coder/coderd/rbac/policy.rego

package authz

import rego.v1

# Check the POLICY.md file before editing this!
#
# https://play.openpolicyagent.org/
#

#==============================================================================#
# Site level rules                                                             #
#==============================================================================#

# Site level permissions allow the subject to use that permission on any object.
# For example, a site-level workspace.read permission means that the subject can
# see every workspace in the deployment, regardless of organization or owner.

default site := 0

site := check_site_permissions(input.subject.roles)

default scope_site := 0

scope_site := check_site_permissions([input.subject.scope])

check_site_permissions(roles) := vote if {
	allow := {is_allowed |
		# Iterate over all site permissions in all roles, and check which ones match
		# the action and object type.
		perm := roles[_].site[_]
		perm.action in [input.action, "*"]
		perm.resource_type in [input.object.type, "*"]

		# If a negative matching permission was found, then we vote to disallow it.
		# If the permission is not negative, then we vote to allow it.
		is_allowed := bool_flip(perm.negate)
	}
	vote := to_vote(allow)
}

#==============================================================================#
# User level rules                                                             #
#==============================================================================#

# User level rules apply to all objects owned by the subject which are not also
# owned by an org. Permissions for objects which are "jointly" owned by an org
# instead defer to the org member level rules.

default user := 0

user := check_user_permissions(input.subject.roles)

default scope_user := 0

scope_user := check_user_permissions([input.subject.scope])

check_user_permissions(roles) := vote if {
	# The object must be owned by the subject.
	input.subject.id = input.object.owner

	# If there is an org, use org_member permissions instead
	input.object.org_owner == ""
	not input.object.any_org

	allow := {is_allowed |
		# Iterate over all user permissions in all roles, and check which ones match
		# the action and object type.
		perm := roles[_].user[_]
		perm.action in [input.action, "*"]
		perm.resource_type in [input.object.type, "*"]

		# If a negative matching permission was found, then we vote to disallow it.
		# If the permission is not negative, then we vote to allow it.
		is_allowed := bool_flip(perm.negate)
	}
	vote := to_vote(allow)
}

#==============================================================================#
# Org level rules                                                              #
#==============================================================================#

# Org level permissions are similar to `site`, except we need to iterate over
# each organization that the subject is a member of, and check against the
# organization that the object belongs to.
# For example, an organization-level workspace.read permission means that the
# subject can see every workspace in the organization, regardless of owner.

# org_memberships is the set of organizations the subject is apart of.
org_memberships := {org_id |
	input.subject.roles[_].by_org_id[org_id]
}

# TODO: Should there be a scope_org_memberships too? Without it, the membership
# is determined by the user's roles, not their scope permissions.
#
# If an owner (who is not an org member) has an org scope, that org scope will
# fail to return '1', since we assume all non-members return '-1' for org level
# permissions. Adding a second set of org memberships might affect the partial
# evaluation. This is being left until org scopes are used.

default org := 0

org := check_org_permissions(input.subject.roles, "org")

default scope_org := 0

scope_org := check_org_permissions([input.subject.scope], "org")

# check_all_org_permissions creates a map from org ids to votes at each org
# level, for each org that the subject is a member of. It doesn't actually check
# if the object is in the same org. Instead we look up the correct vote from
# this map based on the object's org id in `check_org_permissions`.
# For example, the `org_map` will look something like this:
#
#   {"<org_id_a>": 1, "<org_id_b>": 0, "<org_id_c>": -1}
#
# The caller then uses `output[input.object.org_owner]` to get the correct vote.
#
# We have to create this map, rather than just getting the vote of the object's
# org id because the org id _might_ be unknown. In order to make sure that this
# policy compresses down to simple queries we need to keep unknown values out of
# comprehensions.
check_all_org_permissions(roles, key) := {org_id: vote |
	org_id := org_memberships[_]
	allow := {is_allowed |
		# Iterate over all site permissions in all roles, and check which ones match
		# the action and object type.
		perm := roles[_].by_org_id[org_id][key][_]
		perm.action in [input.action, "*"]
		perm.resource_type in [input.object.type, "*"]

