acmecorp_authz.rego

package acmecorp.api
 
import data.acmecorp.roles

default allow = false
 
allow {
  input.method = “GET”
  input.path = [“accounts”, user]
  input.user = user
}
 
allow {
  input.method = “GET”
  input.path = [“accounts”, “report”]
  roles[input.user][_] = “admin”
}

allow {
  input.method = “POST”
  input.path = [“accounts”]
  roles[input.user][_] = “admin”
}