I am working on a rego policy that has multiple conditions. Each condition needs to make a call to the same endpoint of a REST api.
I have managed to retain the result of the service call as a result of another rule.
The result of the Evaluate Package command (VS Code with OPA extension) on the policy looks like this now:
[ [ { "allow": false, "someProp": [ "N/A" ] } ] ]
Will this affect the correctness of the policy once it gets deployed to the server?
EDIT
Until my changes, the policy only returned allow.
The "evaluate package" feature of the VS Code plugin does pretty much just that :) i.e. it evaluates the whole package including all rules. You'll see the same default behavior in the Rego Playground, since it's a pretty good way of learning what's going on to see what all rules evaluate to.
When running OPA as a server (or by all means, opa eval
), you'll commonly query only the specific rule you're interested in, so if in your case you had defined your policy in a package called mypolicy
a request to the OPA REST API might be sent to the /v1/data/mypolicy/allow
endpoint to evaluate only the allow
rule rathe than the whole package (which could be queried at /v1/data/mypolicy
.