Partial evaluation condition location

[robhafner]

I'm in the process of upgrading to version 0.60 of OPA and I noticed that the location of the partial evaluation condition information in a response appears to have moved from the body of the Queries field to underneath the modules rules section. I looked over release notes but didn't find anything that mentioned this change. However, maybe I missed it. Can you confirm if the location has changed?

{
"partial": {
"queries": [
[
{
"index": 0,
"terms": {
"type": "ref",
"value": [
{
"type": "var",
"value": "data"
},
{
"type": "string",
"value": "partial"
},
{
"type": "string",
"value": "sas"
},
{
"type": "string",
"value": "audit"
},
{
"type": "string",
"value": "authz"
},
{
"type": "string",
"value": "allow"
}
]
}
}
]
],
"modules": [
{
"package": {
"path": [
{
"type": "var",
"value": "data"
},
{
"type": "string",
"value": "partial"
},
{
"type": "string",
"value": "sas"
},
{
"type": "string",
"value": "audit"
},
{
"type": "string",
"value": "authz"
}
]
},
"rules": [
{
"body": [
{
"index": 0,
"terms": {
"type": "boolean",
"value": true
}
}
],
"default": true,
"head": {
"name": "allow",
"value": {
"type": "boolean",
"value": false
},
"ref": [
{
"type": "var",
"value": "allow"
}
]
}
},
{
"body": [
{
"index": 0,
"terms": [
{
"type": "ref",
"value": [
{
"type": "var",
"value": "eq"
}
]
},
{
"type": "ref",
"value": [
{
"type": "var",
"value": "data"
},
{
"type": "string",
"value": "partial"
},
{
"type": "string",
"value": "sas"
},
{
"type": "string",
"value": "audit"
},
{
"type": "string",
"value": "authz"
},
{
"type": "string",
"value": "grant"
}
]
},
{
"type": "var",
"value": "$_term_1_21"
}
],
"with": [
{
"target": {
"type": "ref",
"value": [
{
"type": "var",
"value": "data"
},
{
"type": "string",
"value": "request"
}
]
},
"value": {
"type": "object",
"value": [
[
{
"type": "string",
"value": "permission"
},
{
"type": "string",
"value": "read"
}
],
[
{
"type": "string",
"value": "uri"
},
{
"type": "string",
"value": "/audit/entries/123"
}
]
]
}
}
]
},
{
"index": 1,
"terms": {
"type": "var",
"value": "$_term_1_21"
}
}
],
"head": {
"name": "allow",
"value": {
"type": "boolean",
"value": true
},
"ref": [
{
"type": "var",
"value": "allow"
}
]
}
},
{
"body": [
{
"index": 0,
"terms": {
"type": "boolean",
"value": true
}
}
],
"default": true,
"head": {
"name": "grant",
"value": {
"type": "boolean",
"value": false
},
"ref": [
{
"type": "var",
"value": "grant"
}
]
}
},
{
"body": [
{
"index": 0,
"terms": [
{
"type": "ref",
"value": [
{
"type": "var",
"value": "eq"
}
]
},
{
"type": "string",
"value": "wfuser1"
},
{
"type": "ref",
"value": [
{
"type": "var",
"value": "data"
},
{
"type": "string",
"value": "resources"
},
{
"type": "var",
"value": "__local51__36"
},
{
"type": "string",
"value": "user"
}
]
}
]
}
],
"head": {
"name": "grant",
"value": {
"type": "boolean",
"value": true
},
"ref": [
{
"type": "var",
"value": "grant"
}
]
}
}
]
}
]
}
}

[srenatus]

I'm in the process of upgrading to version 0.60 of OPA and I noticed that the location of the partial evaluation condition information in a response appears to have moved from the body of the Queries field to underneath the modules rules section. I looked over release notes but didn't find anything that mentioned this change. However, maybe I missed it. Can you confirm if the location has changed?

From which version are you upgrading? This could be a side effect related to ref head rules, but it's hard to tell without knowing your policy. There was no general "move stuff to support modules" bullet point because there hasn't been any such effort.

