Multiple conditions in one statement

[broom9]

Multiple conditions in one statement

[SylvainEstevez]

Indeed the logical combination of all condition statements is AND @broom9. In order to achieve an OR, you can create multiple permissions with different conditions.

Example: a user can watch a PG13 movie if they are over 13 OR parental control is disabled:

{
  id: 'OfAge',
  action: 'watch',
  resource: 'movie',
  condition: {
    numberGreaterThanEquals: {
      simpleValue: { 'user.age': '13' }
    }
  }
}

{
  id: 'NoParentalControl',
  action: 'watch',
  resource: 'movie',
  condition: {
    bool: {
      simpleValue: { 'user.parentalControl': 'false' }
    }
  }
}

accessControl.can(user, 'watch', 'movie', { user });

If either one of the above conditions is true, then the user will be granted access. This is also how you would do such thing in AWS IAM I believe.

---

If your goal is to allow a set of values, ie a sort of IN statement on a single property, then you can use the forAnyValue modifier.

Example: a user can fetch a post if it's in state 'PUBLISHED' OR 'IN_REVIEW':

{
  id: 'GetPost',
  action: 'fetch',
  resource: 'post',
  condition: {
    stringEquals: {
      forAnyValue: { 'post.status': ['PUBLISHED', 'IN_REVIEW'] }
    }
  }
}

accessControl.can(user, 'fetch', 'post', { post });

If the post has a status of either 'PUBLISHED' OR 'IN_REVIEW' the user will be granted access.

---

As to providing a special syntax for OR / multiple conditions in a single statement, I haven't found a good way to do this (one that would stay close to the AWS syntax) but if you have a proposal with examples I'd be happy to look at it!

Hope this helps!

[broom9]

Thanks for the detailed explanations @SylvainEstevez .

One thought is the when there are multiple conditions with AND relationship, the syntax could be improved. For example, if a user can only buy student pass if she is a student AND she is under 21:

{
  id: 'buyStudentPass',
  action: 'qualify',
  resource: 'student_pass',
  condition: {
    numberLessThanEquals: {
      simpleValue: { 'user.age': '21' }
    },
    bool: {
      simpleValue: { 'user.isStudent': 'true' }
    },
  }
}

Is above the expected syntax? What if I want to have two rules with numberLessThanEquals in it?

It seems the rule syntax is better to be:

{
  id: 'buyStudentPass',
  action: 'qualify',
  resource: 'student_pass',
  conditions: [
    {
      numberLessThanEquals: {
        simpleValue: { 'user.age': '21' }
      }
    },
    {
      bool: {
        simpleValue: { 'user.isStudent': 'true' }
      }
    }
  ]
}

[SylvainEstevez]

@broom9 This is indeed the correct syntax. To have more than one numberLessThanEquals rule, simply add more properties in the object.

{
  id: 'buyStudentPass',
  action: 'qualify',
  resource: 'student_pass',
  condition: {
    numberLessThanEquals: {
      simpleValue: {
        'user.age': '21',
        'user.studentPassCount': 1 // ie, can only buy if not bought already
      }
    },
    bool: {
      simpleValue: { 'user.isStudent': 'true' }
    },
  }
}