From 81858aa542e36d91b9a60cbacbde4523d88c1d55 Mon Sep 17 00:00:00 2001
From: Nikhil J <22786232+mailnike@users.noreply.github.com>
Date: Wed, 1 Jul 2026 15:03:55 -0500
Subject: [PATCH] docs: fix broken OAuth2/OIDC policy examples (#8840)

## What / Why

The examples on the OAuth2/OIDC guide (`docs/docs/oauth-oidc.md`) fail
to compile on current OPA (v1+):

1. `claims := jwt.decode(input.token)[1]` uses an undefined built-in.
The correct name is `io.jwt.decode`, which the same page already uses
correctly further down (`jwt_unverified := io.jwt.decode(input.token)`).
2. The `jwt_verified := jwt_unverified { ... }` and `token := t { ... }`
rules are missing the `if` keyword required before a rule body in Rego
v1, so they fail to parse (`'if' keyword is required before rule body`).

## Changes
- `jwt.decode` -> `io.jwt.decode`
- add `if` before the `jwt_verified` and `token` rule bodies

These are minimal, semantics-preserving fixes so the copy-pasteable
examples work on a current OPA release.

Signed-off-by: Nikhil Jathar <22786232+mailnike@users.noreply.github.com>
---
 docs/docs/oauth-oidc.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/docs/docs/oauth-oidc.md b/docs/docs/oauth-oidc.md
index 9c8d81ff41..6283a3456f 100644
--- a/docs/docs/oauth-oidc.md
+++ b/docs/docs/oauth-oidc.md
@@ -20,7 +20,7 @@ metadata_discovery(issuer) := http.send({
     "force_cache_duration_seconds": 86400 # Cache response for 24 hours
 }).body
 
-claims := jwt.decode(input.token)[1]
+claims := io.jwt.decode(input.token)[1]
 metadata := metadata_discovery(claims.iss)
 
 jwks_endpoint := metadata.jwks_uri
@@ -71,7 +71,7 @@ jwks_url := concat("?", [
 ])
 jwks := jwks_request(jwks_url).raw_body
 
-jwt_verified := jwt_unverified {
+jwt_verified := jwt_unverified if {
     io.jwt.verify_rs256(input.token, jwks)
 }
 
@@ -85,7 +85,7 @@ Programmatically obtain an OAuth2 access token following the client credentials
 ```rego
 package oauth2
 
-token := t {
+token := t if {
     response := http.send({
         "url": "https://authorization-server.example.com/token",
         "method": "POST",