biscuit

rng := rand.Reader
publicRoot, privateRoot, _ := ed25519.GenerateKey(rng)
builder := biscuit.NewBuilder(privateRoot)

fact1, err := parser.FromStringFact(`right("/a/file1.txt", "read")`)
if err != nil {
	panic(fmt.Errorf("failed to parse authority facts: %v", err))
}
err = builder.AddAuthorityFact(fact1)
if err != nil {
	panic(fmt.Errorf("failed to add authority facts: %v", err))
}

fact2, err := parser.FromStringFact(`right("/a/file1.txt", "write")`)
if err != nil {
	panic(fmt.Errorf("failed to parse authority facts: %v", err))
}
err = builder.AddAuthorityFact(fact2)
if err != nil {
	panic(fmt.Errorf("failed to add authority facts: %v", err))
}

fact3, err := parser.FromStringFact(`right("/a/file2.txt", "read")`)
if err != nil {
	panic(fmt.Errorf("failed to parse authority facts: %v", err))
}
err = builder.AddAuthorityFact(fact3)
if err != nil {
	panic(fmt.Errorf("failed to add authority facts: %v", err))
}

fact4, err := parser.FromStringFact(`right("/a/file3.txt", "write")`)
if err != nil {
	panic(fmt.Errorf("failed to parse authority facts: %v", err))
}
err = builder.AddAuthorityFact(fact4)
if err != nil {
	panic(fmt.Errorf("failed to add authority facts: %v", err))
}

b, err := builder.Build()
if err != nil {
	panic(fmt.Errorf("failed to build biscuit: %v", err))
}

token, err := b.Serialize()
if err != nil {
	panic(fmt.Errorf("failed to serialize biscuit: %v", err))
}

fmt.Printf("Token1 length: %d\n", len(token))

deser, err := biscuit.Unmarshal(token)
if err != nil {
	panic(fmt.Errorf("failed to deserialize biscuit: %v", err))
}

blockBuilder := deser.CreateBlock()

check, err := parser.FromStringCheck(`check if resource($file), operation($permission), ["read"].contains($permission)`)
if err != nil {
	panic(fmt.Errorf("failed to parse check: %v", err))
}
err = blockBuilder.AddCheck(check)
if err != nil {
	panic(fmt.Errorf("failed to add block check: %v", err))
}

b2, err := deser.Append(rng, blockBuilder.Build())
if err != nil {
	panic(fmt.Errorf("failed to append: %v", err))
}

token2, err := b2.Serialize()
if err != nil {
	panic(fmt.Errorf("failed to serialize biscuit: %v", err))
}

fmt.Printf("Token2 length: %d\n", len(token2))

// Verify
b2, err = biscuit.Unmarshal(token2)
if err != nil {
	panic(fmt.Errorf("failed to deserialize token: %v", err))
}

v1, err := b2.Authorizer(publicRoot)
if err != nil {
	panic(fmt.Errorf("failed to create verifier: %v", err))
}

vfact1, err := parser.FromStringFact(`resource("/a/file1.txt")`)
if err != nil {
	panic(fmt.Errorf("failed to parse verifier fact: %v", err))
}
v1.AddFact(vfact1)

vfact2, err := parser.FromStringFact(`operation("read")`)
if err != nil {
	panic(fmt.Errorf("failed to parse verifier fact: %v", err))
}
v1.AddFact(vfact2)

policy, err := parser.FromStringPolicy(`allow if resource("/a/file1.txt")`)
if err != nil {
	panic(fmt.Errorf("failed to parse verifier policy: %v", err))
}
v1.AddPolicy(policy)

if err := v1.Authorize(); err != nil {
	fmt.Println(v1.PrintWorld())
	fmt.Println("forbidden to read /a/file1.txt")
} else {
	//fmt.Println(v1.PrintWorld())

	fmt.Println("allowed to read /a/file1.txt")
}

v1, _ = b2.Authorizer(publicRoot)

vfact1, err = parser.FromStringFact(`resource("/a/file1.txt")`)
if err != nil {
	panic(fmt.Errorf("failed to parse verifier fact: %v", err))
}
v1.AddFact(vfact1)

vfact2, err = parser.FromStringFact(`operation("write")`)
if err != nil {
	panic(fmt.Errorf("failed to parse verifier fact: %v", err))
}
v1.AddFact(vfact2)

policy, err = parser.FromStringPolicy(`allow if resource("/a/file1.txt")`)
if err != nil {
	panic(fmt.Errorf("failed to parse verifier policy: %v", err))
}
v1.AddPolicy(policy)

if err := v1.Authorize(); err != nil {
	fmt.Println("forbidden to write /a/file1.txt")
} else {
	fmt.Println("allowed to write /a/file1.txt")
}

Output:

Token1 length: 260
Token2 length: 446
allowed to read /a/file1.txt
forbidden to write /a/file1.txt