Skip to content

Commit

Permalink
rego fixes
Browse files Browse the repository at this point in the history
  • Loading branch information
samteb committed Jan 18, 2024
1 parent 549b521 commit de7bb8a
Show file tree
Hide file tree
Showing 5 changed files with 32 additions and 11 deletions.
1 change: 1 addition & 0 deletions apps/authz/Makefile
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,7 @@ authz/rego/bundle:

opa build \
--bundle ${AUTHZ_PROJECT_DIR}/src/app/opa/rego \
--ignore "__test__" \
--output ${AUTHZ_PROJECT_DIR}/src/app/opa/rego/build/policies.tar.gz

authz/rego/eval:
Expand Down
22 changes: 18 additions & 4 deletions apps/authz/src/app/opa/rego/lib/main.rego
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ package main

import future.keywords.in

evaluate := {
default evaluate := {
"permit": false,
"reasons": set(),
# The default flag indicates whether the rule was evaluated as expected or if
Expand All @@ -11,9 +11,23 @@ evaluate := {
"default": true,
}

permit[{}] := {}
permit[{"policyId": "permit-default-policy"}] := reason {
false

forbid[{}] := {}
reason := {
"policyId": "permit-default-policy",
"reason": "This is the default policy, it always returns false.",
}
}

forbid[{"policyId": "frobid-default-policy"}] := reason {
false

reason := {
"policyId": "forbid-default-policy",
"reason": "This is the default policy, it always returns false.",
}
}

evaluate := decision {
permit_set := {p | p = permit[_]}
Expand Down Expand Up @@ -45,6 +59,6 @@ evaluate := decision {
# TODO: forbid rules need the same response structure as permit so we can have the policyId
decision := {
"permit": false,
"reasons": set(),
"reasons": forbid_set,
}
}
6 changes: 4 additions & 2 deletions apps/authz/src/app/opa/rego/policies/policy1.rego
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,10 @@ import future.keywords.in
permit[{"policyId": "test-policy-1"}] := reason {
check_principal

check_transfer_token_type({"transferToken"})
check_transfer_token_address({"0x2791bca1f2de4661ed88a30c99a7a9449aa84174"})
input.action == "signTransaction"

check_transfer_token_type({"transferERC20"})
check_transfer_token_address({"eip155:137/erc20:0x2791bca1f2de4661ed88a30c99a7a9449aa84174"})
check_transfer_token_operation({"operator": "lte", "value": "1000000000000000000"})

approvalsRequired = [{
Expand Down
6 changes: 4 additions & 2 deletions apps/authz/src/app/opa/rego/policies/policy2.rego
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,10 @@ import future.keywords.in
permit[{"policyId": "test-policy-2"}] := reason {
check_principal

check_transfer_token_type({"transferToken"})
check_transfer_token_address({"0x2791bca1f2de4661ed88a30c99a7a9449aa84174"})
input.action == "signTransaction"

check_transfer_token_type({"transferERC20"})
check_transfer_token_address({"eip155:137/erc20:0x2791bca1f2de4661ed88a30c99a7a9449aa84174"})
check_transfer_token_operation({"operator": "lte", "value": "1000000000000000000"})

approvalsRequired = [{
Expand Down
8 changes: 5 additions & 3 deletions apps/authz/src/app/opa/rego/policies/policy3.rego
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,11 @@ import future.keywords.in
permit[{"policyId": "test-policy-3"}] := reason {
check_principal

check_transfer_token_type({"transferToken"})
check_transfer_token_address({"0x2791bca1f2de4661ed88a30c99a7a9449aa84174"})
check_transfer_token_operation({"operator": "eq", "value": "1000000000000000000"})
input.action == "signTransaction"

check_transfer_token_type({"transferERC20"})
check_transfer_token_address({"eip155:137/erc20:0x2791bca1f2de4661ed88a30c99a7a9449aa84174"})
check_transfer_token_operation({"operator": "lte", "value": "1000000000000000000"})

approvalsRequired = [{
"threshold": 2,
Expand Down

0 comments on commit de7bb8a

Please sign in to comment.