Compound authorization

[luxas]

Category

User level API features/changes

Describe the feature you'd like to request

Sometimes, the application needs to make sure that the principal has multiple permissions on an object or a set of resources, before a certain operation is allowed. This can be done today through multiple independent Cedar authorization checks, but from time to time, users have raised discussion on what it would look like for Cedar to support something with regards to that natively.

Alex on the Cedar Slack and in this blog post brought this up most recently, and mentioned that other projects like SpiceDB support the all operator, which in Alex' example could be modelled e.g. as

permission viewReport = viewReportMetadata & sourceDatasets.all(viewDataset)

which means that a principal can only viewReport if they have the viewReportMetadata permission and the viewDataset permission on all source datasets of the report.

It would be interesting to see how Cedar would tackle something like this, even if using some "non-core" or higher-level library doing most of it.

Creating this tracking issue mostly in order to track the interest in this kind of feature.

Describe alternatives you've considered

Require consumers to implement this themselves.

Additional context

No response

Is this something that you'd be interested in working on?

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change