are there any libraries for ACL-like authorisation using datomic?

another question: what is a good way to debug datalog query rules? I find it quite hard to diagnose & fix mistakes in them.

@chrisblom are you referring to datalog query performance? https://github.com/Datomic/day-of-datomic/blob/master/tutorial/decomposing_a_query.clj

no, debugging problems with datalog rules

What kind of problems are you running into? I often find that I have to separately break up the group of clauses to confirm I have exactly what I am after. I am just curious if you are having a different problem debugging rules.

i’m developing some rules for an authorisation scheme, i have a rule

[[check-permission ?p ?action ?resource]
    [?p :permission/action ?action]
    [?p :permission/resource ?resource]]

which can be used to check if a permission is granted to perform an action on some resource

where actions are a fixes set of idents, like :action/read, :action/update, action/delete

and resources can be any entity in the db

this works fine, but i want to add a special wildcard action :action/ANY

such that when a permission grants :action/ANY on a resources, check-permission will match any action

i’ve tried adding

[[check-permission ?p _ ?resource]
    [?p :permission/resource ?resource]
    [?p :permission/action :action/ANY]]

i’ve also tried a bunch of other rules, but as the rules engine is a black box, i have no idea when a rule matches or not

i would try something like

[[check-permission ?p ?action ?resource]
[?p :permission/resource ?resource]
[(= ?action :action/ANY]]

@chrisblom ^

thanks, but thats not what i’m looking for. I’m looking for a rule such that [check-permission ?p ?action ?resource] will match when ?action is :action/read | :action/write | :action/…

provided that

{:db/id ?p 
 :permission/resource ?resource
 :permission/action :action/ANY}

ah.

so when a permission has :permission/action :action/ANY it should not unify the ?action variable of check-permission, but i’m not able to achieve this

i think youll need to use an OR in the rule

[[check-permission ?p ?action ?resource]
    (or [?p :permisison/action :action/ANY]
        [?p :permission/action ?action])
    [?p :permission/resource ?resource]]

if entity p has either the specified action or the ANY action set, then match

ok, seems logical, but datomic does not allow it

Assert failed: All clauses in 'or' must use same set of vars, had
   [#{?p} #{?action ?p}] (apply = uvs)

or-join

erm. one sec

actually, i think i was closer the first time

[[check-permission ?p ?action ?resource]
    [?p :permission/action ?action]
    [?p :permission/resource ?resource]]
[[check-permission ?p ?action ?resource]
    [?p :permission/action :action/ANY]
    [?p :permission/resource ?resource]]

multiple rule heads are treated as logical OR

ah, yeah that works, thanks

i had an underscore instead of ?action

you were pretty much right the first time, just minus the _

i’d have to think about why that didnt work

yeah, i’d expect that _ would unify with anything

did you get an error or did it just not work?

it just did not work, no error

following the grammar, the rule head is:

fyi, an or-join is also possible:

'[[check-permission ?p ?action ?resource]
    (or-join [?p ?action]
             [?p :permission/action :action/ANY]
             [?p :permission/action ?action])
    [?p :permission/resource ?resource]]

[rule-name rule-vars]

yeah, an or-join would do the same thing

anyway, the grammar does say that a rule head is [rule-name rule-vars] , rule vars is [variable+ | ([variable+] variable*)] and variable is symbol starting with ?

so an underscore isn’t actually permitted in a rule-var list

ah ok, yeah i see it now in the grammar

i expected that using _ in a rule should work, it works in queries

some other datalog query engines, and prolog allow it

can i file a bug for this? It kept me busy for a few hours and i’d like to avoid others from experiencing the same.

@marshall thanks a lot for your help!

np. yeah, i’ll pass it along

Looks like a deps conflict @donmullen

Yep - just seeing that — some conflict with com.socrata/soda-api-java — sorry for the noise.

Np