Rego Policies for Notes RBAC/ABAC (+ Unit Tests)

[Ikey168]

Motivation: Express domain authZ in code: who can read/write which note, tag, or plugin action.

Acceptance Criteria

• policy/authorization.rego implements at least:
  • notes.read: owner or shared-with role.
  • notes.write: owner or editor.
  • notes.admin: admin role.
  • Tag/graph link rules aligned with domain model.
• Policy unit tests: allow/deny matrices pass.
• Documentation: docs/policy/README.md explaining rules & inputs.

Tasks

• Define input schema (claims, path, method, resource owner, scopes).
• Implement allow/deny rules + default deny.
• Add opa test suite with table-driven cases.
• Wire a simple “policy bundle” build (e.g., make policy-build).

Notes

• Prefer capability-based checks (scopes/claims) for plugin actions.