access to entity only go through to query lib

apps/policy-engine/src/resource/open-policy-agent/rego/__test__/criteria/resource_test.rego

@@ -17,7 +17,7 @@ test_resource {
 	groups = resource.groups with input as requestWithEip1559Transaction with data.entities as entities
 	groups == {"test-account-group-ONE-uid"}
 
-	accountGroupsById = get.accountGroups("eip155:eoa:0xddcf208f219a6e6af072f2cfdc615b2c1805f98e") with input as requestWithEip1559Transaction with data.entities as entities
+	accountGroupsById = get.account("eip155:eoa:0xddcf208f219a6e6af072f2cfdc615b2c1805f98e").groups with input as requestWithEip1559Transaction with data.entities as entities
 	accountGroupsById == {"test-account-group-ONE-uid"}
 
 	checkAccountId({"eip155:eoa:0xdDcF208f219a6e6af072f2cfdc615b2c1805F98E"}) with input as requestWithEip1559Transaction with data.entities as entities

apps/policy-engine/src/resource/open-policy-agent/rego/criteria/approval.rego

@@ -1,5 +1,6 @@
 package main
 
+import data.armory.entities.get
 import data.armory.lib.case.equalsIgnoreCase
 import data.armory.lib.case.findCaseInsensitive
 import future.keywords.in
@@ -38,7 +39,7 @@ checkApproval(approval) = result {
 	approval.approvalEntityType == "Narval::UserGroup"
 	possibleApprovers = {user |
 		entity = approval.entityIds[_]
-		users = data.entities.userGroups[lower(entity)].users
+		users = get.userGroups(entity).users
 		user = users[_]
 	} | {principal.id}
 
@@ -50,7 +51,7 @@ checkApproval(approval) = result {
 	approval.approvalEntityType == "Narval::UserGroup"
 	possibleApprovers = {user |
 		entity = approval.entityIds[_]
-		users = data.entities.userGroups[lower(entity)].users
+		users = get.userGroups(entity).users
 		user = users[_]
 		equalsIgnoreCase(user, principal.id) == false
 	}
@@ -63,21 +64,25 @@ checkApproval(approval) = result {
 checkApproval(approval) = result {
 	approval.countPrincipal == true
 	approval.approvalEntityType == "Narval::UserRole"
-	possibleApprovers = {user.id |
-		user = data.entities.users[_]
-		user.role in approval.entityIds
-	} | {principal.id}
+	possibleApprovers := {user |
+		role := approval.entityIds[_]
+		users := get.usersByRole(role)
+		user := users[_]
+	}
 
 	result = getApprovalsCount(possibleApprovers)
 }
 
 checkApproval(approval) = result {
 	approval.countPrincipal == false
 	approval.approvalEntityType == "Narval::UserRole"
-	possibleApprovers = {user.id |
-		user = data.entities.users[_]
-		user.role in approval.entityIds
-		equalsIgnoreCase(user.id, principal.id) == false
+	role := approval.entityIds[_]
+
+	possibleApprovers := {user |
+		role_id := approval.entityIds[_]
+		users := get.usersByRole(role_id)
+		user := users[_]
+		equalsIgnoreCase(user, principal.id) == false
 	}
 
 	result = getApprovalsCount(possibleApprovers)

apps/policy-engine/src/resource/open-policy-agent/rego/criteria/intent/userOperation/entryPoint.rego

@@ -6,6 +6,7 @@ import future.keywords.in
 
 checkEntryPointId(values) {
 	entrypoint = getEntryPoint(input.intent)
+	print("entrypoint.id: ", entrypoint.id)
 	findCaseInsensitive(entrypoint.id, values)
 }
 

apps/policy-engine/src/resource/open-policy-agent/rego/utils/__test__/entityQueries_test.rego

@@ -37,21 +37,44 @@ test_account_from_address {
 }
 
 test_accountGroups {
-	groups := get.accountGroups("eip155:eoa:0xddcf208F219a6e6af072f2cfdc615b2c1805f98e") with data.entities as entities
-	groups == {"test-account-group-ONE-uid"}
+	# Test finding a group by ID
+	group := get.accountGroups("test-account-group-ONE-uid") with data.entities as entities
+	expected_group := {
+		"id": "test-account-group-ONE-uid",
+		"accounts": [
+			"eip155:eoa:0xddcf208f219a6e6af072f2cfdc615b2c1805f98e",
+			"eip155:eoa:0xbbBB208f219a6e6af072f2cfdc615b2c1805f98e",
+		],
+		"name": "dev",
+	}
+	group == expected_group
 
 	# Test case insensitivity
-	groups_upper := get.accountGroups("EIP155:EOA:0xDDCF208F219a6e6af072f2cfdc615b2c1805f98e") with data.entities as entities
-	groups == groups_upper
+	groups_upper := get.accountGroups("test-account-group-one-uid") with data.entities as entities
+	group == groups_upper
+
+	# Test non-existent input
+	non_existent := get.accountGroups("unknown") with data.entities as entities
+	non_existent == null
 }
 
 test_userGroups {
-	groups := get.userGroups("test-bob-uid") with data.entities as entities
-	groups == {"test-USER-group-one-uid", "test-USER-group-two-uid"}
+	# Test finding a group by ID
+	group := get.userGroups("test-USER-group-one-uid") with data.entities as entities
+	expected_group := {
+		"id": "test-USER-group-one-uid",
+		"name": "dev",
+		"users": ["test-Bob-uid", "test-Bar-uid"],
+	}
+	group == expected_group
 
 	# Test case insensitivity
-	groups_upper := get.userGroups("TEST-bob-UID") with data.entities as entities
-	groups == groups_upper
+	groups_upper := get.userGroups("test-user-group-one-UID") with data.entities as entities
+	group == groups_upper
+
+	# Test non-existent input
+	non_existent := get.userGroups("unknown") with data.entities as entities
+	non_existent == null
 }
 
 test_addressBookEntry {
@@ -97,3 +120,16 @@ test_user {
 	user_upper := get.user("test-BOB-uid") with data.entities as entities
 	user == user_upper
 }
+
+test_usersByRole {
+	root := get.usersByRole("root") with data.entities as entities
+
+	root == {"test-BOB-uid"}
+
+	admin := get.usersByRole("admin") with data.entities as entities
+	admin == {
+		"test-Bar-uid",
+		"test-Foo-uid",
+		"0xAAA8ee1cbaa1856f4550c6fc24abb16c5c9b2a43",
+	}
+}

apps/policy-engine/src/resource/open-policy-agent/rego/utils/chainAccount.rego

@@ -143,7 +143,7 @@ intentDestinationChainAccount(intent) = destination {
 intentDestinationChainAccount(intent) = destination {
 	chainAccount = parseChainAccount(intent.to)
 	get.account(chainAccount.address) == null
-	addressBookData = data.entities.addressBook[lower(intent.to)]
+	addressBookData = get.addressBookEntry(intent.to)
 
 	destination := {
 		"id": chainAccount.id,
@@ -162,6 +162,9 @@ intentDestinationChainAccount(intent) = destination {
 	destination := mergeAccountAndAddressBook(chainAccount, accountData, addressBookData)
 }
 
-getEntryPoint(intent) = data.entities.accounts[intent.entrypoint]
-
-getEntryPoint(intent) = data.entities.addressBook[intent.entrypoint]
+getEntryPoint(intent) = entrypoint {
+	entrypoint := get.account(intent.entrypoint)
+	entrypoint != null
+} else = entrypoint {
+	entrypoint := get.addressBookEntry(intent.entrypoint)
+}

apps/policy-engine/src/resource/open-policy-agent/rego/utils/entityInput.rego

@@ -7,4 +7,4 @@ resource := get.account(input.resource.uid)
 
 principal := get.user(input.principal.userId)
 
-principalGroups = get.userGroups(input.principal.userId)
+principalGroups = principal.groups