feat: add initial workspace resource

platform/cerbos/client.ts

@@ -1,8 +1,17 @@
 import { HTTP } from "@cerbos/http";
+import { getEnvironmentVariable } from "@platform/config/environment.ts";
+import z from "zod";
 
-export const cerbos = new HTTP("http://localhost:3592", {
-  adminCredentials: {
-    username: "cerbos",
-    password: "cerbosAdmin",
+export const cerbos = new HTTP(
+  getEnvironmentVariable({
+    key: "CERBOS_URL",
+    type: z.string(),
+    fallback: "http://localhost:3592",
+  }),
+  {
+    adminCredentials: {
+      username: "cerbos",
+      password: "cerbosAdmin",
+    },
   },
-});
+);

platform/cerbos/package.json

@@ -5,6 +5,8 @@
   "type": "module",
   "dependencies": {
     "@cerbos/http": "0.23.1",
-    "@valkyr/auth": "npm:@jsr/valkyr__auth@2.1.4"
+    "@platform/config": "workspace:*",
+    "@valkyr/auth": "npm:@jsr/valkyr__auth@2.1.4",
+    "zod": "4.1.11"
   }
 }

platform/cerbos/policies/workspace.yaml

@@ -0,0 +1,42 @@
+# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/Policy.schema.json
+# docs: https://docs.cerbos.dev/cerbos/latest/policies/resource_policies
+
+apiVersion: api.cerbos.dev/v1
+resourcePolicy:
+  resource: workspace
+  version: default
+  rules:
+
+    ### Read
+
+    - actions:
+        - read
+      effect: EFFECT_ALLOW
+      roles:
+        - admin
+        - user
+      condition:
+        match:
+          expr: request.principal.workspaceIds.includes(request.resource.id)
+
+    ### Update
+
+    - actions:
+        - update
+      effect: EFFECT_ALLOW
+      roles:
+        - admin
+      condition:
+        match:
+          expr: request.principal.workspaceIds.includes(request.resource.id)
+
+    ### Delete
+    
+    - actions:
+        - delete
+      effect: EFFECT_ALLOW
+      roles:
+        - admin
+      condition:
+        match:
+          expr: request.principal.workspaceIds.includes(request.resource.id)

platform/cerbos/resources.ts

@@ -5,6 +5,10 @@ export const resources = new ResourceRegistry([
     kind: "identity",
     attr: {},
   },
+  {
+    kind: "workspace",
+    attr: {},
+  },
 ] as const);
 
 export type Resource = typeof resources.$resource;