Policy set IRN library

Ironflow adds the package ironflow.lib.irn to every policy set on the server. It is written in Rego, not in Go, so that stock opa test can run on your files. ironflow policy pull writes the same file to .ironflow/lib/irn.rego.

The package follows the IRN grammar of Ironflow (ADR 0089). A conformance test runs one table of vectors through the Go matcher and through this library. Any mismatch fails the build.

The namespace data.ironflow.* is reserved. You cannot declare a package there, except ironflow.authz and ironflow.authz_test.

Import

package ironflow.authz

import data.ironflow.lib.irn

deny contains "members cannot touch production functions" if {
  "member" in input.subject.roles
  irn.match("irn:ironflow:*:*:function:env_prod:*", input.request.resource)
}

Functions

irn.match(pattern, resource)

True when the IRN resource matches the IRN pattern.

• A pattern of * matches any resource.
• Otherwise both values are split on :. They must have the same number of segments. A segment of * in the pattern matches any one segment. Other segments must be equal.
• Both arguments must be strings. Otherwise the function is undefined.

Pattern	Resource	Result
*	irn:ironflow:o:p:run:e:r1	true
irn:ironflow:o:p:run:e:*	irn:ironflow:o:p:run:e:r1	true
irn:ironflow:*:*:run:*:*	irn:ironflow:o:p:run:e:r1	true
irn:ironflow:o:p:run:e:r2	irn:ironflow:o:p:run:e:r1	false
irn:ironflow:o:p:run:e	irn:ironflow:o:p:run:e:r1	false (segment counts differ)
irn:ironflow:o:p:function:e:*	irn:ironflow:o:p:run:e:r1	false
**	irn:ironflow:o:p:run:e:r1	false
an empty string	any IRN	false

A * stands for one whole segment. irn:ironflow:o:p:run:e:r* does not match by prefix.

irn.match_resource(patterns, resource)

True when resource matches any of the comma-separated patterns. Spaces around a pattern are trimmed.

package ironflow.authz

import data.ironflow.lib.irn

deny contains "no access to production functions or secrets" if {
  irn.match_resource("irn:ironflow:*:*:function:env_prod:*, irn:ironflow:*:*:secret:env_prod:*", input.request.resource)
  "contractor" in input.subject.roles
}

irn.match_action(patterns, action)

True when action matches any of the comma-separated patterns. A pattern matches when it is:

• *
• equal to the action
• a prefix with a trailing :*, for example runs:*, which matches runs:read and runs:cancel

package ironflow.authz

import data.ironflow.lib.irn

deny contains "contractors cannot write" if {
  irn.match_action("runs:*,events:emit", input.request.action)
  "contractor" in input.subject.roles
}

IRN format

An IRN has seven segments: irn:ironflow:{org}:{project}:{type}:{env}:{id}. Raw event names and invoked function IDs are encoded once: literal % becomes %25, then : becomes %3A. For example, the function team:fn-a is irn:ironflow:org_acme:proj_default:function:env_default:team%3Afn-a. The literal function ID team%3Afn-a instead has the last segment team%253Afn-a.

The library compares encoded segments byte-for-byte. It does not percent-decode or accept the former colon-only encoding as an alternative. See Update existing policies for policies that name literal % identifiers.

At the route gate, ConnectRPC calls have an empty input.request.resource. irn.match with a pattern other than * is false for an empty string. Guard rules that must not fire at the gate with input.request.resource != "". See Limit an agent key to specific functions.