John Dvorak
717ae1031e
Zanzibar-style authorization graph engine (direct/chain/TTU/defeasible/ binary modes, condensed snapshots, value relations) with 39 rigor test campaigns. Includes fixes for snapshot binary writer/reader format mismatch (snapshot-of-snapshot corruption), possibility write-boundary validation, empty-graph snapshot serialization, relation lookup cache direction collision, config-redefinition cache invalidation, binary threshold semantics, defeasible compiled routing, and comparator reason whitelisting.
38 lines
832 B
JavaScript
38 lines
832 B
JavaScript
export const DSL_PRELUDE = `
|
|
// Built-in types and relations available in every graph.
|
|
// These are intended for request-scoped auth/session evidence (partial graph inputs).
|
|
|
|
definition User {
|
|
id: string
|
|
}
|
|
|
|
definition Account {
|
|
id: string
|
|
tier: string
|
|
}
|
|
|
|
definition Device {
|
|
id: string
|
|
device_risk: number
|
|
auth_method: string
|
|
ip_address: string
|
|
user_agent: string
|
|
}
|
|
|
|
definition AuthSession {
|
|
login_time: timestamp
|
|
last_login_time: timestamp
|
|
mfa_used: boolean
|
|
auth_method: string
|
|
ip_address: string
|
|
user_agent: string
|
|
expires_at: timestamp
|
|
device_risk: number
|
|
}
|
|
|
|
fact session_for_user(user: User, session: AuthSession)
|
|
fact session_for_account(account: Account, session: AuthSession)
|
|
fact session_for_device(device: Device, session: AuthSession)
|
|
fact logged_in_as(device: Device, account: Account)
|
|
`;
|