apiVersion: v1
data:
  policy-write.rego: |+
    package dataapi.authz

    rule[{}] {
        description := "allow read datasets"
        input.action.actionType == "read"
      }

    rule[{"action": {"name":"RedactAction","columns": column_names}, "policy": description}] {
        description := "Redact written columns tagged as sensitive in datasets tagged with finance = true. The data should not be stored in `neverland` storage account"
        input.action.actionType == "write"
        input.resource.metadata.tags.finance
        input.action.destination != "neverland"
        column_names := [input.resource.metadata.columns[i].name | input.resource.metadata.columns[i].tags.sensitive]
    }

kind: ConfigMap
metadata:
  labels:
    openpolicyagent.org/policy: rego
  name: policy-write
  namespace: fybrik-system

