From 5941c48b866463154429e816fae77f7b0b1082a3 Mon Sep 17 00:00:00 2001 From: Mohid Sheraz Date: Fri, 17 Jul 2026 17:16:11 +0530 Subject: [PATCH] fix: Use system field in OPA policies Signed-off-by: Mohid Sheraz --- policy/assignment/list.rego | 4 ++-- policy/assignment/list_test.rego | 2 +- policy/auth/project/list.rego | 4 ++-- policy/auth/project/list_test.rego | 2 +- policy/auth/token/show.rego | 4 ++-- policy/auth/token/show_test.rego | 4 ++-- policy/endpoint/list.rego | 4 ++-- policy/endpoint/list_test.rego | 4 ++-- policy/endpoint/show.rego | 4 ++-- policy/endpoint/show_test.rego | 4 ++-- policy/service/list.rego | 4 ++-- policy/service/list_test.rego | 4 ++-- policy/service/show.rego | 4 ++-- policy/service/show_test.rego | 4 ++-- 14 files changed, 26 insertions(+), 26 deletions(-) diff --git a/policy/assignment/list.rego b/policy/assignment/list.rego index b3ec2e189..02d904d44 100644 --- a/policy/assignment/list.rego +++ b/policy/assignment/list.rego @@ -31,8 +31,8 @@ allow if { # description: "'reader' in the system scope can list any role assignments." allow if { "reader" in input.credentials.roles - input.credentials.system_scope != null - "all" == input.credentials.system_scope + input.credentials.system != null + "all" == input.credentials.system } # METADATA diff --git a/policy/assignment/list_test.rego b/policy/assignment/list_test.rego index bd37a691c..4ad6a464b 100644 --- a/policy/assignment/list_test.rego +++ b/policy/assignment/list_test.rego @@ -4,7 +4,7 @@ import data.identity.assignment.list test_allowed if { list.allow with input as {"credentials": {"roles": ["admin"]}} - list.allow with input as {"credentials": {"roles": ["reader"], "system_scope": "all"}} + list.allow with input as {"credentials": {"roles": ["reader"], "system": "all"}} list.allow with input as { "credentials": {"roles": ["admin"], "domain_id": "domain_a"}, "target": {"assignment": {"domain_id": "domain_b"}}, diff --git a/policy/auth/project/list.rego b/policy/auth/project/list.rego index 077d1f2ca..5b1a0a19f 100644 --- a/policy/auth/project/list.rego +++ b/policy/auth/project/list.rego @@ -19,6 +19,6 @@ allow if { allow if { "reader" in input.credentials.roles - input.credentials.system_scope != null - "all" == input.credentials.system_scope + input.credentials.system != null + "all" == input.credentials.system } diff --git a/policy/auth/project/list_test.rego b/policy/auth/project/list_test.rego index 3587c5694..0aa6cc535 100644 --- a/policy/auth/project/list_test.rego +++ b/policy/auth/project/list_test.rego @@ -4,7 +4,7 @@ import data.identity.auth.project.list test_allowed if { list.allow with input as {"credentials": {"roles": ["admin"]}} - list.allow with input as {"credentials": {"roles": ["reader"], "system_scope": "all"}} + list.allow with input as {"credentials": {"roles": ["reader"], "system": "all"}} list.allow with input as {"credentials": {"roles": []}} list.allow with input as {"credentials": {"roles": ["reader"]}} } diff --git a/policy/auth/token/show.rego b/policy/auth/token/show.rego index 63a9924f5..007f2021e 100644 --- a/policy/auth/token/show.rego +++ b/policy/auth/token/show.rego @@ -37,8 +37,8 @@ allow if { # description: "'reader' in the system scope can inspect tokens" allow if { "reader" in input.credentials.roles - input.credentials.system_scope != null - "all" == input.credentials.system_scope + input.credentials.system != null + "all" == input.credentials.system } # METADATA diff --git a/policy/auth/token/show_test.rego b/policy/auth/token/show_test.rego index 0da78b524..fdd560ec7 100644 --- a/policy/auth/token/show_test.rego +++ b/policy/auth/token/show_test.rego @@ -5,13 +5,13 @@ import data.identity.auth.token.show test_allowed if { show.allow with input as {"credentials": {"roles": ["admin"]}} show.allow with input as {"credentials": {"roles": ["service"]}} - show.allow with input as {"credentials": {"roles": ["reader"], "system_scope": "all"}} + show.allow with input as {"credentials": {"roles": ["reader"], "system": "all"}} show.allow with input as {"credentials": {"user_id": "foo"}, "existing": {"token": {"user": {"id": "foo"}}}} show.allow with input as {"credentials": {"roles": ["admin"], "user_id": "foo"}, "existing": {"token": {"user": {"id": "bar"}}}} } test_forbidden if { - not show.allow with input as {"credentials": {"roles": ["reader"], "system_scope": "not_all"}} + not show.allow with input as {"credentials": {"roles": ["reader"], "system": "not_all"}} not show.allow with input as {"credentials": {"roles": ["manager"], "user_id": "foo"}, "existing": {"token": {"user": {"id": "bar"}}}} not show.allow with input as {"credentials": {"roles": ["member"], "user_id": "foo"}, "existing": {"token": {"user": {"id": "bar"}}}} not show.allow with input as {"credentials": {"roles": ["reader"], "user_id": "foo"}, "existing": {"token": {"user": {"id": "bar"}}}} diff --git a/policy/endpoint/list.rego b/policy/endpoint/list.rego index 899067b52..6d8340281 100644 --- a/policy/endpoint/list.rego +++ b/policy/endpoint/list.rego @@ -30,6 +30,6 @@ allow if { # description: "'reader' in the system scope can list any endpoints." allow if { "reader" in input.credentials.roles - input.credentials.system_scope != null - "all" == input.credentials.system_scope + input.credentials.system != null + "all" == input.credentials.system } diff --git a/policy/endpoint/list_test.rego b/policy/endpoint/list_test.rego index 397cb5c19..1c72cfff5 100644 --- a/policy/endpoint/list_test.rego +++ b/policy/endpoint/list_test.rego @@ -5,12 +5,12 @@ import data.identity.endpoint.list test_allowed if { list.allow with input as {"credentials": {"roles": ["admin"]}} list.allow with input as {"credentials": {"is_admin": true}} - list.allow with input as {"credentials": {"roles": ["reader"], "system_scope": "all"}} + list.allow with input as {"credentials": {"roles": ["reader"], "system": "all"}} } test_forbidden if { not list.allow with input as {"credentials": {"roles": []}} not list.allow with input as {"credentials": {"roles": ["reader"]}} - not list.allow with input as {"credentials": {"roles": ["reader"], "system_scope": "domain"}} + not list.allow with input as {"credentials": {"roles": ["reader"], "system": "domain"}} not list.allow with input as {"credentials": {"roles": ["manager"]}} } diff --git a/policy/endpoint/show.rego b/policy/endpoint/show.rego index 95b6e221b..51361a6e6 100644 --- a/policy/endpoint/show.rego +++ b/policy/endpoint/show.rego @@ -33,6 +33,6 @@ allow if { # description: "'reader' in the system scope can show any endpoint." allow if { "reader" in input.credentials.roles - input.credentials.system_scope != null - "all" == input.credentials.system_scope + input.credentials.system != null + "all" == input.credentials.system } diff --git a/policy/endpoint/show_test.rego b/policy/endpoint/show_test.rego index efa4a63bc..2a07e5045 100644 --- a/policy/endpoint/show_test.rego +++ b/policy/endpoint/show_test.rego @@ -5,12 +5,12 @@ import data.identity.endpoint.show test_allowed if { show.allow with input as {"credentials": {"roles": ["admin"]}} show.allow with input as {"credentials": {"is_admin": true}} - show.allow with input as {"credentials": {"roles": ["reader"], "system_scope": "all"}} + show.allow with input as {"credentials": {"roles": ["reader"], "system": "all"}} } test_forbidden if { not show.allow with input as {"credentials": {"roles": []}} not show.allow with input as {"credentials": {"roles": ["reader"]}} - not show.allow with input as {"credentials": {"roles": ["reader"], "system_scope": "domain"}} + not show.allow with input as {"credentials": {"roles": ["reader"], "system": "domain"}} not show.allow with input as {"credentials": {"roles": ["manager"]}} } diff --git a/policy/service/list.rego b/policy/service/list.rego index 7f581b622..e7abef44d 100644 --- a/policy/service/list.rego +++ b/policy/service/list.rego @@ -29,6 +29,6 @@ allow if { # description: "'reader' in the system scope can list any services." allow if { "reader" in input.credentials.roles - input.credentials.system_scope != null - "all" == input.credentials.system_scope + input.credentials.system != null + "all" == input.credentials.system } diff --git a/policy/service/list_test.rego b/policy/service/list_test.rego index c69f4d045..d7f4d548d 100644 --- a/policy/service/list_test.rego +++ b/policy/service/list_test.rego @@ -5,12 +5,12 @@ import data.identity.service.list test_allowed if { list.allow with input as {"credentials": {"roles": ["admin"]}} list.allow with input as {"credentials": {"is_admin": true}} - list.allow with input as {"credentials": {"roles": ["reader"], "system_scope": "all"}} + list.allow with input as {"credentials": {"roles": ["reader"], "system": "all"}} } test_forbidden if { not list.allow with input as {"credentials": {"roles": []}} not list.allow with input as {"credentials": {"roles": ["reader"]}} - not list.allow with input as {"credentials": {"roles": ["reader"], "system_scope": "domain"}} + not list.allow with input as {"credentials": {"roles": ["reader"], "system": "domain"}} not list.allow with input as {"credentials": {"roles": ["manager"]}} } diff --git a/policy/service/show.rego b/policy/service/show.rego index 0e2741a65..8c3638fd7 100644 --- a/policy/service/show.rego +++ b/policy/service/show.rego @@ -31,6 +31,6 @@ allow if { # description: "'reader' in the system scope can show any service." allow if { "reader" in input.credentials.roles - input.credentials.system_scope != null - "all" == input.credentials.system_scope + input.credentials.system != null + "all" == input.credentials.system } diff --git a/policy/service/show_test.rego b/policy/service/show_test.rego index e067d778b..f9594fb63 100644 --- a/policy/service/show_test.rego +++ b/policy/service/show_test.rego @@ -5,12 +5,12 @@ import data.identity.service.show test_allowed if { show.allow with input as {"credentials": {"roles": ["admin"]}} show.allow with input as {"credentials": {"is_admin": true}} - show.allow with input as {"credentials": {"roles": ["reader"], "system_scope": "all"}} + show.allow with input as {"credentials": {"roles": ["reader"], "system": "all"}} } test_forbidden if { not show.allow with input as {"credentials": {"roles": []}} not show.allow with input as {"credentials": {"roles": ["reader"]}} - not show.allow with input as {"credentials": {"roles": ["reader"], "system_scope": "domain"}} + not show.allow with input as {"credentials": {"roles": ["reader"], "system": "domain"}} not show.allow with input as {"credentials": {"roles": ["manager"]}} }