-
Notifications
You must be signed in to change notification settings - Fork 16
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
documentation/core: better rego documentation #1311
Comments
I will take a first stab at this and then we can move it or reformat it. |
ReferenceOutputsAuthorization policy written in Rego is expected to return results in # a policy that always allows access
allow := true # a policy that always denies access
deny := true Access is granted according to the same rules as PPL:
The reason is useful for debugging since it appears in authorize logs. There are also 2 special reasons used to trigger functionality in Pomerium:
InputsRego scripts are evaluated with inputs available on the allow if input.http.method == "POST" The following inputs are defined:
FunctionsThe following additional functions are available in rego scripts:
|
@ZPain8464 hopefully that's enough to work with. Let me know if anything needs clarification. Thanks! |
@calebdoxsey I appreciate the effort here. I'll take a look at this soon and let you know if I need any more details. Thanks :) |
Currently we have some documentation on using rego directly: https://www.pomerium.com/docs/capabilities/authorization#rego-support
However we don't document what the inputs and outputs are for policy evaluation. Without this information its hard to write correct policy. We should expand the documentation to include this reference information.
The text was updated successfully, but these errors were encountered: