From b74756791ac9b0a0d00eaa12cb15da25bd809f86 Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 14 Aug 2026 09:26:12 +0200 Subject: [PATCH] Authorize scoped public registration applicants --- examples/user-engine/policy_fixtures.yaml | 3 +++ examples/user-engine/policy_package.md | 16 ++++++++++++++++ examples/user-engine/registry_snapshot.json | 2 ++ 3 files changed, 21 insertions(+) diff --git a/examples/user-engine/policy_fixtures.yaml b/examples/user-engine/policy_fixtures.yaml index fbd119e..244f0d5 100644 --- a/examples/user-engine/policy_fixtures.yaml +++ b/examples/user-engine/policy_fixtures.yaml @@ -5,4 +5,7 @@ {"id":"cross-tenant-deny","request":{"id":"c4","tenant":"tenant:friendly:binky","subject":{"id":"admin","type":"human","tenant":"tenant:family:other","attributes":{"roles":["tenant-admin"]}},"action":"membership.write","resource":{"id":"m1","type":"user-engine:membership","system":"user-engine","tenant":"tenant:friendly:binky"},"context":{}},"expect":{"effect":"deny","reason":"cross_tenant"}}, {"id":"missing-role-deny","request":{"id":"c5","tenant":"tenant:friendly:binky","subject":{"id":"u1","type":"human","tenant":"tenant:friendly:binky","attributes":{"roles":[]}},"action":"membership.write","resource":{"id":"m1","type":"user-engine:membership","system":"user-engine","tenant":"tenant:friendly:binky"},"context":{}},"expect":{"effect":"deny","reason":"no_matching_role_or_context"}}, {"id":"wrong-system-deny","request":{"id":"c6","tenant":"tenant:friendly:binky","subject":{"id":"operator","type":"human","tenant":"platform:root","attributes":{"roles":["platform-operator"]}},"action":"outbox.replay","resource":{"id":"e1","type":"user-engine:outbox-event","system":"other","tenant":"tenant:friendly:binky"},"context":{}},"expect":{"effect":"deny","reason":"wrong_system"}} + ,{"id":"registration-applicant-allow","request":{"id":"c7","tenant":"tenant:coulomb","subject":{"id":"applicant-1","type":"human","tenant":"tenant:coulomb","attributes":{"roles":["registration-applicant"],"issuer":"urn:netkingdom:public-registration"}},"action":"registration.start","resource":{"id":"new","type":"user-engine:registration","system":"user-engine","tenant":"tenant:coulomb"},"context":{}},"expect":{"effect":"allow","reason":"registration_applicant"}} + ,{"id":"registration-applicant-membership-deny","request":{"id":"c8","tenant":"tenant:coulomb","subject":{"id":"applicant-1","type":"human","tenant":"tenant:coulomb","attributes":{"roles":["registration-applicant"]}},"action":"membership.write","resource":{"id":"m1","type":"user-engine:membership","system":"user-engine","tenant":"tenant:coulomb"},"context":{}},"expect":{"effect":"deny","reason":"no_matching_role_or_context"}} + ,{"id":"registration-applicant-wrong-issuer-deny","request":{"id":"c9","tenant":"tenant:coulomb","subject":{"id":"applicant-1","type":"human","tenant":"tenant:coulomb","attributes":{"roles":["registration-applicant"],"issuer":"untrusted"}},"action":"registration.start","resource":{"id":"new","type":"user-engine:registration","system":"user-engine","tenant":"tenant:coulomb"},"context":{}},"expect":{"effect":"deny","reason":"no_matching_role_or_context"}} ] diff --git a/examples/user-engine/policy_package.md b/examples/user-engine/policy_package.md index 3b800c9..1b7546f 100644 --- a/examples/user-engine/policy_package.md +++ b/examples/user-engine/policy_package.md @@ -43,6 +43,16 @@ roles := object.get(object.get(input.subject, "attributes", {}), "roles", []) subject_tenant := object.get(input.subject, "tenant", "") resource_tenant := object.get(input.resource, "tenant", input.tenant) self_request := object.get(input.context, "self", false) +resource_type := object.get(input.resource, "type", "") +subject_issuer := object.get(object.get(input.subject, "attributes", {}), "issuer", "") + +registration_applicant