Externalised Policy with OPA and Rego

package northgate.portfolio

import rego.v1

# The rule Lab 13 could not express: permit a read when the subject's desk
# equals the RESOURCE's desk, dynamically, plus the market-hours window and
# the approval-limit threshold. One policy, every desk, present and future.

default allow := false

allow if {
    input.action == "read"
    desk_matches
    within_market_hours
    within_approval_limit
}

desk_matches if {
    input.subject.desk == input.resource.desk
}

within_market_hours if {
    # environment.time is supplied as "HH:MM" 24-hour UK time by the PEP.
    # String comparison works for zero-padded HH:MM values.
    input.environment.time >= "08:00"
    input.environment.time <= "16:30"
}

within_approval_limit if {
    to_number(input.subject.approval_limit) >= input.resource.value
}

# Deny reasons: each rule contributes a human-readable reason when its
# condition fails, so every deny is explainable.
deny_reasons contains reason if {
    not desk_matches
    reason := sprintf("subject desk %q does not match resource desk %q",
        [input.subject.desk, input.resource.desk])
}

deny_reasons contains reason if {
    not within_market_hours
    reason := sprintf("time %q is outside market hours 08:00 to 16:30",
        [input.environment.time])
}

deny_reasons contains reason if {
    not within_approval_limit
    reason := sprintf("approval limit %v is below resource value %v",
        [input.subject.approval_limit, input.resource.value])
}

decision := {"allow": allow, "deny_reasons": deny_reasons}

package northgate.portfolio_test

import rego.v1

import data.northgate.portfolio

base_input := {
    "action": "read",
    "subject": {"username": "asmith", "desk": "desk-a", "approval_limit": "500000"},
    "resource": {"id": "pf-1001", "desk": "desk-a", "value": 250000},
    "environment": {"time": "10:30"},
}

test_matching_desk_in_hours_within_limit_allows if {
    portfolio.allow with input as base_input
}

test_wrong_desk_denies if {
    not portfolio.allow with input as
        json.patch(base_input, [{"op": "replace", "path": "/subject/desk", "value": "desk-b"}])
}

test_wrong_desk_gives_reason if {
    reasons := portfolio.deny_reasons with input as
        json.patch(base_input, [{"op": "replace", "path": "/subject/desk", "value": "desk-b"}])
    count(reasons) == 1
}

test_outside_hours_denies if {
    not portfolio.allow with input as
        json.patch(base_input, [{"op": "replace", "path": "/environment/time", "value": "19:00"}])
}

test_over_limit_denies if {
    not portfolio.allow with input as
        json.patch(base_input, [{"op": "replace", "path": "/resource/value", "value": 900000}])
}

test_new_desk_e_allows_with_no_policy_change if {
    # The payoff test: a desk that never existed when the policy was written.
    portfolio.allow with input as json.patch(base_input, [
        {"op": "replace", "path": "/subject/desk", "value": "desk-e"},
        {"op": "replace", "path": "/resource/desk", "value": "desk-e"},
    ])
}

test_write_action_denies if {
    not portfolio.allow with input as
        json.patch(base_input, [{"op": "replace", "path": "/action", "value": "write"}])
}

cd ~/ib-labs/ib-opa
docker run --rm -v "$(pwd)/policies:/policies:ro" \
  openpolicyagent/opa:latest test /policies -v

  ib-opa:
    image: openpolicyagent/opa:latest
    container_name: ib-opa
    command: ["run", "--server", "--addr", "0.0.0.0:8181",
              "--log-level", "info", "/policies"]
    volumes:
      - ./ib-opa/policies:/policies:ro
    networks:
      - ib-lab-net
    ports:
      - "8181:8181"

docker compose up -d ib-opa

# Permit: matching desk, in hours, within limit.
curl -s -X POST http://localhost:8181/v1/data/northgate/portfolio/decision \
  -H "Content-Type: application/json" \
  -d '{"input": {
        "action": "read",
        "subject": {"username": "asmith", "desk": "desk-a", "approval_limit": "500000"},
        "resource": {"id": "pf-1001", "desk": "desk-a", "value": 250000},
        "environment": {"time": "10:30"}
      }}' | jq '.result'

# Deny: wrong desk. Note the explainable reason.
curl -s -X POST http://localhost:8181/v1/data/northgate/portfolio/decision \
  -H "Content-Type: application/json" \
  -d '{"input": {
        "action": "read",
        "subject": {"username": "jpatel", "desk": "desk-b", "approval_limit": "100000"},
        "resource": {"id": "pf-1001", "desk": "desk-a", "value": 250000},
        "environment": {"time": "10:30"}
      }}' | jq '.result'

docker exec -it ib-keycloak-1 /opt/keycloak/bin/kcadm.sh create \
  clients/RESOURCE_CLIENT_UUID/protocol-mappers/models -r northgate \
  -s name=approval-limit-mapper \
  -s protocol=openid-connect \
  -s protocolMapper=oidc-usermodel-attribute-mapper \
  -s 'config."user.attribute"=approval_limit' \
  -s 'config."claim.name"=approval_limit' \
  -s 'config."access.token.claim"=true' \
  -s 'config."jsonType.label"=String'

# pep.py
# The Policy Enforcement Point. Verifies the Keycloak token (Lab 09 pattern),
# builds the decision input ONLY from verified claims plus its own resource
# data, asks OPA, and enforces. Fails closed if OPA is unreachable.

