Dynamic parameters in OPA

[vas-rus]

It may be very simple question if people already know answer to it ,what I want to achieve is inside rego I want to specify a simple if string equals condition , however base string I want to provide at runtime , depending on many conditions.
For example I want to check if max days since login has passed then fail policy and don't let it pass , now max days for each of specific area/company is set by users. E.g. for america people says it should be 5 days and for india people says 4 days. So can I pass this max value at runtime to opa to evaluate. There can be thousand of such values and hence putting all values and doing if else is not possible.

[srenatus]

🔖 Have you found the docs on external data? There should be viable options in there.

Concretely, providing runtime information to a query is usually done via Input. I could imagine this as something like

$ echo '{"days": 10, "country-standard": 4}' | opa eval -I -fpretty 'input.days < input["country-standard"]'
false
$ echo '{"days": 10, "country-standard": 30}' | opa eval -I -fpretty 'input.days < input["country-standard"]'
true

Since I don't expect your mapping of country to days to change often, data might be a better idea. There are many ways to make that happen. Both input and data are available to all policies evaluated in OPA.

[vas-rus]

Currently I use bundles to load data and input doesn't have this data and this dynamic value can change by people time to time , example may be little wrong but think of it that 2k users can have 2k different values and that is for one rego , there are hundreds such rego where input I want to take from user. Now api we hit is rest api made by opa for every rego file , so how to club all this and while calling api provide these values. I hope you understand question.

[srenatus]

Can you perhaps share an example snippet? it's a little hard to guess what your policy looks like.

From the outset, it seems like using bundles for that kind of thing wouldn't be wrong. 🤔

[vas-rus]

@srenatus Below is little snippet of code

Currently I am using required_tags and grace_period as static , but these values will be dynamic depending on who is providing input.
Bundle I am already using but that only can take static values not at runtime
Code :

package tag_002
import future.keywords.in
import future.keywords.every

default allow = [{"result": "FAIL", "message": "Incorrect input" , "resource" : ""}]

grace_period := data.tag_002.grace_period
required_tags := data.tag_002.required_tags

........
........
........

get_missing_tags[required_tag] {
    some required_tag in required_tags
    every tag in input.tags{
    	lower(required_tag) != lower(tag.key)
        }
}

[srenatus]

What is the information you'd use to figure out which the right grace_period and required_tags are? Something from input? Perhaps you could encode that logic in a helper function 🤔

[vas-rus]

So required_tags are based on input , opa will receive cloud infra data , and every data should have some tags , different small scenario

1. for one team region is very important , so in required tags for that stream input it should be region
2. for other brand name is , so in required tags they provide brandName

Now we check if data has that required tags or not. Based on that result of pass/fail is sent
Now I want to make this additional data(here required_tags) available to opa server while processing.

[srenatus]

Can you share your current approach and where it's lacking? It'll be easier to fill in the blanks, for example in a playground share.