What's the `location` key in the opa rego resultset expression? can I get locations in input json that caused policy violation?

Question

I'm using go rego package, and the rego.ResultSet when marshalled gives this:

[
  {
    "expressions": [
      {
        "value": {...},
        "text": "data",
        "location": { "row": 1, "col": 1 }
      }
    ]
  }
]

I intend to output the location(s) in Input JSON where the keys were responsible for failures so that I can use this in building context for the errors We used JSON schema earlier for validating JSONs and it used to return the keys from input that we can map with errors. https://www.jsonschemavalidator.net/

I suppose as rego could support far more complex decision making where more than one key would be responsible for making the final outcome, that could be the reason it wouldn’t point to a location in the input for failure context. unless am I missing anything?

Answer 1

To answer the first question:

Every value parsed by OPA retains "location" information identifying where it came from in the source string/file. The location in the ResultSet is the location of the expression in the query that was passed when creating the rego.Rego object.

In your case, the query was "data", i.e., you referred to ALL of the documents in OPA (both base documents which could have be loaded from outside as well as virtual documents generated by any rules you loaded into OPA.) The location of the expression in this case is not very interesting: row 1, column 1.

To answer your second question:

OPA does not currently have a reliable way of returning the location of JSON values in the input however this is something that would be valuable and could be added in the future.