Time-Based Checks
You can grant people access to resources for a specific length of time by adding an expiration time to their role or permission assignment.
Implement the logic
We add a rule to say that a user has a role if they have a role assignment that has not expired.
The has_role_with_expiry fact is like the usual has_role fact, but the fourth argument is the
expiration time, expressed as an integer representing seconds since the Unix epoch.
On a *nix system, date +%s will give you the current Unix time in seconds.
@current_unix_time is a constant you can use in rules that will resolve to
the current Unix time at the time your query is evaluated.
To implement access expiration, we compare the expiration time with the current time.
actor User { }resource Repository { roles = ["member"]; permissions = ["read"]; "read" if "member";}has_role(actor: Actor, role: String, repo: Repository) if expiration matches Integer and has_role_with_expiry(actor, role, repo, expiration) and expiration > @current_unix_time;
Test it out
To test this, we grant Alice the "member" role until 2033, while Bob's role expired in 2022.
Given those time-bound roles, Alice has access but Bob does not.
test "access to repositories is conditional on expiry" { setup { # Alice's access expires in 2033 has_role_with_expiry(User{"alice"}, "member", Repository{"anvil"}, 2002913298); # Bob's access expired in 2022 has_role_with_expiry(User{"bob"}, "member", Repository{"anvil"}, 1655758135); } assert allow(User{"alice"}, "read", Repository{"anvil"}); assert_not allow(User{"bob"}, "read", Repository{"anvil"});}