		# If a negative matching permission was found, then we vote to disallow it.
		# If the permission is not negative, then we vote to allow it.
		is_allowed := bool_flip(perm.negate)
	}
	vote := to_vote(allow)
}

# This check handles the case where the org id is known.
check_org_permissions(roles, key) := vote if {
	# Disallow setting any_org at the same time as an org id.
	not input.object.any_org

	allow_map := check_all_org_permissions(roles, key)

	# Return only the vote of the object's org.
	vote := allow_map[input.object.org_owner]
}

# This check handles the case where we want to know if the user has the
# appropriate permission for any organization, without needing to know which.
# This is used in several places in the UI to determine if certain parts of the
# app should be accessible.
# For example, can the user create a new template in any organization? If yes,
# then we should show the "New template" button.
check_org_permissions(roles, key) := vote if {
	# Require `any_org` to be set
	input.object.any_org

	allow_map := check_all_org_permissions(roles, key)

	# Since we're checking if the subject has the permission in _any_ org, we're
	# essentially trying to find the highest vote from any org.
	vote := max({vote |
		some vote in allow_map
	})
}

# is_org_member checks if the subject belong to the same organization as the
# object.
is_org_member if {
	not input.object.any_org
	input.object.org_owner != ""
	input.object.org_owner in org_memberships
}

# ...if 'any_org' is set to true, we check if the subject is a member of any
# org.
is_org_member if {
	input.object.any_org
	count(org_memberships) > 0
}

#==============================================================================#
# Org member level rules                                                       #
#==============================================================================#

# Org member level permissions apply to all objects owned by the subject _and_
# the corresponding org. Permissions for objects which are not owned by an
# organization instead defer to the user level rules.
#
# The rules for this level are very similar to the rules for the organization
# level, and so we reuse the `check_org_permissions` function from those rules.

default org_member := 0

org_member := vote if {
	# Object must be jointly owned by the user
	input.object.owner != ""
	input.subject.id = input.object.owner
	vote := check_org_permissions(input.subject.roles, "member")
}

default scope_org_member := 0

scope_org_member := vote if {
	# Object must be jointly owned by the user
	input.object.owner != ""
	input.subject.id = input.object.owner
	vote := check_org_permissions([input.subject.scope], "member")
}

#==============================================================================#
# Role rules                                                                   #
#==============================================================================#

# role_allow specifies all of the conditions under which a role can grant
# permission. These rules intentionally use the "unification" operator rather
# than the equality and inequality operators, because those operators do not
# work on partial values.
# https://www.openpolicyagent.org/docs/policy-language#unification-

# Site level authorization
role_allow if {
	site = 1
}

# User level authorization
role_allow if {
	not site = -1

	user = 1
}

# Org level authorization
role_allow if {
	not site = -1

	org = 1
}

# Org member authorization
role_allow if {
	not site = -1
	not org = -1

	org_member = 1
}

#==============================================================================#
# Scope rules                                                                  #
#==============================================================================#

# scope_allow specifies all of the conditions under which a scope can grant
# permission. These rules intentionally use the "unification" (=) operator
# rather than the equality (==) and inequality (!=) operators, because those
# operators do not work on partial values.
# https://www.openpolicyagent.org/docs/policy-language#unification-

# Site level scope enforcement
scope_allow if {
	object_is_included_in_scope_allow_list
	scope_site = 1
}

# User level scope enforcement
scope_allow if {
	# User scope permissions must be allowed by the scope, and not denied
	# by the site. The object *must not* be owned by an organization.
	object_is_included_in_scope_allow_list
	not scope_site = -1

	scope_user = 1
}

# Org level scope enforcement
scope_allow if {
	# Org member scope permissions must be allowed by the scope, and not denied
	# by the site. The object *must* be owned by an organization.
	object_is_included_in_scope_allow_list
	not scope_site = -1

	scope_org = 1
}

# Org member level scope enforcement
scope_allow if {
	# Org member scope permissions must be allowed by the scope, and not denied
	# by the site or org. The object *must* be owned by an organization.
	object_is_included_in_scope_allow_list
	not scope_site = -1
	not scope_org = -1

	scope_org_member = 1
}

# If *.* is allowed, then all objects are in scope.
object_is_included_in_scope_allow_list if {
	{"type": "*", "id": "*"} in input.subject.scope.allow_list
}

