Azure APIM policy

rules.rego

package rules

import future.keywords.if

default allow = false

# allow everything unless denied
allow if not deny

# deny feedback posts without a valid JWT
deny {
  input.request.method == "POST"
  input.request.parsed_path[3] == "feedback"
  not claims
}

# Decode and verify the JWT and get claims
claims := payload {
  [valid, _, payload] := io.jwt.decode_verify(bearer_token, data.secret)
  valid
}

# Access the JWT in the bearer token
bearer_token := t {
  v := input.request.headers.authorization
  startswith(v, "Bearer ")
  t := substring(v, count("Bearer "), -1)
}