permit_read_anyone

The simplest useful rule: permit the Read action for any principal on any resource, with no when clause (Step 2 of the getting-started tour). A pure-Cedar rule with no history dependence, checked against the tour’s own minimal Login/Read Drupe schema (schema.cedarschema).

The trace shows both outcomes:

• @0 — alice’s Login (a history-only occurrence here; the policy gates Read, not Login, so no permit matches → deny).
• @10 — alice’s Read → allow (rule 0 matches; bare principal/resource mean “any”).
• @20 — bob’s Read → allow (“anyone” really means any principal).

Referenced by guide/01-getting-started.md.

Policy

// Permit Read for anyone, on any resource. No `when` clause means no extra
// condition: this rule applies whenever its scope matches (the Read action).
// A pure-Cedar rule with no history dependence.
@id("permit_read_anyone")
permit (
    principal,
    action == Drupe::Action::"Read",
    resource
);

Schema

namespace Drupe {
  type LoginInput = { user: String };
  type ReadInput = { user: String };
  entity Gateway;
  entity OAuthUser = { id: String } tags String;
  action "Login" appliesTo {
    principal: [OAuthUser],
    resource: [Gateway],
    context: { input: LoginInput }
  };
  action "Read" appliesTo {
    principal: [OAuthUser],
    resource: [Gateway],
    context: { input: ReadInput }
  };
}

Trace

@0 scope(principal: Drupe::OAuthUser::"alice", resource: Drupe::Gateway::"gw1") request_context(input: { user: "alice" }) Drupe::Action::"Login"::request(input: { user: "alice" }, callerPrincipal: Drupe::OAuthUser::"alice", callerResource: Drupe::Gateway::"gw1", requestId: "u1")
@10 scope(principal: Drupe::OAuthUser::"alice", resource: Drupe::Gateway::"gw1") request_context(input: { user: "alice" }) Drupe::Action::"Read"::request(input: { user: "alice" }, callerPrincipal: Drupe::OAuthUser::"alice", callerResource: Drupe::Gateway::"gw1", requestId: "u2")
@20 scope(principal: Drupe::OAuthUser::"bob", resource: Drupe::Gateway::"gw1") request_context(input: { user: "bob" }) Drupe::Action::"Read"::request(input: { user: "bob" }, callerPrincipal: Drupe::OAuthUser::"bob", callerResource: Drupe::Gateway::"gw1", requestId: "u3")

Expected Output

@0 (time point 0): DENY
@10 (time point 1): ALLOW  [rules: 0]
@20 (time point 2): ALLOW  [rules: 0]