{"id":18302553,"url":"https://github.com/go-training/opa-restful","last_synced_at":"2025-04-09T10:11:48.063Z","repository":{"id":82886398,"uuid":"363351854","full_name":"go-training/opa-restful","owner":"go-training","description":"Setup REST API with Open Policy Agent","archived":false,"fork":false,"pushed_at":"2021-10-03T08:39:03.000Z","size":435,"stargazers_count":14,"open_issues_count":0,"forks_count":4,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-02-15T04:24:56.924Z","etag":null,"topics":["open-policy-agent","restful-api"],"latest_commit_sha":null,"homepage":"","language":"Open Policy Agent","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/go-training.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-05-01T07:39:42.000Z","updated_at":"2024-04-22T00:05:07.000Z","dependencies_parsed_at":null,"dependency_job_id":"a647168d-1f63-4029-b76b-8a5a36336523","html_url":"https://github.com/go-training/opa-restful","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-training%2Fopa-restful","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-training%2Fopa-restful/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-training%2Fopa-restful/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/go-training%2Fopa-restful/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/go-training","download_url":"https://codeload.github.com/go-training/opa-restful/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248018061,"owners_count":21034048,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["open-policy-agent","restful-api"],"created_at":"2024-11-05T15:20:28.732Z","updated_at":"2025-04-09T10:11:48.038Z","avatar_url":"https://github.com/go-training.png","language":"Open Policy Agent","funding_links":[],"categories":[],"sub_categories":[],"readme":"# opa-resful\n\n[![Open Policy Agent Testing](https://github.com/go-training/opa-restful/actions/workflows/opa.yml/badge.svg)](https://github.com/go-training/opa-restful/actions/workflows/opa.yml)\n\n## System Flow\n\n![flow](./images/flow.png)\n\n## Integrating with the REST API\n\nThis document is the authoritative specification of the [OPA REST API](https://www.openpolicyagent.org/docs/latest/rest-api/).\n\n### Run Open Policy Server\n\nRun OPA server using the following command:\n\n```sh\n$ opa run --server\n{\"addrs\":[\":8181\"],\"diagnostic-addrs\":[],\"level\":\"info\",\"msg\":\"Initializing server.\",\"time\":\"2021-04-27T15:54:57+08:00\"}\n```\n\n### Upload custom data\n\nUploading the role permission and group data:\n\n```sh\ncurl -X PUT http://localhost:8181/v1/data/rbac/authz/acl --data-binary @data.json\n```\n\nSee the data with `JSON` format:\n\n```json\n{\n  \"group_roles\": {\n    \"admin\": [\"admin\"],\n    \"quality_head_design\": [\"quality_head_design\"],\n    \"quality_head_system\": [\"quality_head_system\"],\n    \"quality_head_manufacture\": [\"quality_head_manufacture\"],\n    \"kpi_editor_design\": [\"kpi_editor_design\"],\n    \"kpi_editor_system\": [\"kpi_editor_system\"],\n    \"kpi_editor_manufacture\": [\"kpi_editor_manufacture\"],\n    \"viewer\": [\"viewer\"],\n    \"viewer_limit_ds\": [\"viewer_limit_ds\"],\n    \"viewer_limit_m\": [\"viewer_limit_m\"],\n    \"design_group_kpi_editor\": [\"kpi_editor_design\", \"viewer_limit_ds\"],\n    \"system_group_kpi_editor\": [\"kpi_editor_system\", \"viewer_limit_ds\"],\n    \"manufacture_group_kpi_editor\": [\"kpi_editor_manufacture\", \"viewer\"],\n    \"project_leader\": [\"viewer_limit_ds\", \"viewer_limit_m\"]\n  },\n  \"role_permissions\": {\n    \"admin\": [\n      {\"action\": \"view_all\", \"object\": \"design\"},\n      {\"action\": \"edit\", \"object\": \"design\"},\n      {\"action\": \"view_all\", \"object\": \"system\"},\n      {\"action\": \"edit\", \"object\": \"system\"},\n      {\"action\": \"view_all\", \"object\": \"manufacture\"},\n      {\"action\": \"edit\", \"object\": \"manufacture\"}\n    ],\n    \"quality_head_design\": [\n      {\"action\": \"view_all\", \"object\": \"design\"},\n      {\"action\": \"edit\", \"object\": \"design\"},\n      {\"action\": \"view_all\", \"object\": \"system\"},\n      {\"action\": \"view_all\", \"object\": \"manufacture\"}\n    ],\n    \"quality_head_system\": [\n      {\"action\": \"view_all\", \"object\": \"design\"},\n      {\"action\": \"view_all\", \"object\": \"system\"},\n      {\"action\": \"edit\", \"object\": \"system\"},\n      {\"action\": \"view_all\", \"object\": \"manufacture\"}\n    ],\n    \"quality_head_manufacture\": [\n      {\"action\": \"view_all\", \"object\": \"design\"},\n      {\"action\": \"view_all\", \"object\": \"system\"},\n      {\"action\": \"view_all\", \"object\": \"manufacture\"},\n      {\"action\": \"edit\", \"object\": \"manufacture\"}\n    ],\n    \"kpi_editor_design\": [\n      {\"action\": \"view_all\", \"object\": \"design\"},\n      {\"action\": \"edit\", \"object\": \"design\"}\n    ],\n    \"kpi_editor_system\": [\n      {\"action\": \"view_all\", \"object\": \"system\"},\n      {\"action\": \"edit\", \"object\": \"system\"}\n    ],\n    \"kpi_editor_manufacture\": [\n      {\"action\": \"view_all\", \"object\": \"manufacture\"},\n      {\"action\": \"edit\", \"object\": \"manufacture\"}\n    ],\n    \"viewer\": [\n      {\"action\": \"view_all\", \"object\": \"design\"},\n      {\"action\": \"view_all\", \"object\": \"system\"},\n      {\"action\": \"view_all\", \"object\": \"manufacture\"}\n    ],\n    \"viewer_limit_ds\": [\n      {\"action\": \"view_all\", \"object\": \"design\"},\n      {\"action\": \"view_all\", \"object\": \"system\"}\n    ],\n    \"viewer_limit_m\": [{\"action\": \"view_l3_project\", \"object\": \"manufacture\"}]\n  }\n}\n```\n\nTry to fetch group roles data:\n\n```sh\n# curl tool\n$ curl http://localhost:8181/v1/data/rbac/authz/acl/group_roles | jq\n# or bat tool\n$ bat GET http://localhost:8181/v1/data/rbac/authz/acl/group_roles\n```\n\nSee the result:\n\n```sh\n$ curl http://localhost:8181/v1/data/rbac/authz/acl/group_roles | jq\n  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current\n                                 Dload  Upload   Total   Spent    Left  Speed\n100   661  100   661    0     0   107k      0 --:--:-- --:--:-- --:--:--  107k\n{\n  \"result\": {\n    \"admin\": [\n      \"admin\"\n    ],\n    \"design_group_kpi_editor\": [\n      \"kpi_editor_design\",\n      \"viewer_limit_ds\"\n    ],\n    \"kpi_editor_design\": [\n      \"kpi_editor_design\"\n    ],\n    \"kpi_editor_manufacture\": [\n      \"kpi_editor_manufacture\"\n    ],\n    \"kpi_editor_system\": [\n      \"kpi_editor_system\"\n    ],\n    \"manufacture_group_kpi_editor\": [\n      \"kpi_editor_manufacture\",\n      \"viewer\"\n    ],\n    \"project_leader\": [\n      \"viewer_limit_ds\",\n      \"viewer_limit_m\"\n    ],\n    \"quality_head_design\": [\n      \"quality_head_design\"\n    ],\n    \"quality_head_manufacture\": [\n      \"quality_head_manufacture\"\n    ],\n    \"quality_head_system\": [\n      \"quality_head_system\"\n    ],\n    \"system_group_kpi_editor\": [\n      \"kpi_editor_system\",\n      \"viewer_limit_ds\"\n    ],\n    \"viewer\": [\n      \"viewer\"\n    ],\n    \"viewer_limit_ds\": [\n      \"viewer_limit_ds\"\n    ],\n    \"viewer_limit_m\": [\n      \"viewer_limit_m\"\n    ]\n  }\n}\n```\n\n### Upload policy data\n\n```sh\ncurl -X PUT http://localhost:8181/v1/policies/rbac.authz --data-binary @rbac.authz.rego\n```\n\nSee the rego data\n\n```rego\npackage rbac.authz\n\nimport data.rbac.authz.acl\nimport input\n\n# logic that implements RBAC.\ndefault allow = false\n\nallow {\n  # lookup the list of roles for the user\n  roles := acl.group_roles[input.user[_]]\n\n  # for each role in that list\n  r := roles[_]\n\n  # lookup the permissions list for role r\n  permissions := acl.role_permissions[r]\n\n  # for each permission\n  p := permissions[_]\n\n  # check if the permission granted to r matches the user's request\n  p == {\"action\": input.action, \"object\": input.object}\n}\n```\n\n### Testing your input\n\nUsing [curl](https://curl.se/) tool.\n\n```sh\ncurl -X POST http://localhost:8181/v1/data/rbac/authz/allow --data-binary @input.json\n```\n\nUsing [bat](https://github.com/astaxie/bat) tool.\n\n```sh\n$ bat POST http://localhost:8181/v1/data/rbac/authz/allow \u003c input.json\nPOST /v1/data/rbac/authz/allow HTTP/1.1\nHost: localhost:8181\nAccept: application/json\nAccept-Encoding: gzip, deflate\nContent-Type: application/json\nUser-Agent: bat/0.1.0\n\n\n{\"input\":{\"action\":\"edit\",\"object\":\"design\",\"user\":[\"design_group_kpi_editor\",\"system_group_kpi_editor\"]}}\n\n\nHTTP/1.1 200 OK\nContent-Type: application/json\nDate: Sat, 01 May 2021 08:43:30 GMT\nContent-Length: 15\n\n\n{\n  \"result\": true\n}\n```\n\nSee the input data with `JSON` format.\n\n```json\n{\n  \"input\": {\n    \"user\": [\"design_group_kpi_editor\", \"system_group_kpi_editor\"],\n    \"action\": \"edit\",\n    \"object\": \"design\"\n  }\n}\n```\n\nor testing in golang:\n\n```go\npackage main\n\nimport (\n  \"bytes\"\n  _ \"embed\"\n  \"fmt\"\n  \"io/ioutil\"\n  \"net/http\"\n  \"time\"\n)\n\n//go:embed input.json\nvar input []byte\n\nfunc main() {\n  url := \"http://localhost:8181/v1/data/rbac/authz/allow\"\n  method := \"POST\"\n\n  payload := bytes.NewReader(input)\n\n  client := \u0026http.Client{\n    Timeout: 5 * time.Second,\n  }\n  req, err := http.NewRequest(method, url, payload)\n\n  if err != nil {\n    fmt.Println(err)\n    return\n  }\n  req.Header.Add(\"Content-Type\", \"application/json\")\n\n  res, err := client.Do(req)\n  if err != nil {\n    fmt.Println(err)\n    return\n  }\n  defer res.Body.Close()\n\n  body, err := ioutil.ReadAll(res.Body)\n  if err != nil {\n    fmt.Println(err)\n    return\n  }\n  fmt.Println(string(body))\n}\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgo-training%2Fopa-restful","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgo-training%2Fopa-restful","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgo-training%2Fopa-restful/lists"}