[robhafner]

I'm currently upgrading from version 0.55.0. However, I'm starting to wonder if the difference is not a result of the upgrade but rather a result of changes made to the policy file. My policy looks something like this:

`package sas.types.authz

import future.keywords.contains
import future.keywords.every
import future.keywords.if
import future.keywords.in

default allow := false

default grant := false

default deny := false

default authenticated_user := false

default guest := false

default current_user := ""

claims := payload if {
io.jwt.verify_rs256(input.token, "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAosom7P7u0dq6vE8j2UPV\nwjQTnuOy7WYp+h4vF4rDpn8Z/+cbj6ZZ6Ax6M+qUuPDhwlb8RjP7SyYJYFDNmNyX\n5CvJ9Ma0NIAo4SZnW+cnyAC7Adgbx7+caUvRUU7hvUAX4lO2ICjKk6ko5E17OVLa\npEMsYKEzW1DYCkqWVXKyZiiChMUIhDFA0Q2VC+ltpAUZFK6i4LQvDIxnXFDdvbVH\nitEBDdOFjpDT468lp3Ehc1NnzQ8AeWwCuYGKbaiZC1do+5VKffFM7yOz+j+D4RKB\ndFS+InbcOfETztK6NHmcSJGfPE4jOkHN3cDFqXmHR64aJKK2nXkDOAxMMVrZ0mDb\nawIDAQAB\n-----END PUBLIC KEY-----")
[_, payload, _] := io.jwt.decode(input.token)
}

guest := g if {
g := claims.origin == "guest"
}

authenticated_user := a if {
claims
not guest
a := count(claims) > 0
}

current_user := u if {
not claims.user_name
u := claims.client_id
}

current_user := claims.user_name

everyone := e if {
not guest
e := authenticated_user
}

everyone := e if {
guest
e := guest
}

all service rules

rule id: 1cecb68e-ea07-4e63-8c8d-47b5fdefa596

grant if {
data.request.permission in ["read"]
regex.match(^((\/){0,1}$|(\/.+)){0,1}, data.request.uri)
some group in claims.authorities
group = "sasapp"
}

rule id: 20df631c-73f2-40b3-92da-577860e4fc68

grant if {
data.request.permission in ["read"]
regex.match(^((\/){0,1}$|(\/.+)){0,1}, data.request.uri)
some group in claims.authorities
group = "sasapp"
}

Additional rules of similar structure

service specific rules

rule id: 3b31e89d-ed9e-475f-b8f8-cec1f54a2703

grant if {
data.request.permission in ["read"]
data.request.uri = "/types/"
authenticated_user = true
}

rule id: 800d2c60-3540-46a3-bc45-85a468b0ee9c

grant if {
data.request.permission in ["remove", "create", "add", "delete", "secure", "update"]
regex.match(^/types((\/){0,1}$|(\/.+)){0,1}, data.request.uri)
some group in claims.authorities
group = "sasapp"
}

rule id: 72f043a5-3c45-41ed-9365-d81d758b5bb2

deny if {
data.request.permission in ["remove", "create", "add", "read", "delete", "secure", "update"]
input.folder_hierarchy[_] = "16d6016b-ca0a-438a-b502-538742bef506"
authenticated_user = true
every group1 in claims.authorities {
group1 != "SASAdministrators"
}

every group2 in claims.authorities {
	group2 != "sasapp"
}

}

rule id: 210f694f-e176-48df-9a45-73fc67b46daa

grant if {
data.request.permission in ["read"]
input.folder_hierarchy[_] = "20837ee9-2829-410a-bacf-34ad32f82e45"
authenticated_user = true
}

rule id: f6332789-f9e0-4ca9-b49a-691cf889880d

grant if {
data.request.permission in ["read"]
input.folder_hierarchy[_] = "2ee7e1a8-277b-470d-94ab-ed074c82bd60"
everyone = true
guest = true
}

additional rules of similar structure

bulk decision

bulk_decisions contains result if {
some request in input.requests
g := grant with data.request as request
d := deny with data.request as request
result := {"request": request, "grant": g, "deny": d}
}

