Implementing Authorization

local roles = kong.ctx.shared.jwt_payload.roles or {}
local required = "admin"
local allowed = false
for _, r in ipairs(roles) do
  if r == required then allowed = true break end
end
if not allowed then
  return kong.response.exit(403, { error = "forbidden" })
end

package http.authz

default allow = false

allow {
  input.method == "GET"
  input.path[0] == "v1"
  input.path[1] == "orders"
  token.payload.scope[_] == "orders:read"
}

token := { "payload": payload } {
  [_, payload, _] := io.jwt.decode(input.headers.authorization)
}

local payload = kong.ctx.shared.jwt_payload
local req_tenant = kong.request.get_query_arg("tenant")
if payload.tenant ~= req_tenant then
  return kong.response.exit(403, { error = "tenant_mismatch" })
end

plugins:
  - name: acl
    config:
      allow: ["premium-tier", "enterprise-tier"]
      deny: ["banned-users"]
      hide_groups_header: true