Skip to content

Commit 9b28150

Browse files
tstirrat15tstirrat15
authored
Merge pull request #29 from authzed/multiple-file-validation-example
Add example of multiple file validation with zed validate
2 parents 1233655 + a99c3ca commit 9b28150

4 files changed

Lines changed: 304 additions & 0 deletions

File tree

‎schemas/multiple-validation-files/README.md‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
## Multiple Validation Files with a Single Schema
2+
3+
This requires zed version v0.25.0.
4+
5+
This folder demonstrates a structure for a schema and validation files that
6+
can be run in a single `zed validate` command and used as a template
7+
for writing multiple independent tests of a single schema.
8+
9+
Running the following:
10+
11+
```
12+
zed validate validations/*
13+
```
14+
15+
in this folder will validate the schema and run all validations in all schema files.
16+
17+
Note the use of `schemaFile: ` in the validation files - this allows the validation file to
18+
reference the schema without the schema needing to be inline.

‎schemas/multiple-validation-files/schema.zed‎

Lines changed: 200 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,200 @@
1+
definition user {}
2+
3+
definition role {
4+
relation bound_user: user
5+
6+
relation spanner_databaseoperations_cancel: role
7+
relation spanner_databaseoperations_delete: role
8+
relation spanner_databaseoperations_get: role
9+
relation spanner_databaseoperations_list: role
10+
relation spanner_databaseroles_list: role
11+
relation spanner_databaseroles_use: role
12+
relation spanner_databases_beginorrollbackreadwritetransaction: role
13+
relation spanner_databases_beginpartitioneddmltransaction: role
14+
relation spanner_databases_beginreadonlytransaction: role
15+
relation spanner_databases_create: role
16+
relation spanner_databases_drop: role
17+
relation spanner_databases_get: role
18+
relation spanner_databases_getddl: role
19+
relation spanner_databases_getiampolicy: role
20+
relation spanner_databases_list: role
21+
relation spanner_databases_partitionquery: role
22+
relation spanner_databases_partitionread: role
23+
relation spanner_databases_read: role
24+
relation spanner_databases_select: role
25+
relation spanner_databases_setiampolicy: role
26+
relation spanner_databases_update: role
27+
relation spanner_databases_updateddl: role
28+
relation spanner_databases_userolebasedaccess: role
29+
relation spanner_databases_write: role
30+
relation spanner_instances_get: role
31+
relation spanner_instances_getiampolicy: role
32+
relation spanner_instances_list: role
33+
relation spanner_sessions_create: role
34+
relation spanner_sessions_delete: role
35+
relation spanner_sessions_get: role
36+
relation spanner_sessions_list: role
37+
38+
permission can_spanner_databaseoperations_cancel = spanner_databaseoperations_cancel->bound_user
39+
permission can_spanner_databaseoperations_delete = spanner_databaseoperations_delete->bound_user
40+
permission can_spanner_databaseoperations_get = spanner_databaseoperations_get->bound_user
41+
permission can_spanner_databaseoperations_list = spanner_databaseoperations_list->bound_user
42+
permission can_spanner_databaseroles_list = spanner_databaseroles_list->bound_user
43+
permission can_spanner_databaseroles_use = spanner_databaseroles_use->bound_user
44+
permission can_spanner_databases_beginorrollbackreadwritetransaction = spanner_databases_beginorrollbackreadwritetransaction->bound_user
45+
permission can_spanner_databases_beginpartitioneddmltransaction = spanner_databases_beginpartitioneddmltransaction->bound_user
46+
permission can_spanner_databases_beginreadonlytransaction = spanner_databases_beginreadonlytransaction->bound_user
47+
permission can_spanner_databases_create = spanner_databases_create->bound_user
48+
permission can_spanner_databases_drop = spanner_databases_drop->bound_user
49+
permission can_spanner_databases_get = spanner_databases_get->bound_user
50+
permission can_spanner_databases_getddl = spanner_databases_getddl->bound_user
51+
permission can_spanner_databases_getiampolicy = spanner_databases_getiampolicy->bound_user
52+
permission can_spanner_databases_list = spanner_databases_list->bound_user
53+
permission can_spanner_databases_partitionquery = spanner_databases_partitionquery->bound_user
54+