granted_links contains request if {
some bd in bulk_decisions
not bd.deny
bd.grant
request := bd.request
}

denied_links contains request if {
some bd in bulk_decisions
bd.deny = true
request := bd.request
}

denied_links contains request if {
some bd in bulk_decisions
bd.grant = false
bd.deny = false
request := bd.request
}

bulk_decision := {"grantedLinks": granted_links}

simple decision

simple_decision contains result if {
g := grant with data.request as input.request
d := deny with data.request as input.request
result := {"grant": g, "deny": d}
}

allow if {
some sd in simple_decision
not sd.deny
sd.grant
}
`

There were a couple recent changes made to the structure of the policy since I tested partial evaluation initially.

1. A switch to get the input from data. i.e "data.request" instead of "input.request" in the rules.
2. Added support to make a bulk decision for multiple Uris.
3. Added support to make a simple decision for a single uri by passing input.request as data.request.

Would these changes impact the output of partial evaluation?

[srenatus]

Would these changes impact the output of partial evaluation?

That's quite substantial changes, so I'd say "sure", but also -- do you bother much about the PE result changes? If so, why?

[robhafner]

Yes, the partial evaluation changes are impactful to us as we are using the returned information to build a criteria clause for a SQL Statement. Some of our authorization rules use ABAC and require information from the row in the database to make a decision. So we would prefer to filter the data at the database level in this case.

FWIW, this is the blog post we have been referring to:
https://blog.openpolicyagent.org/write-policy-in-opa-enforce-policy-in-sql-d9d24db93bf4

The documentation on the following page shows the partial evaluation information required to build the criteria clause showing up in the query section of the result. Is the information on the page out of date? Or could it be missing some information with respect to output and how the policy is defined?
https://www.openpolicyagent.org/docs/latest/rest-api/#partially-evaluate-a-query

In general, I wasn't expecting the structure of the policy to affect the structure of the output for a partial evaluation call.

[johanfylling]

My guess is it's the default allow := false in your policy that forces OPA to create a support module for the query, as allow now effectively has two declarations that partial eval must join. OPA simply isn't "smart" enough to represent this as a query.
I'm not certain however, but it should be easy to verify by removing that default term.

[robhafner]

I commented out the following two defaults and ran the OPA cli.

default allow := false
default grant := false

opa eval "data.sas.audit.authz.allow" -p -u "data.resources" -i input.json -b .

The output of the command with the "-f pretty" option is:

+-----------+--------------------------------------------------------------------------------------------------------------------------+
| Query 1   | data.partial.sas.audit.authz.grant = _term_1_21 with data.request as {"permission": "read", "uri": "/audit/entries/123"} |
|           | _term_1_21                                                                                                               |
+-----------+--------------------------------------------------------------------------------------------------------------------------+
| Support 1 | package partial.sas.audit.authz                                                                                          |
|           |                                                                                                                          |
|           | grant {                                                                                                                  |
|           |   "wfuser1" = data.resources[__local51__36].user                                                                         |
|           | }                                                                                                                        |
+-----------+--------------------------------------------------------------------------------------------------------------------------+

Here is the output without the "-f pretty" option. The information required to build the SQL criteria clause still appears to be in the modules -> rules sections of the output.

