一般ユーザーをreadonlyにする

readonly.sh

geonic admin policies create '{
  "policyId": "user-readonly",
  "description": "user ロールをデータ API で読み取り専用に制限",
  "target": {
    "subjects": [{"attributeId": "role", "matchValue": "user"}]
  },
  "ruleCombiningAlgorithm": "first-applicable",
  "rules": [
    {
      "ruleId": "deny-post",
      "effect": "Deny",
      "target": {
        "actions": [{"attributeId": "method", "matchValue": "POST"}],
        "resources": [
          {"attributeId": "path", "matchValue": "/v2/**"},
          {"attributeId": "path", "matchValue": "/ngsi-ld/**"}
        ]
      }
    },
    {
      "ruleId": "deny-patch",
      "effect": "Deny",
      "target": {
        "actions": [{"attributeId": "method", "matchValue": "PATCH"}],
        "resources": [
          {"attributeId": "path", "matchValue": "/v2/**"},
          {"attributeId": "path", "matchValue": "/ngsi-ld/**"}
        ]
      }
    },
    {
      "ruleId": "deny-put",
      "effect": "Deny",
      "target": {
        "actions": [{"attributeId": "method", "matchValue": "PUT"}],
        "resources": [
          {"attributeId": "path", "matchValue": "/v2/**"},
          {"attributeId": "path", "matchValue": "/ngsi-ld/**"}
        ]
      }
    },
    {
      "ruleId": "deny-delete",
      "effect": "Deny",
      "target": {
        "actions": [{"attributeId": "method", "matchValue": "DELETE"}],
        "resources": [
          {"attributeId": "path", "matchValue": "/v2/**"},
          {"attributeId": "path", "matchValue": "/ngsi-ld/**"}
        ]
      }
    }
  ],
  "priority": 100
}'

このポリシーを無効化するには以下のコマンドで

geonic admin policies deactivate user-readonly