Add default OPA rules

[andrei2699]

package app.rbac

# Default everything to closed
default allow = false

# Define roles and their permitted actions (Self-hosters can change this!)
role_permissions := {
 "admin": ["project:read", "project:edit", "project:delete", "member:invite"],
 "editor": ["project:read", "project:edit"],
 "viewer": ["project:read"]
}

# 1. API Authorization Check: Does this role have this permission?
allow {
 # Check if the requested action is in the list of permissions for the user's project role
 input.action == role_permissions[input.project_role][_]
}

# Global Admin Override (e.g., system admins can do anything)
allow {
 input.is_system_admin == true
}

# 2. UI Permissions Check: Return all permissions for a given role
# This powers your GET /api/projects/{id}/my-permissions endpoint
user_permissions := role_permissions[input.project_role]

example on how to run custom rules
docker run -v ./my-custom-policy.rego:/policies/policy.rego openpolicyagent/opa