if { + "registration-applicant" in roles + subject_issuer == "urn:netkingdom:public-registration" + same_tenant + startswith(input.action, "registration.") + resource_type in {"user-engine:registration", "user-engine:registration-factor"} +} decision := {"effect": "allow", "reason": "platform_operator"} if { valid_system @@ -55,6 +65,9 @@ decision := {"effect": "allow", "reason": "platform_operator"} if { valid_system same_tenant self_request == true +} else := {"effect": "allow", "reason": "registration_applicant"} if { + valid_system + registration_applicant } else := {"effect": "deny", "reason": first_denial} if { true } valid_system if { input.resource.system == "user-engine" } @@ -80,4 +93,7 @@ test_platform_operator_cross_tenant_allowed if { portal.decision.effect == "allo test_cross_tenant_denied if { portal.decision.reason == "cross_tenant" with input as object.union(base, {"subject": object.union(base.subject, {"tenant": "tenant:family:other"})}) } test_missing_role_denied if { portal.decision.effect == "deny" with input as {"tenant": "tenant:friendly:binky", "subject": {"id": "u1", "type": "human", "tenant": "tenant:friendly:binky", "attributes": {"roles": []}}, "action": "membership.write", "resource": {"id": "m1", "type": "user-engine:membership", "system": "user-engine", "tenant": "tenant:friendly:binky"}, "context": {}} } test_wrong_system_denied if { portal.decision.reason == "wrong_system" with input as object.union(base, {"resource": object.union(base.resource, {"system": "other"})}) } +test_registration_applicant_allowed if { portal.decision.reason == "registration_applicant" with input as {"tenant": "tenant:friendly:binky", "subject": {"id": "applicant", "type": "human", "tenant": "tenant:friendly:binky", "attributes": {"roles": ["registration-applicant"], "issuer": "urn:netkingdom:public-registration"}}, "action": "registration.start", "resource": {"id": "new", "type": "user-engine:registration", "system": "user-engine", "tenant": "tenant:friendly:binky"}, "context": {}} } +test_registration_applicant_other_action_denied if { portal.decision.effect == "deny" with input as {"tenant": "tenant:friendly:binky", "subject": {"id": "applicant", "type": "human", "tenant": "tenant:friendly:binky", "attributes": {"roles": ["registration-applicant"], "issuer": "urn:netkingdom:public-registration"}}, "action": "membership.write", "resource": {"id": "m1", "type": "user-engine:membership", "system": "user-engine", "tenant": "tenant:friendly:binky"}, "context": {}} } +test_registration_applicant_wrong_issuer_denied if { portal.decision.effect == "deny" with input as {"tenant": "tenant:friendly:binky", "subject": {"id": "applicant", "type": "human", "tenant": "tenant:friendly:binky", "attributes": {"roles": ["registration-applicant"], "issuer": "untrusted"}}, "action": "registration.start", "resource": {"id": "new", "type": "user-engine:registration", "system": "user-engine", "tenant": "tenant:friendly:binky"}, "context": {}} } ``` diff --git a/examples/user-engine/registry_snapshot.json b/examples/user-engine/registry_snapshot.json index 93250fe..35cdcc4 100644 --- a/examples/user-engine/registry_snapshot.json +++ b/examples/user-engine/registry_snapshot.json @@ -8,6 +8,8 @@ {"name":"user-engine:family-invitation","scope_level":"Resource","planes":["Identity","Audit"]}, {"name":"user-engine:tenant","scope_level":"Tenant","planes":["Identity","Audit"]}, {"name":"user-engine:outbox","scope_level":"Platform","planes":["Audit"]} + ,{"name":"user-engine:registration","scope_level":"Resource","planes":["Identity","Audit"]} + ,{"name":"user-engine:registration-factor","scope_level":"Resource","planes":["Identity","Audit"]} ], "actions": [], "metadata": {"flex_auth_contract":"protected-system-v0","dynamic_actions":true}