---
kind: ConfigMap
apiVersion: v1
metadata:
  name: policy
data:
  policy.rego: |
      package rules

      default main = {"allowed": false}

      main = {"allowed": allow, "headers": headers}

      default allow = false

      allow {
        token_payload.roles[_] = "admin"
      }

      allow {
        #allow viewing of users for all viewers
        has_role("viewer")
        input.attributes.request.http.method = "GET"
        input.parsed_path = ["users"]
      }

      allow {
        #allow viewing of messages for all viewers
        has_role("viewer")
        input.attributes.request.http.method = "GET"
        input.parsed_path = ["messages"]
        input.parsed_query.sub == [token_payload.sub]
      }

      allow {
        input.attributes.request.http.method = "PUT"
        input.parsed_path = ["users", token_payload.sub]
      }

      allow {
        input.parsed_path = ["messages"]
        input.attributes.request.http.method = "POST"
        has_role("chatter")
      }

      allow {
        input.parsed_path = ["users", "register"]
        input.attributes.request.http.method = "POST"
      }

      # helper function
      has_role(role) {
        token_payload.roles[_] = role
      }
      
      allow {
        input.attributes.request.http.headers["user-agent"] = "GoogleHC/1.0"
      }

      token = t {
        full := input.attributes.request.http.headers.authorization
        t := replace(full, "Bearer ", "")
      }

      token_payload = p {
        some secret
          secret = data.secrets[_]
          io.jwt.verify_hs256(token, secret)
          p = io.jwt.decode(token)[1]
      }
      headers["msg"] = "No Access Friend" {not allow}
  data.json: |
      {
          "secrets": [
            "password",
            "oldpassword"
          ],
          "filter": [
              {
                "even": [
                  "1000",
                  "1002",
                  "1004",
                  "1006",
                  "1008",
                  "1010",
                  "1012",
                  "1014",
                  "1016",
                  "1018",
                  "1020",
                  "1022",
                  "1024",
                  "1026",
                  "1028",
                  "1030",
                  "1032",
                  "1034",
                  "1036",
                  "1038",
                  "1040",
                  "1042",
                  "1044",
                  "1046",
                  "1048",
                  "1050",
                  "1052",
                  "1054",
                  "1056",
                  "1058",
                  "1060",
                  "1062",
                  "1064",
                  "1066",
                  "1068",
                  "1070",
                  "1072",
                  "1074",
                  "1076",
                  "1078",
                  "1080",
                  "1082",
                  "1084",
                  "1086",
                  "1088",
                  "1090",
                  "1092",
                  "1094",
                  "1096",
                  "1098"
                ],
                "odd": [
                  "1001",
                  "1003",
                  "1005",
                  "1007",
                  "1009",
                  "1011",
                  "1013",
                  "1015",
                  "1017",
                  "1019",
                  "1021",
                  "1023",
                  "1025",
                  "1027",
                  "1029",
                  "1031",
                  "1033",
                  "1035",
                  "1037",
                  "1039",
                  "1041",
                  "1043",
                  "1045",
                  "1047",
                  "1049",
                  "1051",
                  "1053",
                  "1055",
                  "1057",
                  "1059",
                  "1061",
                  "1063",
                  "1065",
                  "1067",
                  "1069",
                  "1071",
                  "1073",
                  "1075",
                  "1077",
                  "1079",
                  "1081",
                  "1083",
                  "1085",
                  "1087",
                  "1089",
                  "1091",
                  "1093",
                  "1095",
                  "1097",
                  "1099"
                ]
          }
          ]
      }
