Dynamic policy with optional input fields

[renatosc]

Looking for some guidance on how to achieve to following: I have an input that will have 2 fields from 4 possibles (id, name, phone and code). So, my input would be have (id, name) or (id, phone) or (id, code), and so on. To add more fun to it, I am also using dynamic policies, so basically I have something like this:

default result := false

result := true if {
    my_single_policy_from_another_file with input as {
       "name": input.name,
       "id": input.id,
       "code": input.code,
       "phone": input.phone
    }
}

my_single_policy_from_another_file if {
    input.name
    input.name == "abc"
}

my_single_policy_from_another_file if {
    input.id
    input.id == "zzz"
}

my_single_policy_from_another_file if {
    input.code
    input.code == "123"
}

my_single_policy_from_another_file if {
    input.phone
    input.phone == "456" I 
}

If I send the input:

{
    "code": "123",
    "phone" : "456"
}

I get result := false while I would like to get result:= true. I know that I could achieve that by creating all pair combinations for the result rule but that sounds extremely redundant. Any idea on how to achieve my objective?

So far the best solution that I found is to use add "default" values for the inexistent fields using object.get as in:

`result := true if {
	my_single_policy_from_another_file with input as {
              "name": object.get(input, "name", null),
              "id": object.get(input, "id", null),
              "code": object.get(input, "code", null),
              "phone": object.get(input, "phone", null)
    }
}

Is this the way to go or am I missing a better way to do it?

[judgeaxl]

How about something like

name_is_valid if {
    input.name == "abc"
}

id_is_valid if {
    input.id == "xxx"
}

# repeat for code, phone

my_policy if {
   name_is_valid
   id_is_valid
}

my_policy if {
   name_is_valid
   code_is_valid
}

# repeat for valid combinations

The test for each input becomes clear, as well as which combinations are valid.

[renatosc]

Thank you for your suggestion, but not exactly what I am looking for.

Your suggestion is actually very similar to what my real my_single_policy_from_another_file rule has (I simplified in the above because it is not my the point of concern). The issue here is the use of dynamic policy where I have one rule (result) calling the my_single_policy_from_another_file by passing the input received from result to be the input of my_single_policy_from_another_file.

My impression is that by having

my_single_policy_from_another_file with input as {
       "name": input.name,
       "id": input.id,
       "code": input.code,
       "phone": input.phone
    }

when opa/rego is trying to set "name": input.name and input.name does not exist, then it is considered a failure for the rule (instead of just treating it as null value).

[anderseknert]

Maybe I missed something, but why reconstruct input with identical fields from the actual input? The input object is global and can be read from any policy. This:

result := true if {
    my_single_policy_from_another_file with input as {
        "name": input.name,
        "id": input.id,
        "code": input.code,
        "phone": input.phone
    }
}

Is really just a more fragile (as you've noticed) way to express this:

result if {
    my_single_policy_from_another_file
}

Now if you for some reason really need to define a new object from input that has the same defined/undefined properties (perhaps with some added variations), you could build an incremental object rule and use that:

obj["id"] := input.id
obj["name"] := input.name
obj["code"] := input.code
obj["phone"] := input.phone

result if {
    my_single_policy_from_another_file with input as obj
}

[renatosc]

Thank you for your reply. Yes, I send the original input + an extra value (that I omitted on the example to make it simpler) as the input to the other rule, so it is not exactly the same. So what I have is more like this:

my_single_policy_from_another_file with input as {
       "name": input.name,
       "id": input.id,
       "code": input.code,
       "phone": input.phone,
       "extra_data": data.extra_data
    }

but your solution using a new obj is great.

[anderseknert]

The omission did not make it simpler :) But we arrived where we wanted, and that’s what matters.