61 lines
1.8 KiB
Rego
61 lines
1.8 KiB
Rego
# METADATA
|
|
# title: Data source policy for ds:per-diem-rates
|
|
# description: |
|
|
# Only agent-per-diem-calculator may read per-diem rates, and only within
|
|
# an active user session. Filters country+valid_on are required; city is
|
|
# optional. No write operations through this policy; rate maintenance is a
|
|
# separate admin flow.
|
|
# authors:
|
|
# - CTO Agent <cto@basicstack.de>
|
|
# related_resources:
|
|
# - ref: docs/architecture/v1.1.md#user-content-62-deterministische-regelwerke-am-beispiel-spesensätze-verpflegungsmehraufwand
|
|
# - ref: schemas/ds/per_diem/v1.0.0.json
|
|
package proofedmesh.data_sources.per_diem_rates
|
|
|
|
import rego.v1
|
|
|
|
default allow := false
|
|
|
|
allow if {
|
|
input.data_source == "ds:per-diem-rates"
|
|
input.operation == "read"
|
|
input.user_sub != ""
|
|
input.session_id != ""
|
|
input.agent_id == "agent-per-diem-calculator"
|
|
input.resource == "rates"
|
|
filters_ok
|
|
}
|
|
|
|
allowed_filters := {"country", "city", "valid_on"}
|
|
required_filters := {"country", "valid_on"}
|
|
|
|
filters_ok if {
|
|
provided := {k | some k; _ := input.filters[k]}
|
|
count(provided - allowed_filters) == 0
|
|
count(required_filters - provided) == 0
|
|
}
|
|
|
|
deny_reason contains msg if {
|
|
input.data_source != "ds:per-diem-rates"
|
|
msg := sprintf("wrong data_source: %s", [input.data_source])
|
|
}
|
|
|
|
deny_reason contains msg if {
|
|
input.operation != "read"
|
|
msg := sprintf("operation %s not allowed on ds:per-diem-rates (reads only)", [input.operation])
|
|
}
|
|
|
|
deny_reason contains msg if {
|
|
input.user_sub == ""
|
|
msg := "missing user_sub (per-diem reads require active user session)"
|
|
}
|
|
|
|
deny_reason contains msg if {
|
|
input.agent_id != "agent-per-diem-calculator"
|
|
msg := sprintf("agent %s not allowed to read per-diem rates (only agent-per-diem-calculator)", [input.agent_id])
|
|
}
|
|
|
|
deny_reason contains msg if {
|
|
not filters_ok
|
|
msg := "filters must include country and valid_on; only country, city, valid_on allowed"
|
|
}
|