// Copyright 2017 Istio Authors
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

// $title: OPA
// $overview: Adapter that implements an Open Policy Agent engine
// $location: https://istio.io/docs/reference/config/adapters/opa.html

// The `opa` adapter exposes an [Open Policy Agent](http://www.openpolicyagent.org) engine
// that provides sophisticated access control mechanisms.
package adapter.opa.config;

import "gogoproto/gogo.proto";

option go_package="config";
option (gogoproto.goproto_getters_all) = false;
option (gogoproto.equal_all) = false;
option (gogoproto.gostring_all) = false;

// Configuration format for the `opa` adapter.
//
// Example configuration:
// ```
// policy:
//   - |+
//     package mixerauthz
//     policy = [
//       {
//         "rule": {
//           "verbs": [
//             "storage.buckets.get"
//           ],
//           "users": [
//             "bucket-admins"
//           ]
//         }
//       }
//     ]
//
//     default allow = false
//
//     allow = true {
//       rule = policy[_].rule
//       input.subject.user = rule.users[_]
//       input.action.method = rule.verbs[_]
//     }
// checkMethod: "data.mixerauthz.allow"
// failClose: true
// ```
message Params {
  // List of OPA policies
  repeated string policy = 1;

  // Query method to check.
  // Format: data.<package name>.<method name>
  string check_method = 2;

  // Close the client request when adapter has a issue.
  // If failClose is set to true and there is a runtime error,
  // instead of disabling the adapter, close the client request
  bool fail_close = 3;
}
