{"action":"opened","issue":{"url":"https://api.github.com/repos/open-policy-agent/opa/issues/1027","repository_url":"https://api.github.com/repos/open-policy-agent/opa","labels_url":"https://api.github.com/repos/open-policy-agent/opa/issues/1027/labels{/name}","comments_url":"https://api.github.com/repos/open-policy-agent/opa/issues/1027/comments","events_url":"https://api.github.com/repos/open-policy-agent/opa/issues/1027/events","html_url":"https://github.com/open-policy-agent/opa/issues/1027","id":372816845,"node_id":"MDU6SXNzdWUzNzI4MTY4NDU=","number":1027,"title":"Refer other Rego files from a Rego file and selective evaluation of rules based on input parameters","user":{"login":"yashhere","id":13733968,"node_id":"MDQ6VXNlcjEzNzMzOTY4","avatar_url":"https://avatars2.githubusercontent.com/u/13733968?v=4","gravatar_id":"","url":"https://api.github.com/users/yashhere","html_url":"https://github.com/yashhere","followers_url":"https://api.github.com/users/yashhere/followers","following_url":"https://api.github.com/users/yashhere/following{/other_user}","gists_url":"https://api.github.com/users/yashhere/gists{/gist_id}","starred_url":"https://api.github.com/users/yashhere/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yashhere/subscriptions","organizations_url":"https://api.github.com/users/yashhere/orgs","repos_url":"https://api.github.com/users/yashhere/repos","events_url":"https://api.github.com/users/yashhere/events{/privacy}","received_events_url":"https://api.github.com/users/yashhere/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-10-23T05:41:39Z","updated_at":"2018-10-23T05:41:39Z","closed_at":null,"author_association":"NONE","body":"Hi there, I am relatively new to OPA. I am trying to solve a problem, but I do not know if it is even possible to do such things in OPA. Let me first describe my problem:\r\n\r\nOne of my services (service A) pushes the policy data (a JSON object) and the Rego policy rules to the OPA and other service (service B) queries OPA for decisions based on these Rego policies. Now, service A can push multiple JSON objects, but each JSON object and its corresponding Rego file(programmatically generated) will be pushed to a random endpoint (the endpoint address is a random string). As there are multiple random endpoints, I do not want the service B to be aware of any of these endpoints. I want it to query a predefined endpoint which in turn will get the result back from all the other random endpoints. Is it even possible to do this in OPA, I mean is it possible to refer to other Rego modules from a Rego module? If yes, can you please give some example and point me to relevant documentation?\r\n\r\nSecond question is related to Rego as a language. So I have an array of rules in my *data.json* file, which looks something like:\r\n```json\r\n\"rules\": [\r\n\t{\r\n\t\t\"source-ip\": \"192.168.40.23\",\r\n\t\t\"port\":443,\r\n\t\t\"result\": \"allow\"\r\n\t},\r\n\t{\r\n\t\t\"source-ip\": \"192.168.40.23\",\r\n\t\t\"port\": 80,\r\n\t\t\"result\": \"deny\"\r\n\t},\r\n\t{\r\n\t\t\"source-ip\": \"192.168.40.23\",\r\n\t\t\"dest-ip\": \"10.10.1.18\",\r\n\t\t\"port\": 80,\r\n\t\t\"result\": \"allow\"\r\n\t}\r\n]\r\n```\r\nand an *input.json* file, which looks something like:\r\n```json\r\n{\r\n\"inputAttributes\": [\r\n\t{\r\n\t\t\"source-ip\": \"192.168.40.23\",\r\n\t\t\"port\": 80\r\n\t}\r\n],\r\n```\r\n\r\nand the corresponding Rego file is:\r\n```rego\r\npackage example.policy\r\nimport data.rules\r\nimport input.inputAttributes\r\n\r\nmatch[result] {\r\n\trules[i][\"source-ip\"] == inputAttributes[j][\"source-ip\"]\r\n\trules[i][\"port\"] == inputAttributes[j][\"port\"]\r\n\trules[i][\"dest-ip\"] == inputAttributes[j][\"dest-ip\"]\r\n\tresult := rules[i]\r\n}\r\n```\r\n\r\nSo now, you see that I have not provided the **dest-ip** attribute in the *input.json* file, but the Rego file is trying to filter the rules based on **dest-ip** attribute. So as of now, the output is NULL, because the evaluation of policy becomes false at the third statement in the match function. \r\n\r\nIs there any way that I can use to check if an attribute is supplied by the user in *input.json* before Rego tries to evaluate the policy using the attribute? This problem arises because, in my use case, I do not know beforehand, on what attributes the user wants to query the data? There might be thousands of attributes, and I do not think that it is feasible to use each and every combination of these attributes for evaluation purposes.\r\n\r\nI haven't been able to come up with a solution for a long time now. That might be mostly because of my lack of experience with declarative programming languages, but also because I have had a hard time finding examples to learn from and whenever I found examples, I am having hard time understanding them. \r\n\r\nAny help or guidance is appreciated."}}
{"actor":{"display_login":"yashhere"}}