contrib/data_filter_example/example.rego at master · ujwalbukka/contrib · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
package example

# data.example.allow == true
#
# {"input": {"method": "GET", "path": ...}, "unknowns": ["data.posts"]}

allow {
    input.method = "POST"
    input.path = ["posts"]
    input.subject.user  # authenticated users can create posts
}

allow {
    input.method = "GET"
    input.path = ["posts", post_id]
    allowed[post]
    post.id = post_id
}

allow {
    input.method = "GET"
    input.path = ["posts"]
    allowed[_]
}

allowed[post] {
    data.posts[post]
    post.author = input.subject.user
}

allowed[post] {
    data.posts[post]
    post.department = input.subject.departments[_]
    post.clearance_level <= input.subject.clearance_level
}

allowed[post] {
    data.posts[post]
    post.department = "company"
}