Using with to call another policy?

[lukyer]

Hi,
I tried to cross call policy A from another policy B by using with to override data. It works but I noticed that evaluation of policy A is done multiple times without reusing already calculated rule values. Is it for purpose or is it some bug?

Can with be used in regular policy logic or is it to be used only in tests?

Minimal example: https://play.openpolicyagent.org/p/pDWR20IyuA

Thanks!

[anderseknert]

Without diving into the source code on a Friday night (😅), I'm guessing that caching the reslut of rule evaluation is omitted when with is used, since the purpose of using with is basically to say "evaluate foo with a different context provided", which is likely going to render a different result. I suppose the caching mechanism could take the right hand values of the with statement into account.

There are definitely a few use cases for with outside of testing.

I would however think that repeated requests to evaluate the same rule over and over, and with the exact same data provided by with... to be uncommon, to say the least. Is there some scenario where you have found this to be a useful pattern?

[lukyer]

Hi, sorry for late reply - I was catching up with work when finally found solutions and workarounds for the reported issues.

The most minimal example I could get is here https://play.openpolicyagent.org/p/SCYcv53p7M
Check the difference between result_ok and result_problem.

The pattern I had regarding with was to call generic "rbac.rego" policy from specific "feature.rego" policy like:

rbac_result = tmp {
    tmp := rbac.authorization with input.permission as "fixed-feature-permission" with input.action as "read"
}

and work with this evaluated (constant) value further in the specific policy

[anderseknert]

Alright! Thanks for providing an example 👍 Not sure what the alternative would be here though. If you say something like:

my_rule with input as {"foo": "bar"}
my_rule with input as {"bar": "foo"}

how could my_rule not be evaluated twice? It's essentially the same thing as querying OPA twice with different inputs.

[lukyer]

@anderseknert Ah, sorry for confusion, you should call GET .../data/send/result_ok OR GET .../data/send/result_problem - not both at once. You call only one of these rules but send_result rule is evaluated multiple times if the rule contains with keyword. This is not about calling two rules with two different input overrides.

[lukyer]

let me make it more clear with this updated example ... 1 versus 6 evaluations:
https://play.openpolicyagent.org/p/KENLS2BlQA

also notice that it doesn't matter whether with overrides differ or not (this is another unrelated problem I guess)

[anderseknert]

Hey, again :)

This is not about calling two rules with two different input overrides.

It doesn't really matter if it's input that's being overridden by with or not — the effect is the same. I guess I still don't understand the actual use case here. If you call with with different values on the right hand side, you'll obviously want to have the rule on the left hand re-evaluated per invocation. If you call with repeatedly with the same value on the right hand side, you are right that we could probably cache the first invocation and reuse that — I just need help understanding when this would ever be something you'd do in a policy?