Rule Configs

Syntax

Rule configs are stored as a ".write" property on a path in the database using SET_RULE operation.

{
  <path>: {  // path can include variables like $key
    <to>: {
      <target_node>: {
        .write: <eval string to determine the write permission>
      }
    }
  }
}

Its value is an javascript eval string that will be evaluated true or false to determine users' permission on the path whenever a transaction with value write operations on the path is submitted.

Path Variables and Built-in Variables

The path can have path variables like "/transfer/$from/$to/value" to allow flexibility of rule expressions. In the same context, built-in variables are also provided by the system:

Variable / Function

Members

Semantic

Example

API Version

auth

addr

Sender (signer) address

auth.addr === '$uid'

1.0

auth

fid

Caller (function) ID

auth.fid === '_transfer'

1.0

getValue(<db path>)

To get the value at the db path

getValue('/accounts/' + $user_addr + '/balance') >= 0

1.0

getRule(<db path>)

To get the rule at the db path

getRule('/apps/test_app')

1.0

getOwner(<db path>)

To get the owner at the db path

getOwner('/apps/test_app')

1.0

getFunction(<db path>)

To get the function at the db path

getFunction('/apps/test_app')

1.0

evalRule(<db path>, <value>, <auth>, <timestamp>)

To eval the rule config at the rule path

evalRule('/apps/test_app/posts/1', 'hello world', auth, currentTime)

1.0

evalOwner(<db path>, <permission>, <auth>)

To eval the owner config at the owner path

evalOwner('/apps/test_app/posts/1', 'write_owner', auth)

1.0

newData

The new data to be set at the given path

getValue('/accounts/' + $user_addr + '/balance') >= newData

1.0

data

The existing data at the given path

data !== null

1.0

currentTime

Current timestamp

currentTime <= $time + 24 * 60 * 60

1.0

lastBlockNumber

Last block number

lastBlockNumber > 10000

1.0

util

A collection of various utilities

Check this link :https://github.com/ainblockchain/ain-blockchain/blob/master/db/rule-util.js

util.isString(newData)

Examples

Rule configs can be set as the following examples:

{
  transfer: {
    $from: {
      $to: {
        $key: {
          value: {
            .write: "auth.addr === $from && !getValue('transfer/' + $from + '/' + $to + '/' + $key) && getValue(util.getBalancePath($from)) >= newData"
          }
        }
      }
    }
  },
  apps: {
    afan: {
      .write: "auth.addr === '0x12345678901234567890123456789012345678'",
      follow: {
        $uid: {
          .write: "auth.addr === $uid"
        }
      }
    }
  }
}

There is no β€˜read’ permission in data access. It means all network participants can read your data. To secure data on specific node path, users need to encrypt the data with their own private key.

Application of Rule Configs

Permission of a value write operation (e.g. SET_VALUE) is check as follows:

  • When there are no rule configs on the requested path, closest ancestor's rule config is applied

  • If there are more than one path matched, the most specific rule config is applied

    • e.g. Among a) /apps/$app_id/$service, b) /apps/afan/$service, c) /apps/afan/wonny, c) is applied.

  • When the value of the write operation in request is an object, the operation is granted when the permission check succeeds on every path of object. For example, SET_VALUE operation is requested on /foo/bar with value { abc: "abc_val", def: "def_val" }, it should pass the permission check on /foo/bar, /foo/bar/abc, and /foo/bar/def.

  • Rule config always overrides its ancestors' rule configs

Last updated