64 lines
1.6 KiB
Rego
64 lines
1.6 KiB
Rego
|
# METADATA
|
||
|
|
# title: Sink policy for sink:expense-db-app
|
||
|
|
# description: |
|
||
|
|
# Only the posting agent may call the own DB-app sink, only with the
|
||
|
|
# expense.post action, and only with the sink.db.expense payload schema
|
||
|
|
# that was explicitly listed in the approval's allowed_sinks.
|
||
|
|
# authors:
|
||
|
|
# - CTO Agent <cto@basicstack.de>
|
||
|
|
# related_resources:
|
||
|
|
# - ref: docs/architecture/v1.1.md#user-content-70-vertrag-jedes-senken-adapters
|
||
|
|
# - ref: schemas/sink/db/expense/v1.0.0.json
|
||
|
|
package proofedmesh.sinks.expense_db_app
|
||
|
|
|
||
|
|
import rego.v1
|
||
|
|
|
||
|
|
default allow := false
|
||
|
|
|
||
|
|
allowed_agent := "agent-sink-posting"
|
||
|
|
|
||
|
|
allowed_actions := {"expense.post"}
|
||
|
|
|
||
|
|
allow if {
|
||
|
|
input.sink_id == "sink:expense-db-app"
|
||
|
|
input.agent_id == allowed_agent
|
||
|
|
input.action in allowed_actions
|
||
|
|
payload_schema_ok
|
||
|
|
approval_lists_sink
|
||
|
|
}
|
||
|
|
|
||
|
|
payload_schema_ok if {
|
||
|
|
input.payload.schema.name == "sink.db.expense"
|
||
|
|
startswith(input.payload.schema.version, "1.")
|
||
|
|
}
|
||
|
|
|
||
|
|
approval_lists_sink if {
|
||
|
|
some s in input.approval.allowed_sinks
|
||
|
|
s == "sink:expense-db-app"
|
||
|
|
}
|
||
|
|
|
||
|
|
deny_reason contains msg if {
|
||
|
|
input.sink_id != "sink:expense-db-app"
|
||
|
|
msg := sprintf("wrong sink_id: %s", [input.sink_id])
|
||
|
|
}
|
||
|
|
|
||
|
|
deny_reason contains msg if {
|
||
|
|
input.agent_id != allowed_agent
|
||
|
|
msg := sprintf("agent %s not allowed to post to sink:expense-db-app", [input.agent_id])
|
||
|
|
}
|
||
|
|
|
||
|
|
deny_reason contains msg if {
|
||
|
|
not input.action in allowed_actions
|
||
|
|
msg := sprintf("action %s not allowed on sink:expense-db-app", [input.action])
|
||
|
|
}
|
||
|
|
|
||
|
|
deny_reason contains msg if {
|
||
|
|
not payload_schema_ok
|
||
|
|
msg := "payload schema mismatch (expected sink.db.expense v1.x)"
|
||
|
|
}
|
||
|
|
|
||
|
|
deny_reason contains msg if {
|
||
|
|
not approval_lists_sink
|
||
|
|
msg := "sink:expense-db-app not in approval.allowed_sinks"
|
||
|
|
}
|