anderseknert

package p

import future.keywords

global := "foo"

allow if {
	a := global
	b := [c | c := input[x]] # can't capture x

anderseknert

ClojureCLR Notes

Some random notes from using ClojureCLR (.NET Core version) on Mac OS. YMMV, obviously :)

REPL

The REPL provided by Clojure.Main does not support niceties like history, or even using arrow keys to move around while editing. On Linux and Mac, this may be solved by rlwrap, which is also used to enhance the built-in REPL in JVM Clojure (included in the clj script). To create a similar wrapper for Clojure.Main, you can create a cljr script (and place it somewhere on $PATH) as follows:

anderseknert

{
    "funcs": {
        "funcs": [
            {
                "name": "g0.data.policy.is_admin",
                "params": [
                    0,
                    1
                ],
                "return": 2,

anderseknert

{
    "plans": {
        "plans": [
            {
                "name": "policy/allow",
                "blocks": [
                    {
                        "stmts": [
                            {
                                "type": "CallStmt",

anderseknert

{
    "static": {
        "strings": [{"value": "result"}, {"value": "user"}, {"value": "roles"}, {"value": "admin"}],
        "builtin_funcs": [
            {
                "name": "internal.member_2",
                "decl": {
                    "args": [{"type": "any"}, {"type": "any"}],
                    "result": {"type": "boolean"},
                    "type": "function"

anderseknert

package policy

import future.keywords.if
import future.keywords.in

allow if is_admin

is_admin if "admin" in input.user.roles

anderseknert

package policy

# Note the use of the allowed is_object function here
response := is_object({
    "method": "GET",
    "url": "https://www.openpolicyagent.org"
})

# This would work (and send a HTTP request) even though
# the http.send built-in function had been declared unsafe

anderseknert

#!/usr/bin/env python3

import json
import os
import subprocess
import tempfile
import yaml


yaml.SafeDumper.org_represent_str = yaml.SafeDumper.represent_str

anderseknert

deny["S3 Bucket: 'AccessControl' attribute value must be 'Private'"] {
    not bucket_is_private
}

anderseknert

bucket_is_private {
    input.resource.properties.AccessControl == "Private"
}