feature flag editors

ff_editors.opa

package feature_flags

# Only allow FF edits by users in a group called ff_editors
# This helps seperate create and edit access, which are currently bundled together

deny["You are not allowed to edit flags"] {
	input.metadata.action == "onsave"

    # createdAt is in ms vs timestamp in s
    createdAt := floor(input.flag.createdAt / 1000)

    # this action is not a creation, based on timestamps being different
	input.metadata.timestamp != createdAt

    not is_ff_editor
}

is_ff_editor {
    input.metadata.userGroups[i].identifier == "ff_editors"
}