permission can_spanner_databases_partitionread = spanner_databases_partitionread->bound_user
55+
permission can_spanner_databases_read = spanner_databases_read->bound_user
56+
permission can_spanner_databases_select = spanner_databases_select->bound_user
57+
permission can_spanner_databases_setiampolicy = spanner_databases_setiampolicy->bound_user
58+
permission can_spanner_databases_update = spanner_databases_update->bound_user
59+
permission can_spanner_databases_updateddl = spanner_databases_updateddl->bound_user
60+
permission can_spanner_databases_userolebasedaccess = spanner_databases_userolebasedaccess->bound_user
61+
permission can_spanner_databases_write = spanner_databases_write->bound_user
62+
permission can_spanner_instances_get = spanner_instances_get->bound_user
63+
permission can_spanner_instances_getiampolicy = spanner_instances_getiampolicy->bound_user
64+
permission can_spanner_instances_list = spanner_instances_list->bound_user
65+
permission can_spanner_sessions_create = spanner_sessions_create->bound_user
66+
permission can_spanner_sessions_delete = spanner_sessions_delete->bound_user
67+
permission can_spanner_sessions_get = spanner_sessions_get->bound_user
68+
permission can_spanner_sessions_list = spanner_sessions_list->bound_user
69+
}
70+
71+
definition project {
72+
relation granted: role
73+
74+
// Synthetic Instance Relations
75+
permission granted_spanner_instances_get = granted->can_spanner_instances_get
76+
permission granted_spanner_instances_getiampolicy = granted->can_spanner_instances_getiampolicy
77+
permission granted_spanner_instances_list = granted->can_spanner_instances_list
78+
79+
// Synthetic Database Relations
80+
permission granted_spanner_databases_beginorrollbackreadwritetransaction = granted->can_spanner_databases_beginorrollbackreadwritetransaction
81+
permission granted_spanner_databases_beginpartitioneddmltransaction = granted->can_spanner_databases_beginpartitioneddmltransaction
82+
permission granted_spanner_databases_beginreadonlytransaction = granted->can_spanner_databases_beginreadonlytransaction
83+
permission granted_spanner_databases_create = granted->can_spanner_databases_create
84+
permission granted_spanner_databases_drop = granted->can_spanner_databases_drop
85+
permission granted_spanner_databases_get = granted->can_spanner_databases_get
86+
permission granted_spanner_databases_getddl = granted->can_spanner_databases_getddl
87+
permission granted_spanner_databases_getiampolicy = granted->can_spanner_databases_getiampolicy
88+
permission granted_spanner_databases_list = granted->can_spanner_databases_list
89+
permission granted_spanner_databases_partitionquery = granted->can_spanner_databases_partitionquery
90+
permission granted_spanner_databases_partitionread = granted->can_spanner_databases_partitionread
91+
permission granted_spanner_databases_read = granted->can_spanner_databases_read
92+
permission granted_spanner_databases_select = granted->can_spanner_databases_select
93+
permission granted_spanner_databases_setiampolicy = granted->can_spanner_databases_setiampolicy
94+
permission granted_spanner_databases_update = granted->can_spanner_databases_update
95+
permission granted_spanner_databases_updateddl = granted->can_spanner_databases_updateddl
96+
permission granted_spanner_databases_userolebasedaccess = granted->can_spanner_databases_userolebasedaccess
97+
permission granted_spanner_databases_write = granted->can_spanner_databases_write
98+
99+
// Synthetic Sessions Relations
100+
permission granted_spanner_sessions_create = granted->can_spanner_sessions_create
101+
permission granted_spanner_sessions_delete = granted->can_spanner_sessions_delete
102+
permission granted_spanner_sessions_get = granted->can_spanner_sessions_get
103+
permission granted_spanner_sessions_list = granted->can_spanner_sessions_list
104+
105+
// Synthetic Database Operations Relations
106+
permission granted_spanner_databaseoperations_cancel = granted->can_spanner_databaseoperations_cancel
107+
permission granted_spanner_databaseoperations_delete = granted->can_spanner_databaseoperations_delete
108+
permission granted_spanner_databaseoperations_get = granted->can_spanner_databaseoperations_get
109+
permission granted_spanner_databaseoperations_list = granted->can_spanner_databaseoperations_list
