Auth.Biscuit.Datalog.Executor

The Datalog engine, tasked with deriving new facts from existing facts and rules, as well as matching available facts against checks and policies

Documentation

data BlockWithRevocationIds

A parsed block, along with the associated revocation ids.

Constructors

BlockWithRevocationIds

Fields

• bBlock :: Block

  The parsed block

• genericRevocationId :: ByteString

  Generic revocation id (depends on the block contents and its primary key)

• uniqueRevocationId :: ByteString

  Unique revocation id (specific to the token)

data ExecutionError

The result of running verification

Constructors

Timeout

Verification took too much time

TooManyFacts

Too many facts were generated during evaluation

TooManyIterations

Evaluation did not converge in the alloted number of iterations

FactsInBlocks

Some blocks contained either rules or facts while it was forbidden

ResultError ResultError

The checks and policies were not fulfilled after evaluation

Instances

Eq ExecutionError

Defined in Auth.Biscuit.Datalog.Executor

Methods

(==) :: ExecutionError -> ExecutionError -> Bool

(/=) :: ExecutionError -> ExecutionError -> Bool

Show ExecutionError

Defined in Auth.Biscuit.Datalog.Executor

Methods

showsPrec :: Int -> ExecutionError -> ShowS

show :: ExecutionError -> String

showList :: [ExecutionError] -> ShowS

data Limits

Settings for the executor restrictions See defaultLimits for default values.

Constructors

Limits

Fields

• maxFacts :: Int

  maximum number of facts that can be produced (else TooManyFacts is thrown)

• maxIterations :: Int

  maximum number of iterations before throwing TooManyIterations

• maxTime :: Int

  maximum duration the verification can take (in μs)

• allowRegexes :: Bool

  whether or not allowing `.matches()` during verification

• allowBlockFacts :: Bool

  wheter or not accept facts and rules in blocks. Even when they are enabled, they can’t give rise to facts containing `ambient` symbols

• checkRevocationId :: ByteString -> IO (Either () ())

  how to check for token revocation `Left ()` means that the given id is revoked, `Right ()` means it’s not revoked.

data ResultError

The result of matching the checks and policies against all the available facts.

Constructors

NoPoliciesMatched [Check]

No policy matched. additionally some checks may have failed

FailedChecks (NonEmpty Check)

An allow rule matched, but at least one check failed

DenyRuleMatched [Check] Query

A deny rule matched. additionally some checks may have failed

Instances

Eq ResultError

Defined in Auth.Biscuit.Datalog.Executor

Methods

(==) :: ResultError -> ResultError -> Bool

(/=) :: ResultError -> ResultError -> Bool

Show ResultError

Defined in Auth.Biscuit.Datalog.Executor

Methods

showsPrec :: Int -> ResultError -> ShowS

show :: ResultError -> String

showList :: [ResultError] -> ShowS

data World

A collection of facts and rules used to derive new facts. Rules coming from blocks are stored separately since they are subject to specific restrictions regarding the facts they can generate.

Constructors

World

Fields

• rules :: Set Rule
• blockRules :: Set Rule
• facts :: Set Fact

Instances

Show World

Defined in Auth.Biscuit.Datalog.Executor

Methods

showsPrec :: Int -> World -> ShowS

show :: World -> String

showList :: [World] -> ShowS

Semigroup World

Defined in Auth.Biscuit.Datalog.Executor

Methods

(<>) :: World -> World -> World

sconcat :: NonEmpty World -> World

stimes :: Integral b => b -> World -> World

Monoid World

Defined in Auth.Biscuit.Datalog.Executor

Methods

mempty :: World

mappend :: World -> World -> World

mconcat :: [World] -> World

type Bindings = Map Name Value

A list of bound variables, with the associated value

type Name = Text

A variable name

computeAllFacts

Arguments

:: Limits

The maximum amount of iterations that can be reached

-> World

The initial rules and facts

-> Either ExecutionError (Set Fact)

Compute all possible facts, recursively calling itself until it can't generate new facts or a limit is reached

defaultLimits :: Limits

Default settings for the executor restrictions. (1000 facts, 100 iterations, 1000μs max, regexes are allowed, facts and rules are allowed in blocks)

evaluateExpression :: Limits -> Bindings -> Expression -> Either String Value

Given bindings for variables, reduce an expression to a single datalog value

runVerifier

Arguments

:: BlockWithRevocationIds

The authority block

-> [BlockWithRevocationIds]

The extra blocks

-> Verifier

A verifier

-> IO (Either ExecutionError Query)

Given a series of blocks and a verifier, ensure that all the checks and policies match

runVerifierWithLimits

Arguments

:: Limits

custom limits

-> BlockWithRevocationIds

The authority block

-> [BlockWithRevocationIds]

The extra blocks

-> Verifier

A verifier

-> IO (Either ExecutionError Query)

Given a series of blocks and a verifier, ensure that all the checks and policies match, with provided execution constraints