chore: Move the token validation policy to new name

policy/federation/token/check.rego → policy/auth/token/show.rego

@@ -1,8 +1,8 @@
-package identity.check_token
+package identity.auth.token.show
 
 import data.identity
 
-# Update mapping.
+# Validate the token
 
 default allow := false
 
@@ -11,14 +11,16 @@ allow if {
 }
 
 allow if {
-	"reader" in input.credentials.roles
-	"all" in input.credentials.system_scope
+	"service" in input.credentials.roles
 }
 
 allow if {
-	identity.token_subject
+	"reader" in input.credentials.roles
+	input.credentials.system_scope != null
+	"all" == input.credentials.system_scope
 }
 
 allow if {
-	"service" in input.credentials.roles
+	identity.token_subject
 }
+

policy/auth/token/show_test.rego

@@ -0,0 +1,19 @@
+
+package test_auth_token_show
+
+import data.identity.auth.token.show
+
+test_allowed if {
+	show.allow with input as {"credentials": {"roles": ["admin"]}}
+	show.allow with input as {"credentials": {"roles": ["service"]}}
+	show.allow with input as {"credentials": {"roles": ["reader"], "system_scope": "all"}}
+	show.allow with input as {"credentials": {"user_id": "foo"}, "target": {"token": {"user_id": "foo"}}}
+	show.allow with input as {"credentials": {"roles": ["admin"], "user_id": "foo"}, "target": {"token": {"user_id": "bar"}}}
+}
+
+test_forbidden if {
+	not show.allow with input as {"credentials": {"roles": ["reader"], "system_scope": "not_all"}}
+	not show.allow with input as {"credentials": {"roles": ["manager"], "user_id": "foo"}, "target": {"token": {"user_id": "bar"}}}
+	not show.allow with input as {"credentials": {"roles": ["member"], "user_id": "foo"}, "target": {"token": {"user_id": "bar"}}}
+	not show.allow with input as {"credentials": {"roles": ["reader"], "user_id": "foo"}, "target": {"token": {"user_id": "bar"}}}
+}

src/api/v3/auth/token/mod.rs

@@ -257,7 +257,7 @@ async fn show(
 
     policy
         .enforce(
-            "identity/validate_token",
+            "identity/auth/token/show",
             &user_auth,
             to_value(json!({"token": &token}))?,
             None,