---
id: forgejo.application-access
name: Forgejo authenticated application access
namespace: forgejo:application
version: v1
status: draft
package: flexauth.forgejo.application
allow_ttl: 10s
actions: [application.access]
owner: railiance-apps
caring:
  profile: caring-0.4.0-rc2
  enforce: false
---

This source policy enforces the original three-group any-of in the sole PDP.
The registry identifies the application tenant and admitted issuer. This policy requires aal2 assurance.
The PEP independently verifies the ID token and supplies fresh UserInfo groups;
the authenticated workload caller may represent only the Forgejo system. A
decision authorizes one login callback, never a later HTTP/Git/SSH/API operation.
The accompanying registry is synthetic test data, not an estate admission.

```rego
import rego.v1

default decision := {"effect": "deny", "reason": "application_access_refused"}

original_groups := {"forge-admins", "forge-coulomb-owners", "forge-coulomb-readers"}

decision := {"effect": "allow", "reason": "current_authenticated_application_access"} if {
  input.action == "application.access"
  object.get(input, "purpose", "") == ""
  input.resource.id == "application:forgejo"
  input.resource.type == "application"
  input.resource.system == "forgejo"
  input.tenant == input.resource.tenant
  input.tenant == input.resource.attributes.tenant
  input.subject.tenant == input.tenant
  input.context.identity_tenant == input.tenant
  input.subject.id == input.context.identity_subject
  input.subject.type == input.context.identity_principal_type
  input.subject.type == "human"
  input.subject.attributes.issuer == input.context.identity_issuer
  input.context.identity_issuer == input.resource.attributes.identity_issuer
  input.subject.attributes.assurance == input.context.identity_assurance
  input.context.identity_assurance == "aal2"
  count(input.context.required_groups_any_of) == 3
  {g | g := input.context.required_groups_any_of[_]} == original_groups
  input.subject.attributes.current_userinfo_groups == input.context.current_userinfo_groups
  some group in input.context.current_userinfo_groups
  group in original_groups
  is_string(input.context.decisionpep_request_nonce)
  count(input.context.decisionpep_request_nonce) == 64
}
```