CODEWITHSUNDEEP
opa
Yehuda Yefet
Yehuda Yefet

Reputation: 31

Opa eval command line - always evaluates to false

Attempting to evaluate opa via command line but for some reason the evaluation output is always set to false. In this case, the rego policy is just validating the input checking if the RoleID has access to the table.

policy.rego

package play
import data.Roles

default access = false
access {
    some i,j
    currentRole = Roles[i]
    currentRole.RoleID == input.RoleID
    currentRole.tables[j] == input.tableName
}

data.json

{
  "Roles": [
    {
      "RoleID": "SalesHead",
      "tables": [
        "APAC-Sales",
        "USA-Sales"
      ]
    },
    {
      "RoleID": "AccountsHead",
      "tables": [
        "APAC-Accounts",
        "USA-Accounts"
      ]
    }
  ]
}

test.json (input)

{
  "input": {
    "RoleID": "SalesHead",
    "tableName": "USA-Sales"
  }
}

Command:

opa eval --data policy.rego --input test.json --format raw "data.play"

Output:

{"access":false}

^^^This should be: {"access":true}

Stumped.

Upvotes: 0

Views: 475

Answers (2)

GOKULAN S
GOKULAN S

Reputation: 1

Yes "Yehuda Yefet" said right also the eval command should be

opa eval --data policy.rego --input test.json --data data.json --format raw "data.play"

Upvotes: 0

Yehuda Yefet
Yehuda Yefet

Reputation: 31

Had to remove input key from input.json Resolved

Upvotes: 1

Related Questions