// 기본 RBAC 모델
type Role = "admin" | "editor" | "viewer";
 
interface User {
  id: string;
  roles: Role[];
}
 
const rolePermissions: Record<Role, string[]> = {
  admin: ["read", "write", "delete", "manage_users"],
  editor: ["read", "write"],
  viewer: ["read"],
};
 
function hasPermission(user: User, permission: string): boolean {
  return user.roles.some((role) =>
    rolePermissions[role]?.includes(permission)
  );
}
 
// 사용 예시
function deletePost(user: User, postId: string): void {
  if (!hasPermission(user, "delete")) {
    throw new ForbiddenError("삭제 권한이 없습니다.");
  }
  // 삭제 로직 실행
}

// 역할 폭발 예시 - 실제로 이런 코드가 만들어집니다
type ExplodedRole =
  | "sales_document_read"
  | "sales_document_write"
  | "sales_document_delete"
  | "sales_project_read"
  | "sales_project_write"
  | "sales_project_delete"
  | "dev_document_read"
  | "dev_document_write"
  // ... 36개의 역할이 필요
  | "marketing_dashboard_delete";

interface AbacContext {
  subject: {
    id: string;
    department: string;
    clearanceLevel: number;
    location: string;
  };
  resource: {
    type: string;
    owner: string;
    classification: "public" | "internal" | "confidential";
    department: string;
  };
  action: string;
  environment: {
    time: Date;
    ipAddress: string;
    deviceType: string;
  };
}
 
// ABAC 정책 예시
function evaluatePolicy(ctx: AbacContext): boolean {
  // 정책 1: 같은 부서의 내부 문서만 수정 가능
  if (ctx.action === "write" && ctx.resource.type === "document") {
    if (ctx.resource.classification === "internal") {
      return ctx.subject.department === ctx.resource.department;
    }
  }
 
  // 정책 2: 기밀 문서는 clearance 3 이상만 접근
  if (ctx.resource.classification === "confidential") {
    return ctx.subject.clearanceLevel >= 3;
  }
 
  // 정책 3: 근무 시간 외에는 내부 자료 접근 불가
  const hour = ctx.environment.time.getHours();
  if (ctx.resource.classification !== "public") {
    if (hour < 9 || hour > 18) {
      return false;
    }
  }
 
  return false;
}

model
  schema 1.1
 
type user
 
type team
  relations
    define member: [user]
 
type folder
  relations
    define owner: [user]
    define editor: [user, team#member]
    define viewer: [user, team#member] or editor or owner
 
type document
  relations
    define parent: [folder]
    define owner: [user]
    define editor: [user, team#member] or owner
    define viewer: [user, team#member] or editor or owner or viewer from parent

import { OpenFgaClient, CredentialsMethod } from "@openfga/sdk";
 
// OpenFGA 클라이언트 초기화
const fgaClient = new OpenFgaClient({
  apiUrl: process.env.FGA_API_URL,
  storeId: process.env.FGA_STORE_ID,
  authorizationModelId: process.env.FGA_MODEL_ID,
  credentials: {
    method: CredentialsMethod.ApiToken,
    config: {
      token: process.env.FGA_API_TOKEN,
    },
  },
});
 
// 관계 튜플 작성
async function grantAccess() {
  await fgaClient.write({
    writes: [
      // hong은 document:report의 editor
      {
        user: "user:hong",
        relation: "editor",
        object: "document:report",
      },
      // document:report의 부모는 folder:shared
      {
        user: "folder:shared",
        relation: "parent",
        object: "document:report",
      },
      // kim은 team:dev의 member
      {
        user: "user:kim",
        relation: "member",
        object: "team:dev",
      },
      // team:dev의 member는 folder:shared의 viewer
      {
        user: "team:dev#member",
        relation: "viewer",
        object: "folder:shared",
      },
    ],
  });
}
 
// 권한 확인 (Check)
async function canUserViewDocument(
  userId: string,
  documentId: string,
): Promise<boolean> {
  const result = await fgaClient.check({
    user: `user:${userId}`,
    relation: "viewer",
    object: `document:${documentId}`,
  });
  return result.allowed ?? false;
}
 
// 사용자가 접근 가능한 객체 목록 조회 (List Objects)
async function listAccessibleDocuments(
  userId: string,
): Promise<string[]> {
  const result = await fgaClient.listObjects({
    user: `user:${userId}`,
    relation: "viewer",
    type: "document",
  });
  return result.objects;
}

definition user {}
 
definition team {
    relation member: user
}
 
definition folder {
    relation owner: user
    relation editor: user | team#member
    relation viewer: user | team#member
 
    permission can_edit = editor + owner
    permission can_view = viewer + can_edit
}
 
definition document {
    relation parent: folder
    relation owner: user
    relation editor: user | team#member
 
    permission can_edit = editor + owner
    permission can_view = can_edit + parent->can_view
}

package authz
 
import rego.v1
 
default allow := false
 
# 관리자는 모든 작업 허용
allow if {
    input.user.roles[_] == "admin"
}
 
# 문서 소유자는 수정 가능
allow if {
    input.action == "edit"
    input.resource.type == "document"
    input.resource.owner == input.user.id
}
 
# 같은 부서원은 읽기 가능
allow if {
    input.action == "read"
    input.resource.department == input.user.department
}
 
# 근무 시간 외 접근 제한
deny if {
    not is_working_hours
    input.resource.classification == "confidential"
}
 
is_working_hours if {
    hour := time.clock(time.now_ns())[0]
    hour >= 9
    hour < 18
}