-
Notifications
You must be signed in to change notification settings - Fork 32
Initial CLI docs #566
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
gemanor
wants to merge
4
commits into
master
Choose a base branch
from
initial-cli-docs
base: master
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Initial CLI docs #566
Changes from all commits
Commits
Show all changes
4 commits
Select commit
Hold shift + click to select a range
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,247 @@ | ||
--- | ||
sidebar_position: 5 | ||
title: Use the Permit CLI | ||
description: Use the Permit CLI to manage, test, and automate your authorization policies from the command line. | ||
--- | ||
|
||
Now that you've learned how to configure policies and perform authorization checks, let's explore how to manage your authorization system programmatically using the **Permit CLI**. The CLI provides powerful tools for policy management, testing, and automation that complement the web interface and SDKs you've already learned about. | ||
|
||
import TimelineStep from "../../src/components/timeline/TimelineStep"; | ||
import TimelineWrapper from "../../src/components/timeline/TimelineWrapper"; | ||
import WhatsNext from "../../src/components/whats-next/WhatsNext"; | ||
|
||
|
||
## CLI Capabilities & Reference | ||
|
||
The **Permit CLI** is an open-source command-line tool that empowers developers to manage, test, and automate fine-grained access control across applications. It provides a comprehensive interface to all of Permit's functionality, including AI-powered policy generation, interactive wizards, policy testing, and local PDP management. | ||
|
||
For the complete CLI specification and all available commands, explore the [Permit CLI repository](https://github.com/permitio/permit-cli) and its [full documentation](https://github.com/permitio/permit-cli#full-command-list). | ||
|
||
## Prerequisites | ||
|
||
Before starting this walkthrough, ensure you have: | ||
|
||
- A [Permit.io account](https://app.permit.io) with an active project | ||
- Node.js 16+ installed on your system | ||
- Basic familiarity with command-line tools | ||
- Completed the previous walkthroughs: [Configure your first RBAC policy](/overview/configure-your-first-rbac-policy), [Use the Permit API and SDK](/overview/use-the-permit-api-and-sdk), [Sync your first user](/overview/sync-your-first-user-with-sdk), and [Perform policy checks](/overview/perform-policy-check-with-cloud-pdp) | ||
|
||
<TimelineWrapper> | ||
<TimelineStep> | ||
|
||
## Install and authenticate with the CLI | ||
|
||
The Permit CLI is available as an npm package and provides a command-line interface to all of Permit's functionality. | ||
|
||
1. **Install the CLI globally:** | ||
|
||
```bash | ||
npm install -g @permitio/cli | ||
``` | ||
|
||
2. **Verify the installation:** | ||
|
||
```bash | ||
permit | ||
``` | ||
|
||
You should see the following output: | ||
``` | ||
Permit CLI is a developer swiss army knife for fine-grained authorization | ||
Run this command with --help for more information | ||
|
||
You're not logged in. Run `permit login` to activate all CLI features. | ||
``` | ||
|
||
3. **Authenticate with your Permit account:** | ||
|
||
```bash | ||
permit login | ||
``` | ||
|
||
This will open your browser to authenticate with Permit.io. After successful authentication, your credentials will be stored locally. | ||
|
||
4. **Verify your authentication:** | ||
|
||
```bash | ||
permit | ||
``` | ||
|
||
You should see your account information displayed. | ||
|
||
5. **Create an environment:** | ||
|
||
```bash | ||
permit env create | ||
``` | ||
|
||
Now, you can create a new environment so you can start creating policies. | ||
|
||
</TimelineStep> | ||
<TimelineStep> | ||
|
||
## Create policies using AI | ||
|
||
The CLI includes AI-powered policy generation that can create structured RBAC policies from natural language descriptions. This is perfect for quickly prototyping authorization models. | ||
|
||
1. **Start the AI policy creation:** | ||
|
||
```bash | ||
permit policy create ai | ||
``` | ||
|
||
2. **Describe your authorization requirements:** | ||
|
||
When prompted, describe your application's authorization needs. For example: | ||
``` | ||
A document management system with three user types: admins who can do everything, editors who can create and edit documents, and viewers who can only read documents. | ||
``` | ||
|
||
3. **Review and approve the generated policy:** | ||
|
||
The AI will generate a structured policy with resources, roles, and permissions. Review the output and approve it to apply the policy to your environment. | ||
|
||
:::tip | ||
The AI policy generator is particularly useful for rapid prototyping and can help you discover authorization patterns you might not have considered. | ||
::: | ||
|
||
</TimelineStep> | ||
<TimelineStep> | ||
|
||
