mirror of
https://github.com/open-policy-agent/opa.git
synced 2026-08-14 20:32:27 -06:00
Stephan Renatus
2cf57ca6d3
Rules can now be annotated with a metadata `id` field. When any metadata `id` annotations are present in the rego (scope: rule), the IDs of successfully evaluated rules are included in decision log events. Additionally, the Data API supports a `?id` query parameter to include evaluated rule IDs directly in the response payload. ```rego # METADATA # id: allow-admin allow if input.role == "admin" ``` Modules containing `id` annotations will have metadata parsing enabled automatically. Fixes #2089 Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
38 lines
1.8 KiB
Plaintext
38 lines
1.8 KiB
Plaintext
# Verify that request metadata flows into decision logs and does NOT leak
|
|
# into the API response. In vanilla OPA (no custom builtins that write to
|
|
# ResponseMetadata), the response must contain only the standard fields.
|
|
|
|
exec $OPA run --server --addr unix://opa.sock --log-format json --log-level info --set decision_logs.console=true ./policy/example.rego &opa&
|
|
retry curl -sf --unix-socket opa.sock 'http://localhost/health'
|
|
|
|
# POST with namespaced metadata alongside input (recommended pattern).
|
|
exec curl -sf --unix-socket opa.sock -H 'Content-Type: application/json' -d '{"input": {"user": "alice"}, "com.example.opa/metadata": {"trace_id": "req-42"}}' http://localhost/v1/data/example/allow
|
|
jq stdout '.result == true'
|
|
! jq stdout '.["com.example.opa/metadata"]'
|
|
|
|
# POST without any metadata — baseline.
|
|
exec curl -sf --unix-socket opa.sock -H 'Content-Type: application/json' -d '{"input": {"user": "bob"}}' http://localhost/v1/data/example/allow
|
|
jq stdout '.result == true'
|
|
|
|
kill -INT opa
|
|
wait opa
|
|
|
|
# Decision log for the first request must contain request_metadata.
|
|
jq -s stderr '[.[] | select(.msg == "Decision Log" and .custom.request_metadata["com.example.opa/metadata"].trace_id == "req-42")] | length == 1'
|
|
|
|
# Decision log for the first request must NOT have response_metadata (vanilla OPA).
|
|
! jq -s stderr '[.[] | select(.msg == "Decision Log" and .custom.response_metadata)] | length > 0'
|
|
|
|
# Decision log for the second request (no metadata) must not have a custom field.
|
|
jq -s stderr '[.[] | select(.msg == "Decision Log" and .path == "example/allow" and (.custom | not))] | length == 1'
|
|
|
|
# No rules have id annotations, so ids must never appear.
|
|
! jq -s stderr '[.[] | select(.msg == "Decision Log" and .ids)] | length > 0'
|
|
|
|
-- policy/example.rego --
|
|
package example
|
|
|
|
default allow := false
|
|
|
|
allow if input.user != ""
|