OPA Test Run

data.json

{
    "roles": [
        {
            "operation": "read",
            "resource": "widgets",
            "name": "widget-reader"
        },
        {
            "operation": "write",
            "resource": "widgets",
            "name": "widget-writer"
        }
    ],
    "bindings": [
        {
            "user": "inspector-alice",
            "role": "widget-reader"
        },
        {
            "user": "maker-bob",
            "role": "widget-writer"
        }
    ]
}

input.json

{
  "input": {
    "subject": {
      "user": "maker-bob"
    },
    "action": {
      "resource": "widgets",
      "operation": "write"
    }
  }
}

instance config

# opa run --server \
  --log-format json \
  --set decision_logs.console=true \
  -l debug \
  ./data.json ./policy.rego

policy.rego

package example_rbac

default allow = false

allow {
    user_has_role[role_name]
    role_has_permission[role_name]
}

user_has_role[role_name] {
    role_binding = data.bindings[_]
    role_binding.role = role_name
    role_binding.user = input.subject.user
}

role_has_permission[role_name] {
    role = data.roles[_]
    role.name = role_name
    role.operation = input.action.operation
    role.resource = input.action.resource
}

tests

$ mkdir /tmp/opa-tests
$ cd /tmp/opa-tests

$ cat <<EOF > input.json
{
  "input": {
    "subject": {
      "user": "maker-bob"
    },
    "action": {
      "resource": "widgets",
      "operation": "write"
    }
  }
}
EOF

$ curl -fslLX POST -d "@input.json" 'http://dev.authzaas.in.pan-net.eu:8181/v1/data/example_rbac/allow' | jq -S .
{
  "result": true
}

$ curl -fslLX POST -d "@input.json" 'http://dev.authzaas.in.pan-net.eu:8181/v1/data/example_rbac/user_has_role' | jq -S .
{
  "result": [
    "widget-writer"
  ]
}