package rbac.authz

# user-role assignments
user_roles := {
    "alice": ["engineering", "webdev"],
    "bob": ["hr"]
}

# role-permissions assignments
role_permissions := {
    "engineering": [{"action": "read",  "object": "server123"}],
    "webdev":      [{"action": "read",  "object": "server123"},
                    {"action": "write", "object": "server123"}],
    "hr":          [{"action": "read",  "object": "database456"}]
}

# logic that implements RBAC.
default allow = false
allow {
    # lookup the list of roles for the user
    roles := user_roles[input.user]
    # for each role in that list
    r := roles[_]
    # lookup the permissions list for role r
    permissions := role_permissions[r]
    # for each permission
    p := permissions[_]
    # check if the permission granted to r matches the user's request
    p == {"action": input.action, "object": input.object}
}

allow

{
  "user": "bob",
  "action": "read",
  "object": "server123"
}

false

# Pairs of roles that no user can be assigned to simultaneously
sod_roles = [
	["create-payment", "approve-payment"],
  ["create-vendor", "pay-vendor"],
]

# Find all users violating SOD
sod_violation[user] {
  some user
  # grab one role for a user
  role1 := user_roles[user][_]
  # grab another role for that same user
  role2 := user_roles[user][_]
  # check if those roles are forbidden by SOD
  sod_roles[_] == [role1, role2]
}

package abac

# User attributes
user_attributes = {
    "alice": {"tenure": 15, "title": "trader"},
    "bob": {"tenure": 5, "title": "analyst"}
}

# Stock attributes
ticker_attributes = {
    "MSFT": {"exchange": "NASDAQ", "price": 59.20},
    "AMZN": {"exchange": "NASDAQ", "price": 813.64}
}

default allow = false

# all traders may buy NASDAQ under $2M
allow {
    # lookup the user's attributes
    user := user_attributes[input.user]
    # check that the user is a trader
    user.title == "trader"
    # check that the stock being purchased is sold on the NASDAQ
    ticker_attributes[input.ticker].exchange == "NASDAQ"
    # check that the purchase amount is under $2M
    input.amount <= 2000000
}

# traders with 10+ years experience may buy NASDAQ under $5M
allow {
    # lookup the user's attributes
    user := user_attributes[input.user]
    # check that the user is a trader
    user.title == "trader"
    # check that the stock being purchased is sold on the NASDAQ
    ticker_attributes[input.ticker].exchange == "NASDAQ"
    # check that the user has at least 10 years of experience
    user.tenure > 10
    # check that the purchase amount is under $5M
    input.amount <= 5000000
}

allow

{
  "user": "alice",
  "ticker": "MSFT",
  "action": "buy",
  "amount": 1000000
}

true

package aws

default allow = false

# FirstStatement
allow {
    principals_match
    input.action == "iam:ChangePassword"
}

# SecondStatement
allow {
    principals_match
    input.action == "s3:ListAllMyBuckets"
}

# ThirdStatement
#  Use helpers to handle implicit OR in the AWS policy.
#  Below all of the 'principals_match', 'actions_match' and 'resources_match' must be true.
allow {
    principals_match
    actions_match
    resources_match
}

# principals_match is true if input.principal matches
principals_match {
    input.principal == "alice"
}

# actions_match is true if input.action matches one in the list
actions_match {
    # iterate over the actions in the list
    actions := ["s3:List.*","s3:Get.*"]
    action := actions[_]
    # check if input.action matches an action
    regex.globs_match(input.action, action)
}

# resources_match is true if input.resource matches one in the list
resources_match {
    # iterate over the resources in the list
    resources := ["arn:aws:s3:::confidential-data","arn:aws:s3:::confidential-data/.*"]
    resource := resources[_]
    # check if input.resource matches a resource
    regex.globs_match(input.resource, resource)
}

{
  "principal": "alice",
  "action": "ec2:StartInstance",
  "resource": "arn:aws:ec2:::instance/i78999879"
}

allow

false

package xacml

permit {
    # Check that resource has a "NavigationSystem" entry
    input.resource["NavigationSystem"]

    # Check that organization is one of the options (underscore implements "any")
    org_options := ["Packard", "Curtiss"]
    input.user.organization == org_options[_]

    # Check that nationality is one of the options (underscore implements "any")
    nationality_options := ["GB", "US"]
    input.user.nationality == nationality_options[_]

    # Check that work_effort is one of the options (underscore implements "any")
    work_options := ["DetailedDesign", "Simulation"]
    input.user.work_effort == work_options[_]
}

{
  "user": {
    "name": "alice",
    "organization": "Packard",
    "nationality": "GB",
    "work_effort": "DetailedDesign"
  },
  "resource": {
    "NavigationSystem": true
  },
  "action": {
    "name": "read"
  }
}

permit

true