in the original request being handled.

    • connectToVertices: ConnectionToAdd[]

      The Kosmos connectToVertices object, which contains vertices that will be connected to.

    • dataSourceWrapper: DataSourceWrapper

      The Kosmos DataSourceWrapper object.

    Returns Promise<boolean>

Generated using TypeDoc