Jay Brown
6dccf494f8
cleanup permit policies and correct documentation * docs * policy cleanup * refactor * Merge remote-tracking branch 'origin/feature/permit-policy-cleanup' into feature/permit-policy-cleanup * docs and edits
30 lines
571 B
Rego
30 lines
571 B
Rego
package example
|
|
|
|
import rego.v1
|
|
|
|
# Default deny
|
|
default allow := false
|
|
|
|
# Allow if user is admin
|
|
allow if {
|
|
input.user.role == "admin"
|
|
}
|
|
|
|
# Allow read operations for all users
|
|
allow if {
|
|
input.action == "read"
|
|
}
|
|
|
|
# Allow write operations for users with write permission
|
|
allow if {
|
|
input.action == "write"
|
|
input.user.role in data.static.permissions.write_roles
|
|
}
|
|
|
|
# Example rule using the JSON data
|
|
user_has_permission(user_id, permission) if {
|
|
user := data.static.users[_]
|
|
user.id == user_id
|
|
permission in data.static.permissions[user.role]
|
|
}
|