feat(policy): add policies for Tiled authz

Author: DiamondJoseph

policy/diamond/policy/session/session.rego

@@ -55,3 +55,12 @@ write_to_beamline_visit if {
 	access
 	matches_beamline
 }
+
+user_sessions contains user_session if {
+	some session in data.diamond.data.sessions
+	access_session(token.claims.fedid, session.proposal_number, session.visit_number)
+	user_session := sprintf(
+		`{"proposal": %d, "visit": %d, "beamline": "%s"}`,
+		[session.proposal_number, session.visit_number, session.beamline],
+	)
+}

policy/diamond/policy/session/session_test.rego

@@ -20,6 +20,16 @@ diamond_data := {
 			"proposals": [],
 			"sessions": [],
 		},
+		"desmond": {
+			"permissions": [],
+			"proposals": [2],
+			"sessions": [13],
+		},
+		"edna": {
+			"permissions": [],
+			"proposals": [2],
+			"sessions": [13, 14],
+		},
 		"oscar": {
 			"permissions": [],
 			"proposals": [],
@@ -37,12 +47,28 @@ diamond_data := {
 			"proposal_number": 1,
 			"visit_number": 2,
 		},
+		"13": {
+			"beamline": "b07",
+			"proposal_number": 2,
+			"visit_number": 1,
+		},
+		"14": {
+			"beamline": "b07",
+			"proposal_number": 2,
+			"visit_number": 2,
+		},
+	},
+	"proposals": {
+		"1": {"sessions": {
+			"1": 11,
+			"2": 12,
+		}},
+		"2": {"sessions": {
+			"1": 13,
+			"2": 14,
+		}},
 	},
-	"proposals": {"1": {"sessions": {
-		"1": 11,
-		"2": 12,
-	}}},
-	"beamlines": {"i03": {"sessions": [11]}, "b07": {"sessions": [12]}},
+	"beamlines": {"i03": {"sessions": [11]}, "b07": {"sessions": [12, 13, 14]}},
 	"admin": {"b07_admin": ["b07"]},
 }
 
@@ -181,3 +207,37 @@ test_session_beamline if {
 		with data.diamond.data as diamond_data
 	bl2 == "b07"
 }
+
+test_user_session_tags if {
+	session.user_sessions == set() with data.diamond.data as diamond_data
+		with data.diamond.policy.token.claims as {"fedid": "oscar"}
+	session.user_sessions == {
+		`{"proposal": 1, "visit": 2, "beamline": "b07"}`,
+		`{"proposal": 1, "visit": 1, "beamline": "i03"}`,
+	} with data.diamond.data as diamond_data
+		with data.diamond.policy.token.claims as {"fedid": "alice"}
+	session.user_sessions == {
+		`{"proposal": 1, "visit": 2, "beamline": "b07"}`,
+		`{"proposal": 1, "visit": 1, "beamline": "i03"}`,
+		`{"proposal": 2, "visit": 1, "beamline": "b07"}`,
+		`{"proposal": 2, "visit": 2, "beamline": "b07"}`,
+	} with data.diamond.data as diamond_data
+		with data.diamond.policy.token.claims as {"fedid": "bob"}
+	session.user_sessions == {
+		`{"proposal": 1, "visit": 2, "beamline": "b07"}`,
+		`{"proposal": 1, "visit": 1, "beamline": "i03"}`,
+		`{"proposal": 2, "visit": 1, "beamline": "b07"}`,
+		`{"proposal": 2, "visit": 2, "beamline": "b07"}`,
+	} with data.diamond.data as diamond_data
+		with data.diamond.policy.token.claims as {"fedid": "carol"}
+	session.user_sessions == {
+		`{"proposal": 2, "visit": 1, "beamline": "b07"}`,
+		`{"proposal": 2, "visit": 2, "beamline": "b07"}`,
+	} with data.diamond.data as diamond_data
+		with data.diamond.policy.token.claims as {"fedid": "desmond"}
+	session.user_sessions == {
+		`{"proposal": 2, "visit": 1, "beamline": "b07"}`,
+		`{"proposal": 2, "visit": 2, "beamline": "b07"}`,
+	} with data.diamond.data as diamond_data
+		with data.diamond.policy.token.claims as {"fedid": "edna"}
+}

policy/diamond/policy/tiled/tiled.rego

@@ -0,0 +1,33 @@
+package diamond.policy.tiled
+
+import data.diamond.policy.token
+
+read_scopes := {
+	"read:metadata",
+	"read:data",
+}
+
+write_scopes := {
+	"write:metadata",
+	"write:data",
+	"create",
+	"register",
+}
+
+scopes_for(claims) := read_scopes | write_scopes if {
+	"azp" in object.keys(claims)
+	endswith(claims.azp, "-blueapi")
+}
+
+scopes_for(claims) := read_scopes if {
+	"azp" in object.keys(claims)
+	not endswith(claims.azp, "-blueapi")
+}
+
+scopes_for(claims) := read_scopes if {
+	not "azp" in object.keys(claims)
+}
+
+default scopes := set()
+
+scopes := scopes_for(token.claims)

policy/diamond/policy/tiled/tiled_test.rego

@@ -0,0 +1,26 @@
+package diamond.policy.tiled_test
+
+import data.diamond.policy.tiled
+import data.diamond.policy.token
+import rego.v1
+
+test_default_no_scopes if {
+	tiled.scopes == set()
+}
+
+test_wrong_azp_read_scopes if {
+	tiled.scopes == tiled.read_scopes with token.claims as {}
+	tiled.scopes == tiled.read_scopes with token.claims as {"sub": "foo"}
+	tiled.scopes == tiled.read_scopes with token.claims as {"azp": "foo"}
+}
+
+test_blueapi_given_write_scopes if {
+	tiled.scopes == {
+		"read:metadata",
+		"read:data",
+		"write:metadata",
+		"write:data",
+		"create",
+		"register",
+	} with token.claims as {"azp": "foo-blueapi"}
+}