Private variables?

[JAForbes]

Is it possible to declare a variable that can only be referenced by expressions within the same package?

I find I commonly import some untrusted input, and then build an internal local variable that does things like upper(trim(...)) etc. It'd be nice to declare those internal temporary variables without including them on the evaluated policy response, because semantically they aren't that useful to the caller.

[srenatus]

Is it possible to declare a variable that can only be referenced by expressions within the same package?

No, this is not possible. You could introduce your own convention, like starting with an underscore, python-style.

[anderseknert]

Only what was queried for will be included in the policy response :) So if the caller doesn't want them, they should be more specific in their query. I.e. if you have a policy like this:

package policy

foo := input.foo
bar := input.bar

default allow := false

allow {
    foo == bar
}

With OPA running as a server, you either query the whole package, i.e. /v1/data/policy which will evaluate and return all rules/data in the scope of the package, or you query only the rule of interest, like /v1/data/policy/allow. That will only include the result of evaluating the allow rule in the response and nothing else.

[anderseknert]

The same goes for eg opa eval, where you also provide the path for the query, i.e. opa eval -d policy.rego data.policy.allow

[aholmis]

Another way is to make it a function instead of a variable. Like:

_format_foo(foo) = bar {
    bar := upper(trim(foo))
}

Functions are not a part of the result object.