How to Handle undefined Rule Evaluations in Rego and Execute Alternative Logic?

[aashishkr]

Hi,

I'm trying to implement an override in Rego and need help handling the undefined case. Here's the code snippet:

package base.policy_checks

allow := true if {
    # If an override exists, it will return true or false
    check_for_policy_override_exists("inventory")
} else if {
    # If the override doesn't exist, it should fallback to base policy
    check_for_policy_override_exists("inventory") != "undefined"
    check_base_policy_implementation("inventory")
} else := false

check_for_policy_override_exists(policy_name) if {
    # `input.segment` can be any value, e.g., "owner"
    policy_overides[input.segment].check_policy(policy_name) 
}

check_base_policy_implementation("inventory") := true

The owner-level override is defined like this:

package base.policy_overides.owner

check_policy("casual_leaves") := true

Goal:

I want allow to be determined as follows:

1. If check_for_policy_override_exists("inventory") returns true or false, use that value.
2. If check_for_policy_override_exists("inventory") is undefined, fallback to check_base_policy_implementation("inventory").
3. If both [check_for_policy_override_exists("inventory"), check_base_policy_implementation("inventory")] don't exist default the value to false.

How can I refactor this to handle the undefined case more effectively? Any ideas or suggestions are welcome!

[anderseknert]

Could be that I don't fully understand what you want, but it sounds like you want to use the not keyword, which negates false/undefined.

So instead of:

 check_for_policy_override_exists("inventory") != "undefined"

you'd do

not check_for_policy_override_exists("inventory")

which negates an undefined result and moves on to evaluate the next line.

[aashishkr]

I want to differentiate between false and undefined given this example:

package base.policy_checks

default allow := false

allow if check_for_policy_override_exists(input.policy)

allow if {
    not check_for_policy_override_exists(input.policy)
    check_base_policy_implementation(input.policy)
}


check_for_policy_override_exists(policy_name) if {
    # `input.segment` can be any value, e.g., "owner"
    policy_overides[input.segment].check_policy(policy_name) 
}

check_base_policy_implementation(_) := true

package base.policy_overides.owner

check_policy("casual_leaves") := false

Input:


{
“policy”: “casual_leaves”
"segment": "owner"
}


the policy evaluates to true but it should evaluate to false.
A simplified working example here: https://play.openpolicyagent.org/p/l4c0xFciXA

Your example considers check_base_policy_implementation will be false for all params but it can be true too.

[anderseknert]

Ah, sorry, I had missed this bit:

policy_overides[input.segment].check_policy(policy_name) 

But that can't compile though? 🤔 Functions in Rego are resolved at compile time (as they have distinct requiriments for argument and return types) while input obviously isn't known before evaluation.

opa eval -f pretty -d p.rego 'data.p'
1 error occurred: p.rego:8: rego_type_error: undefined function policy_overides[input.segment].check_policy

But that aside, if you want to propagate a false result to the next function, you could do that with an explicit return value:

Instead of:

check_for_policy_override_exists(policy_name) if {
    policy_overides[input.segment].check_policy(policy_name) 
}

Return the result:

check_for_policy_override_exists(policy_name) := policy_overides[input.segment].check_policy(policy_name) 

Or assign it to a defined return value var:

check_for_policy_override_exists(policy_name) := result if {
    # some other code
    result := policy_overides[input.segment].check_policy(policy_name) 
}

But again, that dynamic function call should not pass compilation as far as I can see.

[anderseknert]

See this issue for some context open-policy-agent/opa#4025

Rule/data references are however not resolved until eval time, so something like this would work:

policy_overides[input.segment].check_policy with input as {"name": policy_name}

Assuming of course that you update check_policy to be a rule rather than a function, and have it check for the input in the format you defined.

I wrote a blog about that pattern some years ago. The examples are a little outdated, but besides that still relevant.

[aashishkr]

Agree policy_overides[input.segment].check_policy(policy_name) fails to compile so I have replaced it with this:

input.segment == "owner"
policy_overides.owner.check_policy(policy_name)

It works and compiles.

That being said my original issue remains same where I want to execute an alternate logic (check_base_policy_implementation) when there is no concrete implementation of the policy exists in a different file (check_for_policy_override_exists).

[anderseknert]

👍

Not sure if it’s what you’re after, but OPA makes no distinction between a reference to a rule evaluating to undefined and one that doesn’t exist. Both of them are just undefined.

If the distinction matters, you need to use something like default values to have existing rules fall back to false (or any value) in the undefined case.