# If <type>.* is allowed, then all objects of that type are in scope.
object_is_included_in_scope_allow_list if {
	{"type": input.object.type, "id": "*"} in input.subject.scope.allow_list
}

# Check if the object type and ID match one of the allow list entries.
object_is_included_in_scope_allow_list if {
	# Check that the wildcard rules do not apply. This prevents partial inputs
	# from needing to include `input.object.id`.
	not {"type": "*", "id": "*"} in input.subject.scope.allow_list
	not {"type": input.object.type, "id": "*"} in input.subject.scope.allow_list

	# Check which IDs from the allow list match the object type
	allowed_ids_for_object_type := {it.id |
		some it in input.subject.scope.allow_list
		it.type in [input.object.type, "*"]
	}

	# Check if the input object ID is in the set of allowed IDs for the same
	# object type. We do this at the end to keep `input.object.id` out of the
	# comprehension because it might be unknown.
	input.object.id in allowed_ids_for_object_type
}

#==============================================================================#
# ACL rules                                                                    #
#==============================================================================#

# ACL for users
acl_allow if {
	# TODO: Should you have to be a member of the org too?
	perms := input.object.acl_user_list[input.subject.id]

	# Check if either the action or * is allowed
	some action in [input.action, "*"]
	action in perms
}

# ACL for groups
acl_allow if {
	# If there is no organization owner, the object cannot be owned by an
	# org-scoped group.
	is_org_member
	some group in input.subject.groups
	perms := input.object.acl_group_list[group]

	# Check if either the action or * is allowed
	some action in [input.action, "*"]
	action in perms
}

# ACL for the special "Everyone" groups
acl_allow if {
	# If there is no organization owner, the object cannot be owned by an
	# org-scoped group.
	is_org_member
	perms := input.object.acl_group_list[input.object.org_owner]

	# Check if either the action or * is allowed
	some action in [input.action, "*"]
	action in perms
}

#==============================================================================#
# Allow                                                                        #
#==============================================================================#

# The `allow` block is quite simple. Any check that voted no will cascade down.
# Authorization looks for any `allow` statement that is true. Multiple can be
# true! Note that the absence of `allow` means "unauthorized". An explicit
# `"allow": true` is required.
#
# We check both the subject's permissions (given by their roles or by ACL) and
# the subject's scope. (The default scope is "*:*", allowing all actions.) Both
# a permission check (either from roles or ACL) and the scope check must vote to
# allow or the action is not authorized.

# A subject can be given permission by a role
permission_allow if role_allow

# A subject can be given permission by ACL
permission_allow if acl_allow

allow if {
	# Must be allowed by the subject's permissions
	permission_allow

	# ...and allowed by the scope
	scope_allow
}

#==============================================================================#
# Utilities                                                                    #
#==============================================================================#

# bool_flip returns the logical negation of a boolean value. You can't do
# 'x := not false', but you can do 'x := bool_flip(false)'
bool_flip(b) := false if {
	b
}

bool_flip(b) if {
	not b
}

# to_vote gives you a voting value from a set or list of booleans.
#   {false,..} => deny (-1)
#   {}         => abstain (0)
#   {true}     => allow (1)

# Any set which contains a `false` should be considered a vote to deny.
to_vote(set) := -1 if {
	false in set
}

# A set which is empty should be considered abstaining.
to_vote(set) := 0 if {
	count(set) == 0
}

# A set which only contains true should be considered a vote to allow.
to_vote(set) := 1 if {
	not false in set
	true in set
}