chore(examples): update examples to match new schema

Author: freakyfelt

examples/2022-04/Kitty.jsonc

@@ -0,0 +1,78 @@
+/*
+  Shows an example usage for our Kitty resource
+
+  == Example Context
+  {
+    kitty: {
+      state: 'purring',
+      ownerId: 'sillyLittleMe'
+    },
+    subject: {
+      id: 'sillyLittleMe',
+      role: 'admin'
+    }
+  }
+*/
+{
+  "$schema": "../../schemas/resource-policy-2022-04.schema.json",
+  "resourceType": "Kitty",
+  "actions": ["create", "read", "update", "pet"],
+  "definitions": [
+    {
+      "environment": "*", // applies across all environments
+      "policies": [
+        {
+          "description": "Allow everyone to create a kitty",
+          "action": "create", // specify a single action
+          "effect": "allow",
+          "constraint": true
+        },
+        {
+          "description": "Allow admins to take any action",
+          "action": "*",
+          "effect": "allow",
+          "constraint": {
+            // expects that context will include a subject object with a role property
+            "===": [
+              { "var": "subject.role" },
+              "admin"
+            ]
+          }
+        },
+        {
+          "description": "allow owners to read, update and pet the kitty",
+          "action": ["read", "update", "pet"], // specify a list of actions
+          "effect": "allow",
+          "constraint": {
+            "===": [
+              { "var": "subject.id" },
+              { "var": "kitty.ownerId" }
+            ]
+          }
+        },
+        {
+          "description": "Do not allow users (even admins!) to pet if the kitty is sleeping or eating",
+          "action": "pet",
+          "effect": "deny", // will override any allow statement
+          "constraint": {
+            "in": [
+              { "var": "kitty.state" },
+              ["eating", "sleeping"]
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "environment": ["development", "alpha", "beta"], // specify a list of environments
+      "policies": [
+        {
+          "description": "allow developers to update any kitty in non-prod environments",
+          "action": "update",
+          "effect": "allow",
+          "constraint": true
+        }
+      ]
+    }
+  ]
+}

examples/2022-04/dumbdata-Document.jsonc

@@ -0,0 +1,121 @@
+/*
+  Shows an example usage for creating policies for our dumbdata service's Document resource
+
+  == Example Context
+  {
+    Resource: {
+      Tags: ["Public", "ReadOnly"],
+      AuthorURI: "urn::12345:whodunnit:users/SillyMe",
+      ...
+    },
+    Principal: {
+      URI: "urn::12345:whodunnit:users/SillyMe",
+      RoleURI: "urn::12345:whodunnit:roles/StandardUser"
+    },
+    Environment: {
+      CurrentEnv: "Prod-use1"
+    }
+  }
+*/
+{
+  "$schema": "../../schemas/resource-policy-2022-04.schema.json",
+  "resourceType": "dumbdata:Document",
+  "actions": [
+    "dumbdata:CreateDocument",
+    "dumbdata:DeleteDocument",
+    "dumbdata:GetDocument",
+    "dumbdata:PutDocument",
+    "dumbdata:QueryDocuments"
+  ],
+  "definitions": [
+    {
+      "environment": "*",
+      "policies": [
+        {
+          "description": "Create a dropbox where anyone can create a document, but can't read or update",
+          "action": "dumbdata:CreateDocument",
+          "effect": "allow",
+          "constraint": true
+        },
+        {
+          "description": "Allow anyone to read/query documents with the Public tag",
+          "action": ["dumbdata:GetDocument", "dumbdata:QueryDocuments"],
+          "effect": "allow",
+          "constraint": {
+            "some": [
+              { "var": "Resource.Tags" },
+              // { "var": "" } references the current element from Resource.Tags
+              { "in": [{ "var": "" }, ["Public"]]}
+            ]
+          }
+        },
+        {
+          "description": "Allow users to manage documents they've created if the Editable tag is present",
+          "action": "*",
+          "effect": "allow",
+          "constraint": {
+            "and": [
+              {
+                "some": [
+                  { "var": "Resource.Tags" },
+                  { "===": [{ "var": "" }, "Editable"] }
+                ]
+              },
+              {
+                "===": [
+                  { "var": "Principal.URI" },
+                  { "var": "Resource.AuthorURI" }
+                ]
+              }
+            ]
+          }
+        },
+        {
+          "description": "Block users from managing documents if the ReadOnly tag is present and they're not an admin",
+          "action": ["dumbdata:DeleteDocument", "dumbdata:PutDocument"],
+          "effect": "deny",
+          "constraint": {
+            "all": [
+              {
+                "some": [
+                  { "var": "Resource.Tags" },
+                  { "===": [{ "var": "" }, "ReadOnly"] }
+                ]
+              },
+              {
+                "!==": [
+                  { "var": "Principal.RoleURI" },
+                  "urn::12345:whodunnit:roles/Administrator"
+                ]
+              },
+              // Don't block mutations in the test suite
+              // NOTE: this is just a hypothetical example. Please don't actually do this.
+              {
+                "!==": [
+                  { "var": "Environment.CurrentEnv" },
+                  "test"
+                ]
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "environment": "test",
+      "policies": [
+        {
+          "description": "Allow the test runner to delete documents it created, regardless of the Editable tag being present",
+          "action": "dumbdata:DeleteItem",
+          "effect": "allow",
+          "constraint": {
+            "===": [
+              { "var": "Resource.AuthorURI" },
+              { "var": "Principal.URI" }
+            ]
+          }
+        }
+      ]
+    }
+  ]
+}

examples/Kitty.jsonc

@@ -15,9 +15,8 @@
 */
 {
   "$schema": "../schemas/resource-policy-2023-02.schema.json",
-  "resourceType": "Kitty",
   "actions": ["create", "read", "update", "pet"],
-  "policies": [
+  "statement": [
     {
       "description": "Allow everyone to create a kitty",
       "action": "create", // specify a single action

examples/dumbdata-Document.jsonc

@@ -12,22 +12,11 @@
       URI: "urn::12345:whodunnit:users/SillyMe",
       RoleURI: "urn::12345:whodunnit:roles/StandardUser"
     },
-    Environment: {
-      CurrentEnv: "Prod-use1"
-    }
   }
 */
 {
   "$schema": "../schemas/resource-policy-2023-02.schema.json",
-  "resourceType": "dumbdata:Document",
-  "actions": [
-    "dumbdata:CreateDocument",
-    "dumbdata:DeleteDocument",
-    "dumbdata:GetDocument",
-    "dumbdata:PutDocument",
-    "dumbdata:QueryDocuments"
-  ],
-  "policies": [
+  "statement": [
     {
       "description": "Create a dropbox where anyone can create a document, but can't read or update",
       "action": "dumbdata:CreateDocument",
@@ -84,17 +73,9 @@
               { "var": "Principal.RoleURI" },
               "urn::12345:whodunnit:roles/Administrator"
             ]
-          },
-          // Don't block mutations in the test suite
-          // NOTE: this is just a hypothetical example. Please don't actually do this.
-          {
-            "!==": [
-              { "var": "Environment.CurrentEnv" },
-              "test"
-            ]
           }
         ]
       }
     }
   ]
-}
+}