learn stuff

Signed-off-by: ivan katliarchuk <[email protected]>

Author: ivankatliarchuk

playground/ex13/denied_provisioners.rego

@@ -10,7 +10,7 @@ denied_provisioners = ["local-exec"]
 
 
 array_contains(arr, elem) {
-  arr[_] = elem
+    arr[_] = elem
 }
 
 module_name(path) = name {

playground/ex17/enforce_aws_resource.rego

@@ -5,6 +5,7 @@
 #       before "not array_contains..."
 #
 #       startswith(resources.type,"aws_")
+# https://www.scalr.com/blog/opa-series-part-1-open-policy-agent-and-terraform
 
 package terraform
 

playground/ex26/data.json

@@ -0,0 +1,17 @@
+{
+  "attributes": {
+    "user": [
+      "read:books"
+    ],
+    "moderator": [
+      "read:books",
+      "write:books"
+    ],
+    "administrator": [
+      "read:books",
+      "write:books",
+      "read:store",
+      "write:store"
+    ]
+  }
+}

playground/ex26/mapping.json

@@ -0,0 +1,15 @@
+{
+  "user": [
+    "read:books"
+  ],
+  "moderator": [
+    "read:books",
+    "write:books"
+  ],
+  "administrator": [
+    "read:books",
+    "write:books",
+    "read:store",
+    "write:store"
+  ]
+}

playground/ex26/policy.rego

@@ -0,0 +1,23 @@
+# https://stackoverflow.com/questions/71420104/opa-authorization-policies-with-scopes-and-roles?rq=1
+package whatever.authz
+
+context_scope == data["attributes"][principal_role][_]
+
+# context_scope := concat(":", [input.context.action, input.context.resource])
+context_scope = data["attributes"][principal_role][_]
+
+default allow = false
+
+allow if {
+	token_has_context_scope
+	principal_has_resource_access
+}
+
+token_has_context_scope if {
+	context_scope == input.token.scopes[_]
+}
+
+principal_has_resource_access if {
+	principal_role := input.principal.roles[_]
+	context_scope == data[principal_role][_]
+}

playground/ex27/authorizer.rego

@@ -0,0 +1,7 @@
+package authorizer
+
+default username := null
+
+decode_user(jwt) := user_id {
+    // logic to decode token & return user_id
+}

playground/ex27/policy.rego

@@ -0,0 +1,13 @@
+package user
+
+import data.authorizer.*
+
+default allow := false
+
+user_id := x {
+    x := decode_user(input.jwt)
+}
+
+allow := true {
+    user_id != null
+}