import json
import datetime
import requests
from flask import Flask, request, jsonify
from jwcrypto import jwt, jwk

app = Flask(__name__)
ISSUER = "https://ib-lb:8443/realms/northgate"
JWKS_URL = f"{ISSUER}/protocol/openid-connect/certs"
OPA_URL = "http://ib-opa:8181/v1/data/northgate/portfolio/decision"
requests.packages.urllib3.disable_warnings()
_jwks = jwk.JWKSet.from_json(requests.get(JWKS_URL, verify=False).text)

# The application's own resource data. In production this is the portfolio
# database; the desk and value are RESOURCE attributes the app owns.
PORTFOLIOS = {
    "pf-1001": {"desk": "desk-a", "value": 250000},
    "pf-2001": {"desk": "desk-b", "value": 80000},
    "pf-5001": {"desk": "desk-e", "value": 40000},   # the new desk
}


def _verified_claims(token):
    verified = jwt.JWT(jwt=token, key=_jwks, algs=["RS256"])
    return json.loads(verified.claims)


@app.get("/portfolio/<pf_id>")
def read_portfolio(pf_id):
    auth = request.headers.get("Authorization", "")
    _, _, token = auth.partition(" ")
    try:
        claims = _verified_claims(token)
    except Exception as e:
        return jsonify({"error": f"invalid token: {e}"}), 401

    resource = PORTFOLIOS.get(pf_id)
    if resource is None:
        return jsonify({"error": "no such portfolio"}), 404

    # Build the decision input. Subject attributes come ONLY from the
    # verified token; resource attributes from our own data; time from
    # our clock. Nothing from the caller's request body.
    decision_input = {
        "input": {
            "action": "read",
            "subject": {
                "username": claims.get("preferred_username"),
                "desk": claims.get("desk"),
                "approval_limit": claims.get("approval_limit"),
            },
            "resource": {"id": pf_id, **resource},
            "environment": {
                "time": datetime.datetime.now().strftime("%H:%M"),
            },
        }
    }

    try:
        r = requests.post(OPA_URL, json=decision_input, timeout=2)
        r.raise_for_status()
        result = r.json()["result"]
    except Exception as e:
        # Fail closed: no decision means no access.
        return jsonify({"error": f"policy engine unavailable: {e}"}), 503

    if not result["allow"]:
        return jsonify({"denied": True, "reasons": sorted(result["deny_reasons"])}), 403

    return jsonify({"portfolio": pf_id, "desk": resource["desk"],
                    "value": resource["value"], "viewer": claims.get("preferred_username")})


if __name__ == "__main__":
    app.run(host="0.0.0.0", port=8099, ssl_context="adhoc")

python3.11 pep.py   # listens on https://localhost:8099

# asmith (desk-a, limit 500000) reads a desk-a portfolio: permit.
ASMITH_TOKEN=$(curl -sk -X POST \
  "https://localhost:8443/realms/northgate/protocol/openid-connect/token" \
  -d "client_id=portfolio-api" -d "client_secret=REPLACE_WITH_PORTFOLIO_SECRET" \
  -d "grant_type=password" -d "username=asmith" \
  -d "password=REPLACE_WITH_ASMITH_PASSWORD" -d "scope=openid" | jq -r '.access_token')

curl -sk -H "Authorization: Bearer $ASMITH_TOKEN" \
  https://localhost:8099/portfolio/pf-1001 | jq

# jpatel (desk-b, limit 100000) reads the same desk-a portfolio: deny,
# with BOTH reasons in the response.
JPATEL_TOKEN=$(curl -sk -X POST \
  "https://localhost:8443/realms/northgate/protocol/openid-connect/token" \
  -d "client_id=portfolio-api" -d "client_secret=REPLACE_WITH_PORTFOLIO_SECRET" \
  -d "grant_type=password" -d "username=jpatel" \
  -d "password=REPLACE_WITH_JPATEL_PASSWORD" -d "scope=openid" | jq -r '.access_token')

curl -sk -H "Authorization: Bearer $JPATEL_TOKEN" \
  https://localhost:8099/portfolio/pf-1001 | jq

# jpatel reads his OWN desk's portfolio pf-2001 (value 80000, under his
# 100000 limit): permit. Same user, different resource, different answer.
curl -sk -H "Authorization: Bearer $JPATEL_TOKEN" \
  https://localhost:8099/portfolio/pf-2001 | jq

# Give lokafor the new desk-e and a modest limit.
LID=$(docker exec -it ib-keycloak-1 /opt/keycloak/bin/kcadm.sh get users \
  -r northgate -q username=lokafor --fields id | jq -r '.[0].id')
docker exec -it ib-keycloak-1 /opt/keycloak/bin/kcadm.sh update users/$LID \
  -r northgate -s 'attributes.desk=["desk-e"]' \
  -s 'attributes.approval_limit=["150000"]'

LOKAFOR_TOKEN=$(curl -sk -X POST \
  "https://localhost:8443/realms/northgate/protocol/openid-connect/token" \
  -d "client_id=portfolio-api" -d "client_secret=REPLACE_WITH_PORTFOLIO_SECRET" \
  -d "grant_type=password" -d "username=lokafor" \
  -d "password=REPLACE_WITH_LOKAFOR_PASSWORD" -d "scope=openid" | jq -r '.access_token')

# pf-5001 belongs to desk-e. The policy has never heard of desk-e.
curl -sk -H "Authorization: Bearer $LOKAFOR_TOKEN" \
  https://localhost:8099/portfolio/pf-5001 | jq