Policies

A Policy is the same thing you build on Access → Policies in Studio, written as an expression. Reusable rules get a name; validate checks every condition before anything is sent.

from pawabase_iac import P, Policy, all_of, any_of

Policy("owner_or_staff", P.owner("user_id") | P.role("admin"))
Policy("paid_and_verified", P.authenticated() & (P.auth.plan != "free") & P.auth.email_verified.truthy())
Policy("family", (P.record.student_user_id == P.auth.user_id) | P.record.guardian_ids.contains(P.auth.user_id))
Policy("not_suspended", ~P.record.suspended.truthy())

Facts you can read

P.auth, P.record, P.input, P.request, P.credential and P.env are paths into what a rule can see (the same facts as in Facts a rule can check). Use attribute access: P.auth.user_id, P.record.owner_id, P.request.ip.

Comparisons

Write	Studio calls it
`P.record.status == "draft"`	equals
`P.record.status != "archived"`	does not equal
`P.input.quantity >= 1`, `>`, `<`, `<=`	greater / at least / less / at most
`P.input.status.in_(["draft", "submitted"])`	is one of
`P.auth.roles.contains("admin")`	contains
`P.request.path.startswith("/public")`	starts with
`P.auth.email.endswith("@acme.com")`	ends with
`P.record.id.not_in(P.auth.blocked)`	is not one of
`P.input.slug.matches(r"^[a-z0-9-]+$")`	matches regex
`P.auth.org.truthy()`	is set
`P.record.deleted_at.empty()`	is empty
`P.auth.user_id.exists()`	exists

These mirror the operators on Comparisons and checks. The trailing underscore on in_ avoids Python’s in keyword.

Ready-made checks

Call	Studio
`P.authenticated()`	Is signed in
`P.role("admin")`, `P.role("a", "b")`	Has role
`P.permission("posts.write")`	Has permission
`P.owner("owner_id")`	Owns the record (field)
`P.service()`	Uses a secret key
`P.aal("aal2")`	Signed in with 2FA
`P.scope("resource:write")`	Key has scope
`P.kind("user")`	Caller kind is
`P.anonymous()`	The caller is not signed in
`P.now`	The current time, to compare with a date column

Combining

Operator	Meaning	Studio
`a & b`	both	All of
`a \| b`	either	Any of
`~a`	not	None of
`all_of(a, b, c)`, `any_of(a, b, c)`	many at once	All of, Any of

Python’s and, or and not don’t work on conditions. Use &, | and ~, and put each comparison in parentheses: (P.auth.plan != "free") & P.authenticated().

Using a policy

A Policy can be passed anywhere a rule is accepted: a table’s operations, a bucket’s read_policy, a route’s policy, a subscription’s condition. policy.condition gives the bare condition for combining (mine.condition | staff.condition).

from pawabase_iac import Allow, Table, crud

Table("notes", fields=[...], operations=crud(mine, delete=Allow(P.role("admin"))))

Names are checked

Referencing a policy that doesn’t exist, or a role in P.role(...) that isn’t defined (when roles are managed here), is caught by pawabase validate. See Writing rules and Recipes for what to build.

Roles

Name sets of permissions.

Access rules

The concepts.

Overview

Infrastructure as code

Define your backend

Logic and events

Files and mail

Ship it

Reference

SDK clients

Facts you can read

Comparisons

Ready-made checks

Combining

Using a policy

Names are checked

Roles

Access rules

​Facts you can read

​Comparisons

​Ready-made checks

​Combining

​Using a policy

​Names are checked

Roles

Access rules

Facts you can read

Comparisons

Ready-made checks

Combining

Using a policy

Names are checked