56 lines
2.2 KiB
Markdown
56 lines
2.2 KiB
Markdown
|
---
|
||
|
|
id: forgejo.application-access
|
||
|
|
name: Forgejo authenticated application access
|
||
|
|
namespace: forgejo:application
|
||
|
|
version: v1
|
||
|
|
status: draft
|
||
|
|
package: flexauth.forgejo.application
|
||
|
|
allow_ttl: 10s
|
||
|
|
actions: [application.access]
|
||
|
|
owner: railiance-apps
|
||
|
|
caring:
|
||
|
|
profile: caring-0.4.0-rc2
|
||
|
|
enforce: false
|
||
|
|
---
|
||
|
|
|
||
|
|
This source policy enforces the original three-group any-of in the sole PDP.
|
||
|
|
The registry identifies the application tenant and admitted issuer. This policy requires aal2 assurance.
|
||
|
|
The PEP independently verifies the ID token and supplies fresh UserInfo groups;
|
||
|
|
the authenticated workload caller may represent only the Forgejo system. A
|
||
|
|
decision authorizes one login callback, never a later HTTP/Git/SSH/API operation.
|
||
|
|
The accompanying registry is synthetic test data, not an estate admission.
|
||
|
|
|
||
|
|
```rego
|
||
|
|
import rego.v1
|
||
|
|
|
||
|
|
default decision := {"effect": "deny", "reason": "application_access_refused"}
|
||
|
|
|
||
|
|
original_groups := {"forge-admins", "forge-coulomb-owners", "forge-coulomb-readers"}
|
||
|
|
|
||
|
|
decision := {"effect": "allow", "reason": "current_authenticated_application_access"} if {
|
||
|
|
input.action == "application.access"
|
||
|
|
object.get(input, "purpose", "") == ""
|
||
|
|
input.resource.id == "application:forgejo"
|
||
|
|
input.resource.type == "application"
|
||
|
|
input.resource.system == "forgejo"
|
||
|
|
input.tenant == input.resource.tenant
|
||
|
|
input.tenant == input.resource.attributes.tenant
|
||
|
|
input.subject.tenant == input.tenant
|
||
|
|
input.context.identity_tenant == input.tenant
|
||
|
|
input.subject.id == input.context.identity_subject
|
||
|
|
input.subject.type == input.context.identity_principal_type
|
||
|
|
input.subject.type == "human"
|
||
|
|
input.subject.attributes.issuer == input.context.identity_issuer
|
||
|
|
input.context.identity_issuer == input.resource.attributes.identity_issuer
|
||
|
|
input.subject.attributes.assurance == input.context.identity_assurance
|
||
|
|
input.context.identity_assurance == "aal2"
|
||
|
|
count(input.context.required_groups_any_of) == 3
|
||
|
|
{g | g := input.context.required_groups_any_of[_]} == original_groups
|
||
|
|
input.subject.attributes.current_userinfo_groups == input.context.current_userinfo_groups
|
||
|
|
some group in input.context.current_userinfo_groups
|
||
|
|
group in original_groups
|
||
|
|
is_string(input.context.decisionpep_request_nonce)
|
||
|
|
count(input.context.decisionpep_request_nonce) == 64
|
||
|
|
}
|
||
|
|
```
|