## Use interactive policy wizards | ||
|
||
For more control over policy creation, use the interactive wizard that guides you through each step. | ||
|
||
1. **Initialize the policy wizard:** | ||
|
||
```bash | ||
permit init | ||
``` | ||
|
||
This will guide you through creating a complete authorization policy step by step, similar to what you did in the web interface. | ||
|
||
2. **Or use the simple policy creator for quick setup:** | ||
|
||
```bash | ||
permit policy create simple \ | ||
--resources "document:Document@category,status" \ | ||
--actions "create:Create Document" "read:Read Document" "update:Update Document" "delete:Delete Document" \ | ||
--roles "admin|document:create|document:read|document:update|document:delete" \ | ||
--roles "editor|document:create|document:read|document:update" \ | ||
--roles "viewer|document:read" | ||
``` | ||
|
||
This creates a document management system with three roles and their respective permissions, similar to the RBAC policy you configured earlier. | ||
|
||
</TimelineStep> | ||
<TimelineStep> | ||
|
||
## Sync users and assign roles | ||
|
||
Now let's add users and assign them roles using the CLI, building on what you learned about user syncing. | ||
|
||
1. **Sync a user with role assignment:** | ||
|
||
```bash | ||
permit api sync user \ | ||
--key "john@example.com" \ | ||
--email "john@example.com" \ | ||
--first_name "John" \ | ||
--last_name "Doe" \ | ||
--roles "admin" | ||
``` | ||
|
||
2. **Sync another user with a different role:** | ||
|
||
```bash | ||
permit api sync user \ | ||
--key "jane@example.com" \ | ||
--email "jane@example.com" \ | ||
--first_name "Jane" \ | ||
--last_name "Smith" \ | ||
--roles "editor" | ||
``` | ||
|
||
3. **Verify user assignments:** | ||
|
||
```bash | ||
permit api users list | ||
``` | ||
|
||
This shows all users in your environment, similar to the Directory view in the web interface. | ||
|
||
</TimelineStep> | ||
<TimelineStep> | ||
|
||
## Perform policy checks from the command line | ||
|
||
Now let's test your authorization policies using the CLI, building on your understanding of policy checks. | ||
|
||
1. **Run a local PDP:** | ||
|
||
```bash | ||
permit pdp run | ||
``` | ||
|
||
This will start a local PDP instance on port 7766. | ||
|
||
2. **Check if John can create a document:** | ||
|
||
```bash | ||
permit pdp check \ | ||
--user "john@example.com" \ | ||
--action "create" \ | ||
--resource "document" | ||
``` | ||
|
||
You should see output indicating whether the user is permitted or denied. | ||
|
||
3. **Check if Jane can delete a document:** | ||
|
||
```bash | ||
permit pdp check \ | ||
--user "jane@example.com" \ | ||
--action "delete" \ | ||
--resource "document" | ||
``` | ||
|
||
4. **Check if Jane can read a document:** | ||
|
||
```bash | ||
permit pdp check \ | ||
--user "jane@example.com" \ | ||
--action "read" \ | ||
--resource "document" | ||
``` | ||
|
||
These checks work the same way as the `permit.check()` function you learned about, but from the command line. | ||
|
||
</TimelineStep> | ||
</TimelineWrapper> | ||
|
||
## What did you learn? | ||
|
||
In this walkthrough, you've successfully: | ||
|
||
- ✅ Installed and authenticated with the Permit CLI | ||
- ✅ Created authorization policies using AI and interactive wizards | ||
- ✅ Synced users and assigned appropriate roles from the command line | ||
- ✅ Performed policy checks to verify your authorization rules | ||
- ✅ Tested your policies with audit replay and end-to-end tests | ||
- ✅ Run a local PDP for development and testing | ||
|
||
The CLI complements the web interface and SDKs you've already learned about, providing a powerful command-line workflow for policy management and automation. | ||
|
||
:::tip FUN FACT! | ||
Command-line interfaces have been around since the 1960s! The first CLI was developed for the Compatible Time-Sharing System (CTSS) at MIT, and they've remained essential tools for developers ever since. | ||
::: | ||
|
||
<WhatsNext progress={50} customText="Excellent! You've mastered the CLI workflow."> | ||
<h2>What's next? 🎉</h2> | ||
<ul> | ||
<li>Set up a <a href="/overview/local-authorization-microservice">local authorization microservice</a> for production deployment</li> | ||
<li>Configure attribute-based access control (ABAC) policies</li> | ||
<li>Learn about relationship-based access control (ReBAC)</li> | ||
<li>Explore advanced authorization queries and data filtering</li> | ||
</ul> | ||
</WhatsNext> |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,5 +1,5 @@ | ||
--- | ||
sidebar_position: 2 | ||
sidebar_position: 3 | ||
title: Sync your First User | ||
--- | ||
|
||
|
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
[nitpick] Progress percentages are updated manually across multiple docs and can easily drift; consider deriving this value dynamically or centralizing it to reduce maintenance overhead.
Copilot uses AI. Check for mistakes.