Authorize scoped public registration applicants

examples/user-engine/policy_fixtures.yaml

@@ -5,4 +5,7 @@
   {"id":"cross-tenant-deny","request":{"id":"c4","tenant":"tenant:friendly:binky","subject":{"id":"admin","type":"human","tenant":"tenant:family:other","attributes":{"roles":["tenant-admin"]}},"action":"membership.write","resource":{"id":"m1","type":"user-engine:membership","system":"user-engine","tenant":"tenant:friendly:binky"},"context":{}},"expect":{"effect":"deny","reason":"cross_tenant"}},
   {"id":"missing-role-deny","request":{"id":"c5","tenant":"tenant:friendly:binky","subject":{"id":"u1","type":"human","tenant":"tenant:friendly:binky","attributes":{"roles":[]}},"action":"membership.write","resource":{"id":"m1","type":"user-engine:membership","system":"user-engine","tenant":"tenant:friendly:binky"},"context":{}},"expect":{"effect":"deny","reason":"no_matching_role_or_context"}},
   {"id":"wrong-system-deny","request":{"id":"c6","tenant":"tenant:friendly:binky","subject":{"id":"operator","type":"human","tenant":"platform:root","attributes":{"roles":["platform-operator"]}},"action":"outbox.replay","resource":{"id":"e1","type":"user-engine:outbox-event","system":"other","tenant":"tenant:friendly:binky"},"context":{}},"expect":{"effect":"deny","reason":"wrong_system"}}
+  ,{"id":"registration-applicant-allow","request":{"id":"c7","tenant":"tenant:coulomb","subject":{"id":"applicant-1","type":"human","tenant":"tenant:coulomb","attributes":{"roles":["registration-applicant"],"issuer":"urn:netkingdom:public-registration"}},"action":"registration.start","resource":{"id":"new","type":"user-engine:registration","system":"user-engine","tenant":"tenant:coulomb"},"context":{}},"expect":{"effect":"allow","reason":"registration_applicant"}}
+  ,{"id":"registration-applicant-membership-deny","request":{"id":"c8","tenant":"tenant:coulomb","subject":{"id":"applicant-1","type":"human","tenant":"tenant:coulomb","attributes":{"roles":["registration-applicant"]}},"action":"membership.write","resource":{"id":"m1","type":"user-engine:membership","system":"user-engine","tenant":"tenant:coulomb"},"context":{}},"expect":{"effect":"deny","reason":"no_matching_role_or_context"}}
+  ,{"id":"registration-applicant-wrong-issuer-deny","request":{"id":"c9","tenant":"tenant:coulomb","subject":{"id":"applicant-1","type":"human","tenant":"tenant:coulomb","attributes":{"roles":["registration-applicant"],"issuer":"untrusted"}},"action":"registration.start","resource":{"id":"new","type":"user-engine:registration","system":"user-engine","tenant":"tenant:coulomb"},"context":{}},"expect":{"effect":"deny","reason":"no_matching_role_or_context"}}
 ]

examples/user-engine/policy_package.md

@@ -43,6 +43,16 @@ roles := object.get(object.get(input.subject, "attributes", {}), "roles", [])
 subject_tenant := object.get(input.subject, "tenant", "")
 resource_tenant := object.get(input.resource, "tenant", input.tenant)
 self_request := object.get(input.context, "self", false)
+resource_type := object.get(input.resource, "type", "")
+subject_issuer := object.get(object.get(input.subject, "attributes", {}), "issuer", "")
+
+registration_applicant if {
+  "registration-applicant" in roles
+  subject_issuer == "urn:netkingdom:public-registration"
+  same_tenant
+  startswith(input.action, "registration.")
+  resource_type in {"user-engine:registration", "user-engine:registration-factor"}
+}
 
 decision := {"effect": "allow", "reason": "platform_operator"} if {
   valid_system
@@ -55,6 +65,9 @@ decision := {"effect": "allow", "reason": "platform_operator"} if {
   valid_system
   same_tenant
   self_request == true
+} else := {"effect": "allow", "reason": "registration_applicant"} if {
+  valid_system
+  registration_applicant
 } else := {"effect": "deny", "reason": first_denial} if { true }
 
 valid_system if { input.resource.system == "user-engine" }
@@ -80,4 +93,7 @@ test_platform_operator_cross_tenant_allowed if { portal.decision.effect == "allo
 test_cross_tenant_denied if { portal.decision.reason == "cross_tenant" with input as object.union(base, {"subject": object.union(base.subject, {"tenant": "tenant:family:other"})}) }
 test_missing_role_denied if { portal.decision.effect == "deny" with input as {"tenant": "tenant:friendly:binky", "subject": {"id": "u1", "type": "human", "tenant": "tenant:friendly:binky", "attributes": {"roles": []}}, "action": "membership.write", "resource": {"id": "m1", "type": "user-engine:membership", "system": "user-engine", "tenant": "tenant:friendly:binky"}, "context": {}} }
 test_wrong_system_denied if { portal.decision.reason == "wrong_system" with input as object.union(base, {"resource": object.union(base.resource, {"system": "other"})}) }
+test_registration_applicant_allowed if { portal.decision.reason == "registration_applicant" with input as {"tenant": "tenant:friendly:binky", "subject": {"id": "applicant", "type": "human", "tenant": "tenant:friendly:binky", "attributes": {"roles": ["registration-applicant"], "issuer": "urn:netkingdom:public-registration"}}, "action": "registration.start", "resource": {"id": "new", "type": "user-engine:registration", "system": "user-engine", "tenant": "tenant:friendly:binky"}, "context": {}} }
+test_registration_applicant_other_action_denied if { portal.decision.effect == "deny" with input as {"tenant": "tenant:friendly:binky", "subject": {"id": "applicant", "type": "human", "tenant": "tenant:friendly:binky", "attributes": {"roles": ["registration-applicant"], "issuer": "urn:netkingdom:public-registration"}}, "action": "membership.write", "resource": {"id": "m1", "type": "user-engine:membership", "system": "user-engine", "tenant": "tenant:friendly:binky"}, "context": {}} }
+test_registration_applicant_wrong_issuer_denied if { portal.decision.effect == "deny" with input as {"tenant": "tenant:friendly:binky", "subject": {"id": "applicant", "type": "human", "tenant": "tenant:friendly:binky", "attributes": {"roles": ["registration-applicant"], "issuer": "untrusted"}}, "action": "registration.start", "resource": {"id": "new", "type": "user-engine:registration", "system": "user-engine", "tenant": "tenant:friendly:binky"}, "context": {}} }
 ```

examples/user-engine/registry_snapshot.json

@@ -8,6 +8,8 @@
       {"name":"user-engine:family-invitation","scope_level":"Resource","planes":["Identity","Audit"]},
       {"name":"user-engine:tenant","scope_level":"Tenant","planes":["Identity","Audit"]},
       {"name":"user-engine:outbox","scope_level":"Platform","planes":["Audit"]}
+      ,{"name":"user-engine:registration","scope_level":"Resource","planes":["Identity","Audit"]}
+      ,{"name":"user-engine:registration-factor","scope_level":"Resource","planes":["Identity","Audit"]}
     ],
     "actions": [],
     "metadata": {"flex_auth_contract":"protected-system-v0","dynamic_actions":true}