Helper rules

helper_rules.rego

package policy

import future.keywords.if
import future.keywords.in

default allow := false

allow if {
    # User attempting to access internal resource
    # i.e. something under /internal
    input.request.path[0] == "internal"
    
    # User must work for AcmeCorp, Hooli, or Lexcorp
    valid_email
    
    # And user must have the "acmecorp-internal" role
    "acmecorp-internal" in input.user.roles
}

valid_email if endswith(input.user.email, "acmecorp.com")
valid_email if endswith(input.user.email, "hooli.com")
valid_email if endswith(input.user.email, "lexcorp.com")