3 ms·
Sure, I can name one I've prototyped (but never gotten to deploy in prod) in industry. I proposed an embedded μKanren in an Authorization framework for API end
by KirinDave 8y ago
Sure, I can name one I've prototyped (but never gotten to deploy in prod) in industry.
I proposed an embedded μKanren in an Authorization framework for API endpoints. It relied on a system like JWT (or, preferably something less broken like Macaroons) to provide a series of "auth grants" on the request, auth grants being parameterized lines like:
(= :user-id 16)
(bu.admin-grant (group 10))
(is-super-admin)
A few more like this.
Then, you could use Python annotations on API methods to specify this kind of setup on API endpoints:
(= :group_id request.group-id)
(bu.admin_grant (group :group-id))
The system would then perform a kind of logical unification with the request, the cryptographically validated request token, and the API policy. When a request comes in, the request token is merged a "all is forbidden" default set (which is not a literal hash table, it's a policy annotation for the map that contains them). Thus, it's very easy to create arbitrarily complex security policies and so long as they're logically consistent, the interpreter can tell you so (and if it fails, it can tell you why the request doesn't have access).
What's also interesting was that you could unify the API endpoint annotations with an empty set of grants, and then it'd produce a series of example permissions that would be valid (or you could merge it with a user's invalid grants, and it could tell you what access they need to go through). This worked well for internal documentation and I had hoped that it'd be applicable to internal tooling to explain to an operator of a tool what access they needed to go request to use the tool (and even where to do it).
If you're curious, for most requests the time complexity and memory costs were very modest (approaching but not passing 1ms in the worst case I saw, which for API endpoints written in Python is usually dwarfed by garbage like JSON serialization).