authorize: remove DataBrokerData input

[calebdoxsey]

Summary

Currently we use session, user and group data from the input in the rego policy. This data is also available in data.databroker_data, so this PR updates the policy to only look at data, and stops passing in the session, user and group data.

Checklist

• reference any related issues
• updated docs
• updated unit tests
• updated UPGRADING.md
• add appropriate tag (improvement / bug / etc)
• ready for review

[codeclimate]

Code Climate has analyzed commit 3ade398 and detected 0 issues on this pull request.

View more on Code Climate.

[wasaga]

I only have basic understanding of how rego policies work, thus would appreciate a second pair of eyes @pomerium/dev-backend

[desimone]

The code LGTM but a simple policy is failing for me.

policy:
  - from: https://verify.localhost.pomerium.io
    to: https://verify.pomerium.com/
    allowed_users:
      - bdd@pomerium.com
    pass_identity_headers: true

{
  "level": "info",
  "service": "authorize",
  "request-id": "766960ae-0f8c-4113-979a-ef6f4a27229b",
  "check-request-id": "5a145e27-7dfa-45eb-b383-ae49d9fecca2",
  "method": "GET",
  "path": "/",
  "host": "verify.localhost.pomerium.io",
  "query": "",
  "allow": false,
  "status": 403,
  "message": "authorize check",
  "user": "bdd@pomerium.com",
  "groups": [],
  "time": "2021-02-02T11:15:13-08:00"
}
{
  "level": "error",
  "service": "envoy",
  "name": "lua",
  "time": "2021-02-02T11:15:13-08:00",
  "message": "script log: [string \\\"function envoy_on_request(request_handle)...\\\"]:16: attempt to index a nil value"
}
{
  "level": "info",
  "service": "envoy",
  "upstream-cluster": "",
  "method": "GET",
  "authority": "verify.localhost.pomerium.io",
  "path": "/",
  "user-agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_2_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.96 Safari/537.36",
  "referer": "",
  "forwarded-for": "192.168.1.63",
  "request-id": "5a145e27-7dfa-45eb-b383-ae49d9fecca2",
  "duration": 13.193625,
  "size": 11565,
  "response-code": 403,
  "response-code-details": "ext_authz_denied",
  "time": "2021-02-02T11:15:13-08:00",
  "message": "http-request"

[calebdoxsey]

I don't know why it doesn't work. I spent many hours trying to port the logic to rego without much luck. I'll try again.

[calebdoxsey]

Looks like the issue is the / in the user ids. This gets transformed into a more deeply nested object. eg:

{
  "type.googleapis.com": {
    "user.User": {
      "google": {
         "ID": {}
       } 
    }
  }
}

[codecov]

Codecov Report

Merging #1847 (3ade398) into master (2f3c73b) will decrease coverage by 0.0%.
The diff coverage is 71.2%.

@@           Coverage Diff            @@
##           master   #1847     +/-   ##
========================================
- Coverage    57.0%   56.9%   -0.1%     
========================================
  Files         140     140             
  Lines       10335   10314     -21     
========================================
- Hits         5893    5876     -17     
+ Misses       3829    3822      -7     
- Partials      613     616      +3     

Impacted Files	Coverage Δ
authorize/authorize.go	78.7% <ø> (-0.7%)	⬇️
authorize/run.go	0.0% <0.0%> (ø)
authorize/evaluator/store.go	53.4% <64.4%> (+8.8%)	⬆️
authorize/evaluator/evaluator.go	58.4% <100.0%> (-2.6%)	⬇️
authorize/evaluator/request.go	87.5% <100.0%> (ø)
authorize/grpc.go	77.2% <100.0%> (-5.0%)	⬇️
internal/databroker/server.go	51.8% <0.0%> (+0.7%)	⬆️
pkg/storage/redis/redis.go	75.1% <0.0%> (+1.0%)	⬆️

[desimone]

LGTM;