feat: add rule to check if service account is valid

[tpoliaw]

No description provided.

[ZohebShaikh]

The rego policy logic looks correct

[ZohebShaikh]

errors should be used to give the reason why the policy has failed without leaking any privileged information.

I see this pattern emerging

class OPADecision(..):
	...
	
	def _make_call_to_opa(endpoint,expected_result:Any=True,input:dict[str,str]):
		response = request.post(endpoint,input)
		
		(decision,error) = from response
		if decision == expected_result:
			return;
		if decision != expected_result:
			raise AuthZError(f"{error}")
	
	def delete_task(....):
		_make_call_to_opa(....)
		# successful authz
		return blueapi.delete_task()

This might be better than having exception handling in every func like this

	def delete_task(....):
		decision = _make_call_to_opa(....)
		if decision != True:
			raise AuthZError("Cannot delete this awesome task")
		if decision == True:
			return blueapi.delete_task()

Another example I can think of is when we were debugging numtracker and there was an extra “/” in the issuer, which caused JWT verification to fail. If we had received a clearer error message from OPA, the debugging process would have been much simpler.

[tpoliaw]

Where would this go in the module if there end up being multiple rules? How would you distinguish between causes of errors?