|
1 | 1 | package org.biscuitsec.biscuit.token;
|
2 | 2 |
|
3 | 3 | import static org.biscuitsec.biscuit.token.builder.Utils.constrainedRule;
|
| 4 | +import static org.junit.Assert.assertTrue; |
| 5 | +import static org.junit.jupiter.api.Assertions.assertDoesNotThrow; |
4 | 6 | import static org.junit.jupiter.api.Assertions.assertEquals;
|
5 | 7 |
|
6 | 8 | import biscuit.format.schema.Schema;
|
@@ -73,6 +75,33 @@ public void testPuttingSomeFactsInBiscuitAndGettingThemBackOutAgain() throws Exc
|
73 | 75 | ((Term.Set) permsTerm).getValue());
|
74 | 76 | }
|
75 | 77 |
|
| 78 | + @Test |
| 79 | + public void testDatalogAuthorizer() throws Exception { |
| 80 | + KeyPair keypair = KeyPair.generate(Schema.PublicKey.Algorithm.Ed25519, new SecureRandom()); |
| 81 | + |
| 82 | + Biscuit token = Biscuit.builder(keypair) |
| 83 | + . addAuthorityFact( "email(\"[email protected]\")") |
| 84 | + .addAuthorityFact("id(123)") |
| 85 | + .addAuthorityFact("enabled(true)") |
| 86 | + .addAuthorityFact("perms([1,2,3])") |
| 87 | + .build(); |
| 88 | + |
| 89 | + Authorizer authorizer = Biscuit.fromBase64Url(token.serializeBase64Url(), keypair.getPublicKey()) |
| 90 | + .verify(keypair.getPublicKey()) |
| 91 | + .authorizer(); |
| 92 | + |
| 93 | + String l0 = "right($email) <- email($email)"; |
| 94 | + String l1 = "check if right(\"[email protected]\")"; |
| 95 | + String datalog = String.join(";", Arrays.asList(l0, l1)); |
| 96 | + authorizer.addDatalog(datalog); |
| 97 | + authorizer.addPolicy("allow if true"); |
| 98 | + |
| 99 | + assertDoesNotThrow(() -> authorizer.authorize()); |
| 100 | + |
| 101 | + Term emailTerm = queryFirstResult(authorizer, "right($address) <- email($address)"); |
| 102 | + assertEquals( "[email protected]", (( Term. Str) emailTerm). getValue()); |
| 103 | + } |
| 104 | + |
76 | 105 | private static Term queryFirstResult(Authorizer authorizer, String query) throws Error {
|
77 | 106 | return authorizer.query(query).iterator().next().terms().get(0);
|
78 | 107 | }
|
|
0 commit comments