policy writing

[rajatayyab3]

which is better aproach using a single variable acorss a single namespace or many variables across a single name while writing policy

[anderseknert]

Hi @rajatayyab3 👋 Could you elaborate on what you mean by that, possibly with an example?

Repeating the same rule in a package will have the conditions ORed, i.e. if one of the rules evaluate, the rule is said to evaluate.
If you use different names for your rules, they'll all be evaluated separately. One rule may however depend on another, and using helper rules is definitely considered a good practice.

[anderseknert]

Yes, I would probably use some helper rules. Using the new keywords like if and in would help a lot too 🙂

package PeerEvaluation

import future.keywords.if
import future.keywords.in

default allow := false

allow if is_admin

# Teachers

allow if {
	is_teacher
	peer_evaluation_path
	input.request.method in {"GET", "POST", "PUT"}
}

# Students

allow if {
	is_student
	peer_evaluation_path
	input.date.date_today >= input.date.available_from
	input.date.date_today <= input.date.available_to
	input.request.method == "GET"
}

is_admin if "admin" in input.user.roles

is_teacher if "teacher" in input.user.roles

is_student if "student" in input.user.roles

peer_evaluation_path if startswith(input.request.path, "/peer_evaluation")

[rajatayyab3]

thank you so much sir. i just wanted to key using a single variable allow is fine or i should use multple words? i considering it in the terms of eficiency , response time, mantainability etc

[anderseknert]

No, that would not have any noticeable impact on efficiency. Maintainability, sure, but what's more maintainable would need to be decided by whoever gets to maintain the code.

[rajatayyab3]

Thank you sir for your quality time. actually i was concerned that if one variable let "allow" we use it will evaluate all policies against allow variable so if i use a seperate variable for few particular polices it will only evaluate only that and response time will me efficient that was all my considerations. But as you have told me that would not have noticable impact i will go with one variable. Thank you again thank you so much. Any other suggestions from your side for policies writing that would be great.

[anderseknert]

Sure! Use Regal for linting your policy, and read the docs on any rule where it warns you about something.