110+
111+
// Synthetic Database Roles Relations
112+
permission granted_spanner_databaseroles_list = granted->can_spanner_databaseroles_list
113+
permission granted_spanner_databaseroles_use = granted->can_spanner_databaseroles_use
114+
}
115+
116+
definition spanner_instance {
117+
relation project: project
118+
relation granted: role
119+
120+
permission get = granted->can_spanner_instances_get + project->granted_spanner_instances_get
121+
permission getiampolicy = granted->can_spanner_instances_getiampolicy + project->granted_spanner_instances_getiampolicy
122+
permission list = granted->can_spanner_instances_list + project->granted_spanner_instances_list
123+
124+
// Synthetic Database Relations
125+
permission granted_spanner_databases_beginorrollbackreadwritetransaction = granted->can_spanner_databases_beginorrollbackreadwritetransaction + project->granted_spanner_databases_beginorrollbackreadwritetransaction
126+
permission granted_spanner_databases_beginpartitioneddmltransaction = granted->can_spanner_databases_beginpartitioneddmltransaction + project->granted_spanner_databases_beginpartitioneddmltransaction
127+
permission granted_spanner_databases_beginreadonlytransaction = granted->can_spanner_databases_beginreadonlytransaction + project->granted_spanner_databases_beginreadonlytransaction
128+
permission granted_spanner_databases_create = granted->can_spanner_databases_create + project->granted_spanner_databases_create
129+
permission granted_spanner_databases_drop = granted->can_spanner_databases_drop + project->granted_spanner_databases_drop
130+
permission granted_spanner_databases_get = granted->can_spanner_databases_get + project->granted_spanner_databases_get
131+
permission granted_spanner_databases_getddl = granted->can_spanner_databases_getddl + project->granted_spanner_databases_getddl
132+
permission granted_spanner_databases_getiampolicy = granted->can_spanner_databases_getiampolicy + project->granted_spanner_databases_getiampolicy
133+
permission granted_spanner_databases_list = granted->can_spanner_databases_list + project->granted_spanner_databases_list
134+
permission granted_spanner_databases_partitionquery = granted->can_spanner_databases_partitionquery + project->granted_spanner_databases_partitionquery
135+
permission granted_spanner_databases_partitionread = granted->can_spanner_databases_partitionread + project->granted_spanner_databases_partitionread
136+
permission granted_spanner_databases_read = granted->can_spanner_databases_read + project->granted_spanner_databases_read
137+
permission granted_spanner_databases_select = granted->can_spanner_databases_select + project->granted_spanner_databases_select
138+
permission granted_spanner_databases_setiampolicy = granted->can_spanner_databases_setiampolicy + project->granted_spanner_databases_setiampolicy
139+
permission granted_spanner_databases_update = granted->can_spanner_databases_update + project->granted_spanner_databases_update
140+
permission granted_spanner_databases_updateddl = granted->can_spanner_databases_updateddl + project->granted_spanner_databases_updateddl
141+
permission granted_spanner_databases_userolebasedaccess = granted->can_spanner_databases_userolebasedaccess + project->granted_spanner_databases_userolebasedaccess
142+
permission granted_spanner_databases_write = granted->can_spanner_databases_write + project->granted_spanner_databases_write
143+
144+
// Synthetic Sessions Relations
145+
permission granted_spanner_sessions_create = granted->can_spanner_sessions_create + project->granted_spanner_sessions_create
146+
permission granted_spanner_sessions_delete = granted->can_spanner_sessions_delete + project->granted_spanner_sessions_delete
147+
permission granted_spanner_sessions_get = granted->can_spanner_sessions_get + project->granted_spanner_sessions_get
148+
permission granted_spanner_sessions_list = granted->can_spanner_sessions_list + project->granted_spanner_sessions_list
149+
150+
// Synthetic Database Operations Relations
151+
permission granted_spanner_databaseoperations_cancel = granted->can_spanner_databaseoperations_cancel + project->granted_spanner_databaseoperations_cancel
152+
permission granted_spanner_databaseoperations_delete = granted->can_spanner_databaseoperations_delete + project->granted_spanner_databaseoperations_delete
