# Server authorization (opa run --authorization=basic).
# Health checks are open; everything else needs the bearer token.
package system.authz

import rego.v1

default allow := false

allow if input.path == ["health"]

allow if input.identity == data.opa_authz.token