undefined function

[3goats]

Hi,

Not sure if this is a bug or something I'm not doing. I'm trying to validate a JWT using a JWKS endpoint.

I'm following the the docs here - https://www.openpolicyagent.org/docs/latest/oauth-oidc/#token-verification-using-jwks-endpoint. However when I define the function:

jwks_request(url) := http.send({
    "url": url,
    "method": "GET",
    "force_cache": true,
    "force_cache_duration_seconds": 3600 # Cache response for an hour
})

However when I start my bundle server I get the following error:

error: 1 error occurred: /opt/policy/..2023_10_16_09_23_09.1918868533/policy.rego:85: rego_type_error: undefined function input.attributes.request.http.send 

[srenatus]

Have you got an import, by any chance?

import input.attributes.request.http

What would override the http bit if http.send. Try to use

input.attributes.request.http as http_request

instead.

[anderseknert]

Was thinking this would be a good rule for Regal, but considering the compiler already catches this, perhaps it'd be better if we just made the error message more helpful, and rather than saying the function is undefined explained that an import shadows the built-in function being called? 🤔

[johanfylling]

If the desired function can't be found on an import and that import is shadowing a built-in name/namespace, OPA could definitely be more helpful in decorating the error with additional info 👍.

The followup question is: should OPA completely disallow imports that is shadowing built-ins? Personally, I'm leaning towards this being the perfect responsibility for a linter (e.g. Regal) to decide.

[anderseknert]

Thanks! StyraInc/regal#406 (comment)

[3goats]

So indeed I did have a import input.attributes.request.http import. I changed it to import input.attributes.request.http as http_request.

However this seems to now break my token validation. e.g.

token := {"valid": valid, "payload": payload} if {
    [_, encoded] := split(http.headers.authorization, " ")
    #[valid, _, payload] := io.jwt.decode_verify(encoded, {"secret": "secret"})
    [valid, _, payload] := io.jwt.decode_verify(encoded, constraints)
}

error: 7 errors occurred:                                                                                                                                                                  │
 /opt/policy/..2023_10_16_10_09_40.1741865458/policy.rego:91: rego_unsafe_var_error: var jwks is unsafe                                                                                     
/opt/policy/..2023_10_16_10_09_40.1741865458/policy.rego:94: rego_unsafe_var_error: var _ is unsafe                                                                                        
/opt/policy/..2023_10_16_10_09_40.1741865458/policy.rego:94: rego_unsafe_var_error: var encoded is unsafe                                                                                  
/opt/policy/..2023_10_16_10_09_40.1741865458/policy.rego:94: rego_unsafe_var_error: var http is unsafe                                                                                      /opt/policy/..2023_10_16_10_09_40.1741865458/policy.rego:96: rego_unsafe_var_error: var payload is unsafe                                                                                  
 /opt/policy/..2023_10_16_10_09_40.1741865458/policy.rego:96: rego_unsafe_var_error: var valid is unsafe                                                                                    
 /opt/policy/..2023_10_16_10_09_40.1741865458/policy.rego:96: rego_unsafe_var_error: var _ is unsafe 

My code now looks like this:

jwks_request(url) := http.send({
    "url": url,
    "method": "GET",
    "force_cache": true,
    "force_cache_duration_seconds": 3600 # Cache response for an hour
})

jwks := jwks_request("http://jwt-this.firefly.svc.cluster.local:8000/.well-known/jwks.json").raw_body

constraints := {
  "cert": jwks, 
  "alg": "ES256",
  "time": time.now_ns()
}


token := {"valid": valid, "payload": payload} if {
    [_, encoded] := split(http.headers.authorization, " ")
    #[valid, _, payload] := io.jwt.decode_verify(encoded, {"secret": "secret"})
    [valid, _, payload] := io.jwt.decode_verify(encoded, constraints)
}

[anderseknert]

You'll neeed to update http.headers.authorization -> http_request.headers.authorization

[srenatus]

Everything that was http before to access input.attributes.request.http as a shorthand (nothing more is the import of that), needs to access http_request now.

-    [_, encoded] := split(http.headers.authorization, " ")
+    [_, encoded] := split(http_request.headers.authorization, " ")

[3goats]

Doh! yes that was stupid of me. Working now thanks for all of the help. Are there any plans for a VSCode plugin for Regal ? Would be great to run/debug policies there.

[anderseknert]

For sure! We're getting close to completing the current roadmap.
Once we do, VS Code integration (and possibly, IDEA) will be high up on the list for the next one. I think we may use a simple approach to start out, and extend the OPA plugin to simply call out to the Regal binary similarly to how it calls out to OPA for eval and other commands. Long term, I'd love to have a proper Rego language server which would integrate Regal for linting, but having looked into that briefly I think that'll be quite an undertaking.