153+
permission granted_spanner_databaseoperations_get = granted->can_spanner_databaseoperations_get + project->granted_spanner_databaseoperations_get
154+
permission granted_spanner_databaseoperations_list = granted->can_spanner_databaseoperations_list + project->granted_spanner_databaseoperations_list
155+
156+
// Synthetic Database Roles Relations
157+
permission granted_spanner_databaseroles_list = granted->can_spanner_databaseroles_list + project->granted_spanner_databaseroles_list
158+
permission granted_spanner_databaseroles_use = granted->can_spanner_databaseroles_use + project->granted_spanner_databaseroles_use
159+
}
160+
161+
definition spanner_database {
162+
relation instance: spanner_instance
163+
relation granted: role
164+
165+
// Database
166+
permission beginorrollbackreadwritetransaction = granted->can_spanner_databases_beginorrollbackreadwritetransaction + instance->granted_spanner_databases_beginorrollbackreadwritetransaction
167+
permission beginpartitioneddmltransaction = granted->can_spanner_databases_beginpartitioneddmltransaction + instance->granted_spanner_databases_beginpartitioneddmltransaction
168+
permission beginreadonlytransaction = granted->can_spanner_databases_beginreadonlytransaction + instance->granted_spanner_databases_beginreadonlytransaction
169+
permission create = granted->can_spanner_databases_create + instance->granted_spanner_databases_create
170+
permission drop = granted->can_spanner_databases_drop + instance->granted_spanner_databases_drop
171+
permission get = granted->can_spanner_databases_get + instance->granted_spanner_databases_get
172+
permission get_ddl = granted->can_spanner_databases_getddl + instance->granted_spanner_databases_getddl
173+
permission getiampolicy = granted->can_spanner_databases_getiampolicy + instance->granted_spanner_databases_getiampolicy
174+
permission list = granted->can_spanner_databases_list + instance->granted_spanner_databases_list
175+
permission partitionquery = granted->can_spanner_databases_partitionquery + instance->granted_spanner_databases_partitionquery
176+
permission partitionread = granted->can_spanner_databases_partitionread + instance->granted_spanner_databases_partitionread
177+
permission read = granted->can_spanner_databases_read + instance->granted_spanner_databases_read
178+
permission select = granted->can_spanner_databases_select + instance->granted_spanner_databases_select
179+
permission setiampolicy = granted->can_spanner_databases_setiampolicy + instance->granted_spanner_databases_setiampolicy
180+
permission update = granted->can_spanner_databases_update + instance->granted_spanner_databases_update
181+
permission updateddl = granted->can_spanner_databases_updateddl + instance->granted_spanner_databases_updateddl
182+
permission userolebasedaccess = granted->can_spanner_databases_userolebasedaccess + instance->granted_spanner_databases_userolebasedaccess
183+
permission write = granted->can_spanner_databases_write + instance->granted_spanner_databases_write
184+
185+
// Sessions
186+
permission create_session = granted->can_spanner_sessions_create + instance->granted_spanner_sessions_create
187+
permission delete_session = granted->can_spanner_sessions_delete + instance->granted_spanner_sessions_delete
188+
permission get_session = granted->can_spanner_sessions_get + instance->granted_spanner_sessions_get
189+
permission list_sessions = granted->can_spanner_sessions_list + instance->granted_spanner_sessions_list
190+
191+
// Database Operations
192+
permission cancel_operation = granted->can_spanner_databaseoperations_cancel + instance->granted_spanner_databaseoperations_cancel
193+
permission delete_operation = granted->can_spanner_databaseoperations_delete + instance->granted_spanner_databaseoperations_delete
194+
permission get_operation = granted->can_spanner_databaseoperations_get + instance->granted_spanner_databaseoperations_get
195+
permission list_operations = granted->can_spanner_databaseoperations_list + instance->granted_spanner_databaseoperations_list
196+
197+
// Database Roles
198+
permission list_roles = granted->can_spanner_databaseroles_list + instance->granted_spanner_databaseroles_list
199+
permission use_role = granted->can_spanner_databaseroles_use + instance->granted_spanner_databaseroles_use
200+
}

