{"id":18302558,"url":"https://github.com/go-training/opa-embed","last_synced_at":"2025-10-17T07:21:46.947Z","repository":{"id":57616253,"uuid":"359017024","full_name":"go-training/opa-embed","owner":"go-training","description":"Open Policy Agent Demo for Embed file in Go","archived":false,"fork":false,"pushed_at":"2021-10-10T13:09:44.000Z","size":101,"stargazers_count":13,"open_issues_count":0,"forks_count":6,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-02-15T04:24:57.383Z","etag":null,"topics":["embedmd","open-policy-agent","rbac","rego"],"latest_commit_sha":null,"homepage":"","language":"Open Policy Agent","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/go-training.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2021-04-18T01:16:03.000Z","updated_at":"2024-03-13T05:58:40.000Z","dependencies_parsed_at":"2022-08-27T07:31:47.813Z","dependency_job_id":null,"html_url":"https://github.com/go-training/opa-embed","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-training%2Fopa-embed","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-training%2Fopa-embed/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-training%2Fopa-embed/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-training%2Fopa-embed/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/go-training","download_url":"https://codeload.github.com/go-training/opa-embed/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248018061,"owners_count":21034048,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["embedmd","open-policy-agent","rbac","rego"],"created_at":"2024-11-05T15:20:31.105Z","updated_at":"2025-10-17T07:21:41.903Z","avatar_url":"https://github.com/go-training.png","language":"Open Policy Agent","funding_links":[],"categories":[],"sub_categories":[],"readme":"# opa-embed\n\n[![Run Tests](https://github.com/go-training/opa-embed/actions/workflows/go.yml/badge.svg)](https://github.com/go-training/opa-embed/actions/workflows/go.yml)\n[![Open Policy Agent Testing](https://github.com/go-training/opa-embed/actions/workflows/opa.yml/badge.svg)](https://github.com/go-training/opa-embed/actions/workflows/opa.yml)\n\nHow to use Role-based access control (RBAC) with the Open Policy Agent. See the [reference guide](https://www.openpolicyagent.org/docs/latest/comparison-to-other-systems/#role-based-access-control-rbac).\n\n* [Chinese Blog](https://blog.wu-boy.com/2021/04/setup-rbac-role-based-access-control-using-open-policy-agent/)\n* [Chinese Video](https://www.youtube.com/watch?v=AkMVh5XRcuI)\n\n## Integrating with the Go API\n\n### Create RBAC policy\n\n[embedmd]:# (policy/rbac.authz.rego)\n```rego\npackage rbac.authz\n\n# user-role assignments\ngroup_roles := {\n\t\"design_group_kpi_editor\": [\"kpi_editor_design\", \"viewer_limit_ds\"],\n\t\"system_group_kpi_editor\": [\"kpi_editor_system\", \"viewer_limit_ds\"],\n\t\"manufacture_group_kpi_editor\": [\"kpi_editor_manufacture\", \"viewer\"],\n\t\"project_leader\": [\"viewer_limit_ds\", \"viewer_limit_m\"],\n}\n\n# role-permissions assignments\nrole_permissions := {\n\t\"admin\": [\n\t\t{\"action\": \"view_all\", \"object\": \"design\"},\n\t\t{\"action\": \"edit\", \"object\": \"design\"},\n\t\t{\"action\": \"view_all\", \"object\": \"system\"},\n\t\t{\"action\": \"edit\", \"object\": \"system\"},\n\t\t{\"action\": \"view_all\", \"object\": \"manufacture\"},\n\t\t{\"action\": \"edit\", \"object\": \"manufacture\"},\n\t],\n\t\"quality_head_design\": [\n\t\t{\"action\": \"view_all\", \"object\": \"design\"},\n\t\t{\"action\": \"edit\", \"object\": \"design\"},\n\t\t{\"action\": \"view_all\", \"object\": \"system\"},\n\t\t{\"action\": \"view_all\", \"object\": \"manufacture\"},\n\t],\n\t\"quality_head_system\": [\n\t\t{\"action\": \"view_all\", \"object\": \"design\"},\n\t\t{\"action\": \"view_all\", \"object\": \"system\"},\n\t\t{\"action\": \"edit\", \"object\": \"system\"},\n\t\t{\"action\": \"view_all\", \"object\": \"manufacture\"},\n\t],\n\t\"quality_head_manufacture\": [\n\t\t{\"action\": \"view_all\", \"object\": \"design\"},\n\t\t{\"action\": \"view_all\", \"object\": \"system\"},\n\t\t{\"action\": \"view_all\", \"object\": \"manufacture\"},\n\t\t{\"action\": \"edit\", \"object\": \"manufacture\"},\n\t],\n\t\"kpi_editor_design\": [\n\t\t{\"action\": \"view_all\", \"object\": \"design\"},\n\t\t{\"action\": \"edit\", \"object\": \"design\"},\n\t],\n\t\"kpi_editor_system\": [\n\t\t{\"action\": \"view_all\", \"object\": \"system\"},\n\t\t{\"action\": \"edit\", \"object\": \"system\"},\n\t],\n\t\"kpi_editor_manufacture\": [\n\t\t{\"action\": \"view_all\", \"object\": \"manufacture\"},\n\t\t{\"action\": \"edit\", \"object\": \"manufacture\"},\n\t],\n\t\"viewer\": [\n\t\t{\"action\": \"view_all\", \"object\": \"design\"},\n\t\t{\"action\": \"view_all\", \"object\": \"system\"},\n\t\t{\"action\": \"view_all\", \"object\": \"manufacture\"},\n\t],\n\t\"viewer_limit_ds\": [\n\t\t{\"action\": \"view_all\", \"object\": \"design\"},\n\t\t{\"action\": \"view_all\", \"object\": \"system\"},\n\t],\n\t\"viewer_limit_m\": [{\"action\": \"view_l3_project\", \"object\": \"manufacture\"}],\n}\n\n# logic that implements RBAC.