PHP code example of kjdev / cedar

    
        
<?php
require_once('vendor/autoload.php');

/* Start to develop here. Best regards https://php-download.com/ */

    

kjdev / cedar example snippets

$store = new Cedar\PolicyStore('my-app-store');
$store->loadString('admin-may-view', <<<'CEDAR'
permit (
    principal in MyApp::Group::"admins",
    action == MyApp::Action::"view",
    resource
);
CEDAR);

$client = new Cedar\AuthorizationClient($store);

$result = $client->isAuthorized([
    'policyStoreId' => 'my-app-store',
    'principal' => ['entityType' => 'MyApp::User',   'entityId' => 'alice'],
    'action'    => ['actionType' => 'MyApp::Action', 'actionId' => 'view'],
    'resource'  => ['entityType' => 'MyApp::Doc',    'entityId' => 'doc-42'],
    'entities'  => ['entityList' => [[
        'identifier' => ['entityType' => 'MyApp::User',  'entityId' => 'alice'],
        'attributes' => [],
        'parents'    => [['entityType' => 'MyApp::Group', 'entityId' => 'admins']],
    ]]],
]);

// $result === [
//     'decision' => 'ALLOW',
//     'determiningPolicies' => [['policyId' => 'admin-may-view']],
//     'errors' => [],
// ]

interface AuthorizationClientInterface
{
    public function isAuthorized(array $params): array;
    public function isAuthorizedWithToken(array $params): array;
}

final class CedarLocalClient implements AuthorizationClientInterface
{
    public function __construct(private readonly \Cedar\AuthorizationClient $client) {}

    public function isAuthorized(array $params): array
    {
        return $this->client->isAuthorized($params);
    }

    public function isAuthorizedWithToken(array $params): array
    {
        return $this->client->isAuthorizedWithToken($params);
    }
}

final class AvpClient implements AuthorizationClientInterface
{
    public function __construct(
        private readonly \Aws\VerifiedPermissions\VerifiedPermissionsClient $client,
    ) {}

    public function isAuthorized(array $params): array
    {
        return $this->client->isAuthorized($params)->toArray();
    }

    public function isAuthorizedWithToken(array $params): array
    {
        return $this->client->isAuthorizedWithToken($params)->toArray();
    }
}

$authorizer = getenv('APP_ENV') === 'production'
    ? new AvpClient(new \Aws\VerifiedPermissions\VerifiedPermissionsClient([
          'region'  => 'us-east-1',
          'version' => 'latest',
      ]))
    : new CedarLocalClient(new \Cedar\AuthorizationClient($store));

$result = $authorizer->isAuthorized([
    'policyStoreId' => $policyStoreId,
    'principal'     => ['entityType' => 'MyApp::User',   'entityId' => 'alice'],
    'action'        => ['actionType' => 'MyApp::Action', 'actionId' => 'view'],
    'resource'      => ['entityType' => 'MyApp::Doc',    'entityId' => 'doc-42'],
    'entities'      => ['entityList' => [/* ... */]],
]);
// $result['decision'] === 'ALLOW' | 'DENY'

new Cedar\AuthorizationClient(PolicyStore $store, array $options = []);

[
    'policyStoreId' => string,                 //  => ...],   // ,   // optional
    'entities'  => ['entityList' => [                                 // optional
        [
            'identifier' => ['entityType' => ..., 'entityId' => ...],
            'attributes' => [name => AttributeValue, ...],
            'parents'    => [['entityType' => ..., 'entityId' => ...], ...],
        ],
        ...
    ]],
    // isAuthorizedWithToken only:
    'identityToken' => [claim => value, ...],   // verified claims array
    'accessToken'   => [claim => value, ...],   // verified claims array
]

['string' => 'admin']
['long'    => 42]
['boolean' => true]
['ipaddr'  => '10.0.0.1']
['decimal' => '12.3400']
['datetime' => '2026-01-01T00:00:00Z']
['duration' => '1d12h']
['entityIdentifier' => ['entityType' => 'MyApp::User', 'entityId' => 'bob']]
['set'    => [AttributeValue, ...]]
['record' => [name => AttributeValue, ...]]

[
    'decision' => 'ALLOW' | 'DENY',
    'determiningPolicies' => [['policyId' => string], ...],
    'errors' => [['errorDescription' => string], ...],
    // isAuthorizedWithToken only:
    'principal' => ['entityType' => string, 'entityId' => string],
]

$payload = $jwtVerifier->decode($rawJwt);   // verified by your library

$client = new Cedar\AuthorizationClient($store, [
    'identitySource' => [
        'principalEntityType' => 'MyApp::User',
        'principalIdClaim'    => 'sub',
        'groupEntityType'     => 'MyApp::Group',
        'groupIdsClaim'       => 'cognito:groups',
    ],
]);

$result = $client->isAuthorizedWithToken([
    'policyStoreId' => $store->id(),
    'identityToken' => $payload,
    'action'   => ['actionType' => 'MyApp::Action', 'actionId' => 'view'],
    'resource' => ['entityType' => 'MyApp::Doc',    'entityId' => 'doc-42'],
]);

bash
php /usr/lib64/php/build/gen_stub.php cedar.stub.php