[WIP] implement scoped rules, remove #authority and #ambient

the scoped execution model ensures that checks and rules only have access to facts added or generated in the current or previous blocks. They cannot be affected by facts from later blocks. Verifier rules, checks and policies are executed in the context of the authority block Since this change can prevent check from the authority block and the verifier from being affected by facts from later block, we can remove the #authority and #ambient symbols TODO: - update the spec
biscuit-auth · Sep 5, 2021 · 035941d · 035941d
1 parent e5ea1c1
commit 035941d
Show file tree

Hide file tree

Showing 24 changed files with 519 additions and 437 deletions.
diff --git a/samples/v2/README.md b/samples/v2/README.md
diff --git a/samples/v2/samples.json b/samples/v2/samples.json
diff --git a/samples/v2/test10_authority_rules.bc b/samples/v2/test10_authority_rules.bc
diff --git a/samples/v2/test10_verifier_scope.bc b/samples/v2/test10_verifier_scope.bc
diff --git a/samples/v2/test11_verifier_authority_caveats.bc b/samples/v2/test11_verifier_authority_caveats.bc
diff --git a/samples/v2/test12_authority_caveats.bc b/samples/v2/test12_authority_caveats.bc
@@ -1,6 +1,6 @@
-�
-,
-check12 
-
-"file1"file1 D�S�K6e@�����{��HPc��G!���c\@�c��6�I�;�g��g�2�/�7�YZ.�����e�ý�ɻY�ݫ�R_Di�/�EV>l""
- <���thT�d�2f�u��h�̍��kn�
+�
+(
+check12
+
+"file1"file1 ܤ����x�7�ɇ�H_�O�U/����@&�3�v�n���bX����3��%���c8���Fy8'�=ًQG�P�\�ت�*/�Ѫ��w	""
+ ��F�w�n*b�J��X���oZ�:��z�b�3q

diff --git a/samples/v2/test13_block_rules.bc b/samples/v2/test13_block_rules.bc
diff --git a/samples/v2/test14_regex_constraint.bc b/samples/v2/test14_regex_constraint.bc
@@ -1,13 +1,12 @@
-�
-O
+�
+K
 resource_match
-028
-6
-
- 
+024
+2
+ 
 
 
 
 "file[0-9]+.txt
- ;�69Xy�oC?���B�s�-+�3P1knar@(���%"dOE�iD������a%h1��{j�0%�]�w<��/�!���\����������l�n��""
- �9���b�/�9n������J-?��P�=�� 
+ ι�G���V��`*k��)��_��<�^dM'�B@��:��y{�1�����.�(:�SA�ʄ��B`�ԎL��(��ji��gJ�7ˊ����vz""
+ �Ɩ��]�<T�~�Eq��2��e�p���9QS�

diff --git a/samples/v2/test15_multi_queries_caveats.bc b/samples/v2/test15_multi_queries_caveats.bc
diff --git a/samples/v2/test16_caveat_head_name.bc b/samples/v2/test16_caveat_head_name.bc
diff --git a/samples/v2/test17_expressions.bc b/samples/v2/test17_expressions.bc
diff --git a/samples/v2/test18_unbound_variables_in_rule.bc b/samples/v2/test18_unbound_variables_in_rule.bc
diff --git a/samples/v2/test19_generating_ambient_from_variables.bc b/samples/v2/test19_generating_ambient_from_variables.bc
@@ -1,15 +1,12 @@
-�
-.
+�
+*
 check1
 test
-read2
-
-
-	 u�"^r�9SQ&^���$�|��V0�p&>:蟬@39�6�ѽ��h�S�	y��͇&Z勼���:�I�{�N�A��}�NZC��!� ���l�"#�
-!
-any*
-
-	
-
- <���l�� >?�}���#�-0	�X����r@w�;ZZ������|ҙ)��q��rZ��J�x��K��L.<9�]:9���K�LD*1��I�a3""
- P����9�ʾ{t��U�tp�~��R�dt��)
+read2
+
+	 ���D��~[� N�$�PZ�!�����؃��@�Um	��|>�-SL4?^���9ԉ�f��H�q�����E�@�������O��Ѿ}@�
+
+any*
+	
+ �a�0�c���L�BlA|3�(Z�=��R��:��@�w�T�u�;��)��DUQAKy"}��3r�Ą�"�h�˨ރ��E� �{ύ�р~�WӁ{�`""
+ ��+o\�����eȽs�����6G�;�cFwa�

diff --git a/samples/v2/test1_basic.bc b/samples/v2/test1_basic.bc
diff --git a/samples/v2/test2_different_root_key.bc b/samples/v2/test2_different_root_key.bc
diff --git a/samples/v2/test3_invalid_signature_format.bc b/samples/v2/test3_invalid_signature_format.bc
diff --git a/samples/v2/test4_random_block.bc b/samples/v2/test4_random_block.bc
diff --git a/samples/v2/test5_invalid_signature.bc b/samples/v2/test5_invalid_signature.bc
diff --git a/samples/v2/test6_reordered_blocks.bc b/samples/v2/test6_reordered_blocks.bc
diff --git a/samples/v2/test7_invalid_block_fact_authority.bc b/samples/v2/test7_invalid_block_fact_authority.bc
diff --git a/samples/v2/test7_scoped_rules.bc b/samples/v2/test7_scoped_rules.bc
diff --git a/samples/v2/test8_invalid_block_fact_ambient.bc b/samples/v2/test8_invalid_block_fact_ambient.bc
diff --git a/samples/v2/test8_scoped_checks.bc b/samples/v2/test8_scoped_checks.bc
diff --git a/samples/v2/test9_expired_token.bc b/samples/v2/test9_expired_token.bc