\ndefault allow = false\n\nallow {\n\t# lookup the list of roles for the user\n\troles := group_roles[input.user[_]]\n\n\t# for each role in that list\n\tr := roles[_]\n\n\t# lookup the permissions list for role r\n\tpermissions := role_permissions[r]\n\n\t# for each permission\n\tp := permissions[_]\n\n\t# check if the permission granted to r matches the user's request\n\tp == {\"action\": input.action, \"object\": input.object}\n}\n```\n\n### Write Testing\n\nPlease download [OPA Binary](https://www.openpolicyagent.org/docs/latest/#running-opa) first.\n\n[embedmd]:# (policy/rbac.authz_test.rego)\n```rego\npackage rbac.authz\n\ntest_design_group_kpi_editor {\n\tallow with input as {\"user\": [\"design_group_kpi_editor\"], \"action\": \"view_all\", \"object\": \"design\"}\n\tallow with input as {\"user\": [\"design_group_kpi_editor\"], \"action\": \"edit\", \"object\": \"design\"}\n\tallow with input as {\"user\": [\"design_group_kpi_editor\"], \"action\": \"view_all\", \"object\": \"system\"}\n\tnot allow with input as {\"user\": [\"design_group_kpi_editor\"], \"action\": \"edit\", \"object\": \"system\"}\n\tnot allow with input as {\"user\": [\"design_group_kpi_editor\"], \"action\": \"view_all\", \"object\": \"manufacture\"}\n\tnot allow with input as {\"user\": [\"design_group_kpi_editor\"], \"action\": \"edit\", \"object\": \"manufacture\"}\n}\n\ntest_system_group_kpi_editor {\n\tallow with input as {\"user\": [\"system_group_kpi_editor\"], \"action\": \"view_all\", \"object\": \"design\"}\n\tnot allow with input as {\"user\": [\"system_group_kpi_editor\"], \"action\": \"edit\", \"object\": \"design\"}\n\tallow with input as {\"user\": [\"system_group_kpi_editor\"], \"action\": \"view_all\", \"object\": \"system\"}\n\tallow with input as {\"user\": [\"system_group_kpi_editor\"], \"action\": \"edit\", \"object\": \"system\"}\n\tnot allow with input as {\"user\": [\"system_group_kpi_editor\"], \"action\": \"view_all\", \"object\": \"manufacture\"}\n\tnot allow with input as {\"user\": [\"system_group_kpi_editor\"], \"action\": \"edit\", \"object\": \"manufacture\"}\n}\n\ntest_manufacture_group_kpi_editor {\n\tallow with input as {\"user\": [\"manufacture_group_kpi_editor\"], \"action\": \"view_all\", \"object\": \"design\"}\n\tnot allow with input as {\"user\": [\"manufacture_group_kpi_editor\"], \"action\": \"edit\", \"object\": \"design\"}\n\tallow with input as {\"user\": [\"manufacture_group_kpi_editor\"], \"action\": \"view_all\", \"object\": \"system\"}\n\tnot allow with input as {\"user\": [\"manufacture_group_kpi_editor\"], \"action\": \"edit\", \"object\": \"system\"}\n\tallow with input as {\"user\": [\"manufacture_group_kpi_editor\"], \"action\": \"view_all\", \"object\": \"manufacture\"}\n\tallow with input as {\"user\": [\"manufacture_group_kpi_editor\"], \"action\": \"edit\", \"object\": \"manufacture\"}\n}\n\ntest_project_leader {\n\tallow with input as {\"user\": [\"project_leader\"], \"action\": \"view_all\", \"object\": \"design\"}\n\tnot allow with input as {\"user\": [\"project_leader\"], \"action\": \"edit\", \"object\": \"design\"}\n\tallow with input as {\"user\": [\"project_leader\"], \"action\": \"view_all\", \"object\": \"system\"}\n\tnot allow with input as {\"user\": [\"project_leader\"], \"action\": \"edit\", \"object\": \"system\"}\n\tnot allow with input as {\"user\": [\"project_leader\"], \"action\": \"view_all\", \"object\": \"manufacture\"}\n\tnot allow with input as {\"user\": [\"project_leader\"], \"action\": \"edit\", \"object\": \"manufacture\"}\n\tallow with input as {\"user\": [\"project_leader\"], \"action\": \"view_l3_project\", \"object\": \"manufacture\"}\n}\n\ntest_design_group_kpi_editor_and_system_group_kpi_editor {\n\tallow with input as {\"user\": [\"design_group_kpi_editor\", \"system_group_kpi_editor\"], \"action\": \"edit\", \"object\": \"design\"}\n\tallow with input as {\"user\": [\"design_group_kpi_editor\", \"system_group_kpi_editor\"], \"action\": \"edit\", \"object\": \"system\"}\n}\n```\n\nrun test command:\n\n```bash\n$ opa test -v *.rego\ndata.rbac.authz.test_design_group_kpi_editor: PASS (8.604833ms)\ndata.rbac.authz.test_system_group_kpi_editor: PASS (7.260166ms)\ndata.rbac.authz.test_manufacture_group_kpi_editor: PASS (2.217125ms)\ndata.rbac.authz.test_project_leader: PASS (1.823833ms)\ndata.rbac.authz.test_design_group_kpi_editor_and_system_group_kpi_editor: PASS (1.150791ms)\n--------------------------------------------------------------------------------\nPASS: 5/5\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgo-training%2Fopa-embed","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgo-training%2Fopa-embed","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgo-training%2Fopa-embed/lists"}