Early Exit in iteration with http.send

[ZabelinK]

Hi,

I have a question regarding early exit in Rego rules that involve iterations and the use of http.send.

We have the following example:

allow if {
	some acl in input.acls
	some grant in acl.grants

	is_member_response := http.send({
		"method": "POST",
			"url": sprintf("http://someservice/%s/%s", [input.requester, grant.grantee]),
		"headers": {
			"content-type": "application/json",
		}
	})

	is_member_response.body.is_member == true
}

Based on the documentation about early exit from https://www.openpolicyagent.org/docs/policy-performance#early-exit-in-rule-evaluation, I would expect the rule to stop evaluation and return true as soon as the first HTTP request returns with is_member == true. However, according to the logs, an HTTP request is sent for every possible item in the input list, even after some requests have already returned is_member == true.

Is this the expected behavior? Does early exit not work with http.send, or is there a way to make the rule stop iterating once an http.send call returns is_member == true?

We use policy compiled into wasm bundle.

Thanks!

[ZabelinK]

I tried the same policy with rego bundle instead of wasm and there it seems to be working. Is wasm an issue in this case? Is there a plan to make EE work with WASM?

[srenatus]

You're right, EE isn't a thing in wasm. Can you create an issue, please?

[ZabelinK]

Thanks for the fast response!

I will create an issue for this. Do you have an idea how much time it might take to resolve it?

[ZabelinK]

Created an issue here - open-policy-agent/opa#7753

[srenatus]

Do you have an idea how much time it might take to resolve it?

Definitely "don't hold your breath" territory -- it's not code that's actively being worked on, so it'll most likely take some time before someone picks this up. That said, it could be a good opportunity to dive into that part of the code base, if you're so inclined 😅 Come join #contributors on Slack if you'd like to discuss this.