http-authz-policy-middleware/examples/combined-rules.yml at main · andrewkroh/http-authz-policy-middleware · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
# Combined rules with complex boolean logic example
#
# This configuration demonstrates complex access control combining
# multiple conditions with AND/OR/NOT operators.
#
# Use case: Fine-grained access control with multiple criteria

http:
  routers:
    admin-api-router:
      rule: "Host(`admin.example.com`)"
      service: admin-service
      middlewares:
        - admin-authz

  middlewares:
    admin-authz:
      plugin:
        http-authz-policy-middleware:
          # Complex authorization logic:
          # 1. Admin API paths require admin role
          # 2. OR user must be in platform-eng team AND using safe methods
          # 3. Never allow DELETE method
          expression: |
            (
              (path startsWith "/admin" AND contains(headerList("X-Auth-User-Roles"), "admin"))
              OR
              (
                contains(headerList("X-Auth-User-Teams"), "platform-eng")
                AND
                (method == "GET" OR method == "HEAD")
              )
            )
            AND
            NOT method == "DELETE"

          denyStatusCode: 403
          denyBody: "Access denied: insufficient permissions"

          tests:
            - name: "admin role can access /admin"
              request:
                method: "POST"
                path: "/admin/users"
                headers:
                  X-Auth-User-Roles: "admin,user"
              expect: true

            - name: "platform-eng GET allowed"
              request:
                method: "GET"
                path: "/api/metrics"
                headers:
                  X-Auth-User-Teams: "platform-eng"
              expect: true

            - name: "platform-eng POST denied"
              request:
                method: "POST"
                path: "/api/metrics"
                headers:
                  X-Auth-User-Teams: "platform-eng"
              expect: false

            - name: "DELETE always denied"
              request:
                method: "DELETE"
                path: "/admin/users"
                headers:
                  X-Auth-User-Roles: "admin"
              expect: false

            - name: "no credentials denied"
              request:
                method: "GET"
                path: "/api/metrics"
                headers: {}
              expect: false

  services:
    admin-service:
      loadBalancer:
        servers:
          - url: "http://admin-backend:8080"