oso_success.py

#!/usr/bin/env python3
from oso import Oso, Relation
from dataclasses import dataclass
from functools import partial

policy = """
actor User {

}

resource Network {
  relations = {groups: Group};
  roles = ["member"];
  permissions = ["read"];

  "read" if "member";
}

resource Group {
    permissions = ["read"];
    roles = ["host", "member"];

    "read" if "member";
    "member" if "host";
}

allow(actor, action, resource) if
   has_permission(actor, action, resource);

has_role(_u: User, _role: String, n: Network) if
  g in n.groups and g.name = "testing";
"""
open('policy.polar', 'w').write(policy)

OSO = Oso()

args = {'exec_query': lambda q: q,
        'combine_query': lambda a, b: (a, b)}

def build_query(table, filt):
    print(table, filt)
    class Something:
        def __getattr__(self, x):
            return self
        def __iter__(self):
            return iter([self])
    return Something()

@dataclass
class User:
    id: str

OSO.register_class(
    User,
    fields={'id': str},
    build_query=partial(build_query, 'users'),
    **args)

class Network:
    pass

OSO.register_class(
    Network,
    fields={'id': str,
            'groups': Relation(
                kind='many', my_field='id', other_field='user_id', other_type='Group')},
    build_query=partial(build_query, 'network'),
    **args)

class Group:
    pass

OSO.register_class(
    Group,
    fields={'id': str, 'name': str},
    build_query=partial(build_query, 'group'),
    **args)

OSO.load_files(["policy.polar"])
print(OSO.authorized_query(User(id="xyz"), "read", Network))