OPA — Open Policy Agent · DataFlow Analytics

package dataflow.authz

import rego.v1

# ─────────────────────────────────────────────────────
# DataFlow Analytics — Política de autorización central
# Roles: admin | manager | analyst | viewer
# ─────────────────────────────────────────────────────

# Denegar por defecto (principio de mínimo privilegio)
default allow := false

# ── Admins tienen acceso total ──────────────────────
allow if {
    input.user.role == "admin"
}

# ── GET /reports — todos los roles ──────────────────
allow if {
    input.method == "GET"
    input.path[0] == "reports"
    count(input.path) == 1
    input.user.role in {"viewer", "analyst", "manager", "admin"}
}

# ── POST /reports — analyst, manager, admin ──────────
allow if {
    input.method == "POST"
    input.path[0] == "reports"
    input.user.role in {"analyst", "manager", "admin"}
}

# ── DELETE /reports/:id — solo admin ─────────────────
allow if {
    input.method == "DELETE"
    input.path[0] == "reports"
    input.user.role == "admin"
}

# ── GET /exports/:reportId — manager, admin ──────────
allow if {
    input.method == "GET"
    input.path[0] == "exports"
    input.user.role in {"manager", "admin"}
}

# ── POST /exports — solo admin ────────────────────────
allow if {
    input.method == "POST"
    input.path[0] == "exports"
    input.user.role == "admin"
}

# ── PATCH /users/:id/role — admin, no puede cambiarse a sí mismo ──
allow if {
    input.method == "PATCH"
    input.path[0] == "users"
    input.path[2] == "role"
    input.user.role == "admin"
    input.path[1] != input.user.id  # Nunca cambiar el propio rol
}

# ── GET /billing — solo admin ─────────────────────────
allow if {
    input.method == "GET"
    input.path[0] == "billing"
    input.user.role == "admin"
}

# ── Razones de denegación para audit log ─────────────
reasons contains msg if {
    not allow
    msg := sprintf(
        "[DENIED] user=%s role=%s method=%s path=%s",
        [input.user.id, input.user.role, input.method, concat("/", input.path)]
    )
}

package dataflow.authz_test

import rego.v1

# Viewer puede listar informes
test_viewer_can_list_reports if {
    allow with input as {
        "method": "GET", "path": ["reports"],
        "user": {"id": "u1", "role": "viewer"}
    }
}

# Viewer NO puede crear informes
test_viewer_cannot_create_reports if {
    not allow with input as {
        "method": "POST", "path": ["reports"],
        "user": {"id": "u1", "role": "viewer"}
    }
}

# Admin NO puede cambiar su propio rol
test_admin_cannot_change_own_role if {
    not allow with input as {
        "method": "PATCH", "path": ["users", "admin-42", "role"],
        "user": {"id": "admin-42", "role": "admin"}
    }
}

# Manager puede descargar exportaciones
test_manager_can_download_export if {
    allow with input as {
        "method": "GET", "path": ["exports", "rpt-99"],
        "user": {"id": "mgr-7", "role": "manager"}
    }
}

# Ejecutar: opa test policy/ -v

package terraform.dataflow

import rego.v1

# ── Bloquear S3 buckets públicos ─────────────────────
deny contains msg if {
    resource := input.resource_changes[_]
    resource.type == "aws_s3_bucket"
    resource.change.after.acl == "public-read"
    msg := sprintf(
        "[BLOQUEADO] S3 bucket %s no puede ser público (violación SOC 2)",
        [resource.address]
    )
}

# ── Cifrado obligatorio en RDS ────────────────────────
deny contains msg if {
    resource := input.resource_changes[_]
    resource.type == "aws_db_instance"
    not resource.change.after.storage_encrypted
    msg := sprintf(
        "[BLOQUEADO] RDS %s debe tener storage_encrypted=true (ISO 27001)",
        [resource.address]
    )
}

# ── Tipos de instancia permitidos (control de costes) ─
deny contains msg if {
    resource := input.resource_changes[_]
    resource.type == "aws_instance"
    not resource.change.after.instance_type in allowed_types
    msg := sprintf(
        "[BLOQUEADO] EC2 %s usa %s — permitidos: %v",
        [resource.address,
         resource.change.after.instance_type,
         allowed_types]
    )
}

allowed_types := {"t3.micro", "t3.small", "t3.medium", "m5.large"}

# Validar: terraform plan -out=plan.tfplan
# terraform show -json plan.tfplan > plan.json
# opa eval -d policy/ -i plan.json "data.terraform.dataflow.deny"

import type { Request, Response, NextFunction } from "express";

const OPA_URL = process.env.OPA_URL ?? "http://opa:8181";
const POLICY  = "v1/data/dataflow/authz/allow";

interface OpaInput {
  method : string;
  path   : string[];
  user   : { id: string; role: string; teams?: string[] };
  body  ?: unknown;
}

export async function authorize(
  req: Request, res: Response, next: NextFunction
): Promise<void> {
  const input: OpaInput = {
    method : req.method,
    path   : req.path.split("/").filter(Boolean),
    user   : {
      id   : req.user?.id   ?? "anonymous",
      role : req.user?.role ?? "viewer",
      teams: req.user?.teams ?? [],
    },
    body: req.body,
  };

  const response = await fetch(`${OPA_URL}/${POLICY}`, {
    method : "POST",
    headers: { "Content-Type": "application/json" },
    body   : JSON.stringify({ input }),
  });

  const { result } = await response.json();

  if (result) {
    next();
  } else {
    // Obtener razón del audit log
    const rRes = await fetch(
      `${OPA_URL}/v1/data/dataflow/authz/reasons`, {
        method: "POST",
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({ input }),
      }
    );
    const { result: reasons } = await rRes.json();
    console.warn("[OPA]", reasons?.[0] ?? "Access denied");
    res.status(403).json({
      error  : "Forbidden",
      message: "No tienes permisos para realizar esta acción"
    });
  }
}

// Uso en app.ts:
// import { authorize } from "./middleware/opa-authz";
// app.use(authorize);