Skip to content

Commit eebe538

Browse files
gemanorgemanor
authored
Merge pull request #135 from miracleonyenma/chore/api-gateway-authorization
Create gateway-api-authorization.tf
2 parents 6456189 + 7b12f80 commit eebe538

1 file changed

Lines changed: 234 additions & 0 deletions

File tree

‎source/templates/gateway-api-authorization.tf‎

Lines changed: 234 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,234 @@
1+
terraform {
2+
required_providers {
3+
permitio = {
4+
source = "permitio/permit-io"
5+
version = "~> 0.0.12"
6+
}
7+
}
8+
}
9+
10+
variable "PERMIT_API_KEY" {
11+
type = string
12+
description = "The API key for the Permit.io API"
13+
}
14+
15+
provider "permitio" {
16+
api_url = "https://api.permit.io"
17+
api_key = var.PERMIT_API_KEY
18+
}
19+
20+
# Resources
21+
resource "permitio_resource" "Comment" {
22+
name = "Comment"
23+
description = ""
24+
key = "Comment"
25+
26+
actions = {
27+
"read" = {
28+
name = "read"
29+
},
30+
"create" = {
31+
name = "create"
32+
},
33+
"update" = {
34+
name = "update"
35+
},
36+
"delete" = {
37+
name = "delete"
38+
}
39+
}
40+
attributes = {
41+
}
42+
}
43+
resource "permitio_resource" "Category" {
44+
name = "Category"
45+
description = "" key = "Category"
46+
47+
actions = {
48+
"read" = {
49+
name = "read"
50+
},
51+
"create" = {
52+
name = "create"
53+
},
54+
"update" = {
55+
name = "update"
56+
},
57+
"delete" = {
58+
name = "delete"
59+
}
60+
}
61+
attributes = {
62+
}
63+
}
64+
resource "permitio_resource" "Article" {
65+
name = "Article"
66+
description = ""
67+
key = "Article"
68+
69+
actions = {
70+
"read" = {
71+
name = "read"
72+
},
73+
"create" = {
74+
name = "create"
75+
},
76+
"update" = {
77+
name = "update"
78+
},
79+
"delete" = {
80+
name = "delete"
81+
},
82+
"publish" = {
83+
name = "publish"
84+
}
85+
}
86+
attributes = {
87+
"category" = {
88+
name = "Category"
89+
type = "string"
90+
}
91+
}
92+
}
93+
94+
# User Attributes
95+
resource "permitio_user_attribute" "user_created_at" {
96+
key = "created_at"
97+
type = "string"
98+
description = ""
99+
}
100+
resource "permitio_user_attribute" "user_last_active" {
101+
key = "last_active"
102+
type = "string"
103+
description = ""
104+
}
105+
resource "permitio_user_attribute" "user_subscription_tier" {
106+
key = "subscription_tier"
107+
type = "string"
108+
description = ""
109+
}
110+
111+
# Roles
112+
resource "permitio_role" "author" {
113+
key = "author"
114+
name = "author"
115+
permissions = ["Comment:create", "Article:read", "Comment:read", "Comment:update",
116+
"Article:create", "Article:update", "Category:read"]
117+
118+
depends_on = [permitio_resource.Comment, permitio_resource.Article, permitio_resource.Category]
119+
}
120+
121+
# Condition Set Rules
122+
resource "permitio_condition_set_rule" "premium_subscribers_regular_articles_Article_read" {
123+
user_set = permitio_user_set.premium_subscribers.key
124+
permission = "Article:read"
125+
resource_set = permitio_resource_set.regular_articles.key
126+
depends_on = [
127+
permitio_resource_set.regular_articles,
128+
permitio_user_set.premium_subscribers
129+
]
130+
}
131+
resource "permitio_condition_set_rule" "premium_subscribers_premium_articles_Article_read" {
132+
user_set = permitio_user_set.premium_subscribers.key
133+
permission = "Article:read"
134+
resource_set = permitio_resource_set.premium_articles.key
135+
depends_on = [
136+
permitio_resource_set.premium_articles,
137+
permitio_user_set.premium_subscribers
138+
]
139+
}
140+
resource "permitio_condition_set_rule" "free_subscribers_regular_articles_Article_read" {
141+
user_set = permitio_user_set.free_subscribers.key
142+
permission = "Article:read"
143+
resource_set = permitio_resource_set.regular_articles.key
144+
depends_on = [
145+
permitio_resource_set.regular_articles,
146+
permitio_user_set.free_subscribers
147+
]
148+
}
149+
150+
# Resource Sets
151+
resource "permitio_resource_set" "premium_articles" {
152+
name = "Premium Articles"
153+
key = "premium_articles"
154+
resource = permitio_resource.Article.key
155+
conditions = jsonencode({
156+
"allOf": [
157+
{
158+
"allOf": [
159+
{
160+
"resource.category": {
161+
"equals": "premium"
162+
}
163+
}
164+
]
165+
}
166+
]
167+
})
168+
depends_on = [
169+
permitio_resource.Article
170+
]
171+
}
172+
resource "permitio_resource_set" "regular_articles" {
173+
name = "Regular Articles"
174+
key = "regular_articles"
175+
resource = permitio_resource.Article.key
176+
conditions = jsonencode({
177+
"allOf": [
178+
{
179+
"allOf": [
180+
{
181+
"resource.category": {
182+
"not-equals": "premium"
183+
}
184+
}
185+
]
186+
}
187+
]
188+
})
189+
depends_on = [
190+
permitio_resource.Article
191+
]
192+
}
193+
194+
# User Sets
195+
resource "permitio_user_set" "free_subscribers" {
196+
key = "free_subscribers"
197+
name = "Free Subscribers"
198+
conditions = jsonencode({
199+
allOf = [
200+
{
201+
allOf = [
202+
{
203+
"user.subscription_tier" = {
204+
equals = "free"
205+
}
206+
}
207+
]
208+
}
209+
]
210+
})
211+
depends_on = [
212+
permitio_user_attribute.user_subscription_tier
213+
]
214+
}
215+
resource "permitio_user_set" "premium_subscribers" {
216+
key = "premium_subscribers"
217+
name = "Premium Subscribers"
218+
conditions = jsonencode({
219+
allOf = [
220+
{
221+
allOf = [
222+
{
223+
"user.subscription_tier" = {
224+
equals = "premium"
225+
}
226+
}
227+
]
228+
}
229+
]
230+
})
231+
depends_on = [
232+
permitio_user_attribute.user_subscription_tier
233+
]
234+
}

0 commit comments

Comments
 (0)