feat: identity cerbos implementation

modules/identity/routes/access/check-resources/handle.ts

@@ -0,0 +1,6 @@
+import { cerbos } from "../../../cerbos/client.ts";
+import route from "./spec.ts";
+
+export default route.access("session").handle(async ({ body: resources }, { principal }) => {
+  return cerbos.checkResources({ principal, resources });
+});

modules/identity/routes/access/check-resources/spec.ts

@@ -0,0 +1,18 @@
+import { route } from "@platform/relay";
+import z from "zod";
+
+export default route
+  .post("/api/v1/identity/access/check-resources")
+  .body(
+    z.array(
+      z.strictObject({
+        resource: z.strictObject({
+          kind: z.string(),
+          id: z.string(),
+          attr: z.record(z.string(), z.any()),
+        }),
+        actions: z.array(z.string()),
+      }),
+    ),
+  )
+  .response(z.any());