---
kind: ConfigMap
apiVersion: v1
metadata:
  name: policy
data:
  policy.rego: |
      package rules

      default main = {"allowed": false}

      main = {"allowed": allow, "headers": headers}

      default allow = false

      headers["x-allowed-subjects"] = res {
        has_role("filtered")
        to_number(token_payload.sub) % 2 != 0
        res := concat("|", data.filter.odd)
      }

      headers["x-allowed-subjects"] = res {
        has_role("filtered")
        to_number(token_payload.sub) % 2 == 0
        res = concat("|", data.filter.even)
      }

      headers["t-links"] = concat( "|", link)

      link["odd"] {
          to_number(token_payload.sub) % 2 != 0
      }

      link["even"] {
          to_number(token_payload.sub) % 2 == 0
      }
      
      allow {
        token_payload.roles[_] = "admin"
      }

      allow {
        #allow viewing of users for all viewers
        has_role("viewer")
        input.attributes.request.http.method = "GET"
        input.parsed_path = ["users"]
      }

      allow {
        #allow viewing of messages for all viewers
        has_role("viewer")
        input.attributes.request.http.method = "GET"
        input.parsed_path = ["messages"]
        input.parsed_query.sub == [token_payload.sub]
      }

      allow {
        input.attributes.request.http.method = "PUT"
        input.parsed_path = ["users", token_payload.sub]
      }

      allow {
        input.parsed_path = ["messages"]
        input.attributes.request.http.method = "POST"
        has_role("chatter")
      }

      allow {
        input.parsed_path = ["users", "register"]
        input.attributes.request.http.method = "POST"
      }

      # helper function
      has_role(role) {
        token_payload.roles[_] = role
      }
      
      allow {
        input.attributes.request.http.headers["user-agent"] = "GoogleHC/1.0"
      }

      token = t {
        full := input.attributes.request.http.headers.authorization
        t := replace(full, "Bearer ", "")
      }

      token_payload = p {
        some secret
          secret = data.secrets[_]
          io.jwt.verify_hs256(token, secret)
          p = io.jwt.decode(token)[1]
      }
      headers["msg"] = "No Access Friend" {not allow}
  data.json: |
      {
          "secrets": [
            "password",
            "oldpassword"
          ],
          "filter": 
              {
                "even": [
                  "1000",
                  "1002",
                  "1004",
                  "1006",
                  "1008",
                  "1010",
                  "1012",
                  "1014",
                  "1016",
                  "1018",
                  "1020",
                  "1022",
                  "1024",
                  "1026",
                  "1028",
                  "1030",
                  "1032",
                  "1034",
                  "1036",
                  "1038",
                  "1040",
                  "1042",
                  "1044",
                  "1046",
                  "1048"
                ],
                "odd": [
                  "1001",
                  "1003",
                  "1005",
                  "1007",
                  "1009",
                  "1011",
                  "1013",
                  "1015",
                  "1017",
                  "1019",
                  "1021",
                  "1023",
                  "1025",
                  "1027",
                  "1029",
                  "1031",
                  "1033",
                  "1035",
                  "1037",
                  "1039",
                  "1041",
                  "1043",
                  "1045",
                  "1047",
                  "1049"
                ]
          }
      }