‎schemas/multiple-validation-files/validations/admin-role.yaml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
---
2+
schemaFile: "../schema.zed"
3+
relationships: |-
4+
spanner_database:db1#instance@spanner_instance:instance1
5+
spanner_instance:instance1#project@project:proj1
6+
7+
// Add permissions to "admin" role
8+
role:spanner_database_admin#spanner_databaseoperations_cancel@role:spanner_database_admin
9+
role:spanner_database_admin#spanner_databaseoperations_delete@role:spanner_database_admin
10+
role:spanner_database_admin#spanner_databaseoperations_get@role:spanner_database_admin
11+
role:spanner_database_admin#spanner_databaseoperations_list@role:spanner_database_admin
12+
role:spanner_database_admin#spanner_databaseroles_list@role:spanner_database_admin
13+
role:spanner_database_admin#spanner_databaseroles_use@role:spanner_database_admin
14+
role:spanner_database_admin#spanner_databases_beginorrollbackreadwritetransaction@role:spanner_database_admin
15+
role:spanner_database_admin#spanner_databases_beginpartitioneddmltransaction@role:spanner_database_admin
16+
role:spanner_database_admin#spanner_databases_beginreadonlytransaction@role:spanner_database_admin
17+
role:spanner_database_admin#spanner_databases_create@role:spanner_database_admin
18+
role:spanner_database_admin#spanner_databases_drop@role:spanner_database_admin
19+
role:spanner_database_admin#spanner_databases_get@role:spanner_database_admin
20+
role:spanner_database_admin#spanner_databases_getddl@role:spanner_database_admin
21+
role:spanner_database_admin#spanner_databases_getiampolicy@role:spanner_database_admin
22+
role:spanner_database_admin#spanner_databases_list@role:spanner_database_admin
23+
role:spanner_database_admin#spanner_databases_partitionquery@role:spanner_database_admin
24+
role:spanner_database_admin#spanner_databases_partitionread@role:spanner_database_admin
25+
role:spanner_database_admin#spanner_databases_read@role:spanner_database_admin
26+
role:spanner_database_admin#spanner_databases_select@role:spanner_database_admin
27+
role:spanner_database_admin#spanner_databases_setiampolicy@role:spanner_database_admin
28+
role:spanner_database_admin#spanner_databases_update@role:spanner_database_admin
29+
role:spanner_database_admin#spanner_databases_updateddl@role:spanner_database_admin
30+
role:spanner_database_admin#spanner_databases_userolebasedaccess@role:spanner_database_admin
31+
role:spanner_database_admin#spanner_databases_write@role:spanner_database_admin
32+
role:spanner_database_admin#spanner_instances_get@role:spanner_database_admin
33+
role:spanner_database_admin#spanner_instances_getiampolicy@role:spanner_database_admin
34+
role:spanner_database_admin#spanner_instances_list@role:spanner_database_admin
35+
role:spanner_database_admin#spanner_sessions_create@role:spanner_database_admin
36+
role:spanner_database_admin#spanner_sessions_delete@role:spanner_database_admin
37+
role:spanner_database_admin#spanner_sessions_get@role:spanner_database_admin
38+
role:spanner_database_admin#spanner_sessions_list@role:spanner_database_admin
39+
40+
// Grant admin role to a specific user on a resource
41+
role:spanner_database_admin#bound_user@user:specific_db_admin
42+
spanner_database:db1#granted@role:spanner_database_admin
43+
assertions:
44+
assertTrue:
45+
- "spanner_database:db1#drop@user:specific_db_admin"
46+
- "spanner_database:db1#delete_session@user:specific_db_admin"
47+
assertFalse:
48+
# Can't drop a database you don't have access to
49+
- "spanner_database:db2#drop@user:specific_db_admin"
50+
validation:
51+
spanner_database:db1#drop:
52+
- "[user:specific_db_admin] is <role:spanner_database_admin#bound_user>"
53+
spanner_database:db1#read:
54+
- "[user:specific_db_admin] is <role:spanner_database_admin#bound_user>"

0 commit comments

Comments
 (0)