Merge pull request #2 from abbeylabs/rbac-abac-policies

Add in_group and has_attribute policy functions

src/abbey/functions/has_attribute.rego

@@ -0,0 +1,10 @@
+package abbey.functions
+
+import future.keywords.if
+
+# Function which checks whether a user has a given attribute.
+# Attributes are found under a custom_attributes object under the
+# abbey.identities object.
+has_attribute(name, value) := true if {
+	data.system.abbey.identities.directory_sync_users.custom_attributes[name] == value
+}

src/abbey/functions/has_attribute_test.rego

@@ -0,0 +1,19 @@
+package abbey.functions
+
+import future.keywords.if
+
+test_has_cost_center_engineering if {
+    has_attribute("cost_center_name", "Engineering") with data.system.abbey.identities.directory_sync_users.custom_attributes as {"department_name": "Engineering", "cost_center_name": "Engineering", "employee_type": "Manager"}
+}
+
+test_has_department_engineering if {
+    has_attribute("department_name", "Engineering") with data.system.abbey.identities.directory_sync_users.custom_attributes as {"department_name": "Engineering", "cost_center_name": "Engineering", "employee_type": "Manager"}
+}
+
+test_does_not_have_department_marketing if {
+    not has_attribute("department_name", "Marketing") with data.system.abbey.identities.directory_sync_users.custom_attributes as {"department_name": "Engineering", "cost_center_name": "Engineering", "employee_type": "Manager"}
+}
+
+test_does_not_have_employee_type_ic if {
+    not has_attribute("employee_type", "IC") with data.system.abbey.identities.directory_sync_users.custom_attributes as {"department_name": "Engineering", "cost_center_name": "Engineering", "employee_type": "Manager"}
+}

src/abbey/functions/in_group.rego

@@ -0,0 +1,11 @@
+package abbey.functions
+
+import future.keywords.if
+import future.keywords.in
+
+# Function which checks whether a user is in a given group.
+# Groups are kept within an object called group_memberships in the
+# system.abbey object
+in_group(group_name) := true if {
+	group_name in data.system.abbey.group_memberships
+}

src/abbey/functions/in_group_test.rego

@@ -0,0 +1,11 @@
+package abbey.functions
+
+import future.keywords.if
+
+test_in_group_engineering if {
+    in_group("Engineering") with data.system.abbey.group_memberships as ["Engineering", "R&D"]
+}
+
+test_not_in_group_marketing if {
+    not in_group("Marketing") with data.system.abbey.group_memberships as ["Engineering", "R&D"]
+}