Built-in HTTP and deterministic "two-step" calls

[grubis]

In Rego, I have a rule that requires two sequential HTTP calls... one POST to authorize and get a token, then one GET to use the token and get the data. This is just the way the system I'm interfacing with works.

user_is_allowed {

  request1 := {...Built-in function HTTP arguments - POST...}
  response1 := http.send(request1)

  token := extract token from response1.raw_body
  
  request2 := {... Built-in function HTTP arguments INCLUDE token from response1 - GET...}
  response2 := http.send(request2)

  allowed == check response2 for correct data
}

This works once, and then never again... and in the documentation (latest release) I see for HTTP:
"This built-in function must not be used for effecting changes in external systems as OPA does not guarantee that the statement will be executed due to automatic performance optimizations that are applied during policy evaluation."

I think "optimizations" is not performing both HTTP calls on every run. Any ideas around this... I am not using the cache.

Thanks for any guidance.

[srenatus]

This should be doable. I'm not sure what's going wrong based on your description, could you share a trace of a failing run? Or come up with an MWE showing the same behaviour?

[grubis]

I found the issue in my code.
Copying an authorization code from the response of the first request to the http header of the second request, I missed changing some characters in a string to URL encoding.. characters like / = + etc.

[srenatus]

Awesome! Would you be able to share some example code here for everyone's benefit? 😃