// Copyright 2017 Istio Authors
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

// $title: Authorization
// $description: A template used to represent an access control query.
// $location: https://istio.io/docs/reference/config/policy-and-telemetry/templates/authorization.html
// $aliases:
// $  - /docs/reference/config/template/authorization.html

// The `authorization` template defines parameters for performing policy
// enforcement within Istio. It is primarily concerned with enabling Mixer
//
// Example config:
//
// ```yaml
// apiVersion: "config.istio.io/v1alpha2"
// kind: instance
// metadata:
//   name: authinfo
//   namespace: istio-system
// spec:
//   compiledTemplate: authorization
//   params:
//     subject:
//       user: source.principal | request.auth.principal | ""
//       groups: request.auth.claims["groups"] | ""
//       properties:
//         iss: request.auth.claims["iss"]
//     action:
//       namespace: destination.namespace | "default"
//       service: destination.service.host | ""
//       path: request.path | "/"
//       method: request.method | "post"
//       properties:
//         version: destination.labels[version] | ""
// ```
package authorization;

import "policy/v1beta1/type.proto";
import "mixer/adapter/model/v1beta1/extensions.proto";

option (istio.mixer.adapter.model.v1beta1.template_variety) = TEMPLATE_VARIETY_CHECK;

// A subject contains a list of attributes that identify
// the caller identity.
message Subject {
  // The user name/ID that the subject represents.
  string user = 1;
  // Groups the subject belongs to depending on the authentication mechanism,
  // "groups" are normally populated from JWT claim or client certificate.
  // The operator can define how it is populated when creating an instance of
  // the template.
  string groups = 2;
  // Additional attributes about the subject.
  map<string, istio.policy.v1beta1.Value> properties = 3;
}

// An action defines "how a resource is accessed".
message Action {
  // Namespace the target action is taking place in.
  string namespace = 1;
  // The Service the action is being taken on.
  string service = 2;
  // What action is being taken.
  string method = 3;
  // HTTP REST path within the service
  string path = 4;
  // Additional data about the action for use in policy.
  map<string, istio.policy.v1beta1.Value> properties = 5;
}

// The `authorization` template defines parameters for performing policy
// enforcement within Istio. It is primarily concerned with enabling Mixer
// adapters to make decisions about who is allowed to do what.
// In this template, the "who" is defined in a Subject message. The "what" is
// defined in an Action message. During a Mixer Check call, these values
// will be populated based on configuration from request attributes and
// passed to individual authorization adapters to adjudicate.
message Template {
  // A subject contains a list of attributes that identify
  // the caller identity.
  Subject subject = 1;
  // An action defines "how a resource is accessed".
  Action action = 2;
}