  "partial": {
    "queries": [
      [
        {
          "index": 0,
          "terms": [
            {
              "type": "ref",
              "value": [
                {
                  "type": "var",
                  "value": "eq"
                }
              ]
            },
            {
              "type": "ref",
              "value": [
                {
                  "type": "var",
                  "value": "data"
                },
                {
                  "type": "string",
                  "value": "partial"
                },
                {
                  "type": "string",
                  "value": "sas"
                },
                {
                  "type": "string",
                  "value": "audit"
                },
                {
                  "type": "string",
                  "value": "authz"
                },
                {
                  "type": "string",
                  "value": "grant"
                }
              ]
            },
            {
              "type": "var",
              "value": "$_term_1_21"
            }
          ],
          "with": [
            {
              "target": {
                "type": "ref",
                "value": [
                  {
                    "type": "var",
                    "value": "data"
                  },
                  {
                    "type": "string",
                    "value": "request"
                  }
                ]
              },
              "value": {
                "type": "object",
                "value": [
                  [
                    {
                      "type": "string",
                      "value": "permission"
                    },
                    {
                      "type": "string",
                      "value": "read"
                    }
                  ],
                  [
                    {
                      "type": "string",
                      "value": "uri"
                    },
                    {
                      "type": "string",
                      "value": "/audit/entries/123"
                    }
                  ]
                ]
              }
            }
          ]
        },
        {
          "index": 1,
          "terms": {
            "type": "var",
            "value": "$_term_1_21"
          }
        }
      ]
    ],
    "modules": [
      {
        "package": {
          "path": [
            {
              "type": "var",
              "value": "data"
            },
            {
              "type": "string",
              "value": "partial"
            },
            {
              "type": "string",
              "value": "sas"
            },
            {
              "type": "string",
              "value": "audit"
            },
            {
              "type": "string",
              "value": "authz"
            }
          ]
        },
        "rules": [
          {
            "body": [
              {
                "index": 0,
                "terms": [
                  {
                    "type": "ref",
                    "value": [
                      {
                        "type": "var",
                        "value": "eq"
                      }
                    ]
                  },
                  {
                    "type": "string",
                    "value": "wfuser1"
                  },
                  {
                    "type": "ref",
                    "value": [
                      {
                        "type": "var",
                        "value": "data"
                      },
                      {
                        "type": "string",
                        "value": "resources"
                      },
                      {
                        "type": "var",
                        "value": "__local51__36"
                      },
                      {
                        "type": "string",
                        "value": "user"
                      }
                    ]
                  }
                ]
              }
            ],
            "head": {
              "name": "grant",
              "value": {
                "type": "boolean",
                "value": true
              },
              "ref": [
                {
                  "type": "var",
                  "value": "grant"
                }
              ]
            }
          }
        ]
      }
    ]
  }
}```

[johanfylling]

What is the original form of the optimized grant rule (maybe provide the complete policy, as it seems the one provided in the original question isn't up to date)?
Another guess is that there is something in that grant rule that could be optimized, and couldn't be inlined into the query. Maybe because there are several grant rules(?).

[johanfylling]

Thinking about it, since it's the optimized rule (data.partial.sas.audit.authz.grant) that's called directly, any other grant rules should be irrelevant.

It might even be the with that prevents the optimized grant rule to be inlined into the query. I'm thinking the original rule had more terms in the body that got dropped by the optimization, and even though there is only one term remaining, it isn't inlined 🤔 . As @srenatus , says above.

[robhafner]

Attaching the input file and policy file for completeness.

input.json
main.rego.txt

We can certainly consider parsing the information out of the modules/rules section if that is the right answer. However, I have some concern with doing that as it is unclear if a future modification to our policy will result in structural changes to the output again.

[srenatus]

However, I have some concern with doing that as it is unclear if a future modification to our policy will result in structural changes to the output again.

That's understandable. But since partial eval is eval of a policy, changing the policy can change the outcome. That's a fundamental limitation of the PE-and-SQL approach. It doesn't mean it cannot be made to work, but it requires some care and attention.

[robhafner]

Thanks for the explanation! That makes sense now.

I don't think this will prevent us from using the partial evaluation functionality as I assume once our policy structure stabilizes the partial evaluation output should as well. In addition, our automated tests should catch any unexpected output and thus limit the risk of us delivering broken functionality as a result of a policy change.

[robhafner]

Is it still possible to rely on the Query portion of the output to determine if the decision is unconditionally granted or partially granted as mentioned in the table found on this page:

https://www.openpolicyagent.org/docs/latest/rest-api/#partially-evaluate-a-query

The reason I'm asking is if I swap the token for one that is an administrator I would expect to receive an unconditional decision. However, I don't see an empty query in the response. I've confirmed I do receive an allow=true decision when dropping the partial evaluation arguments (-p -u "data.resources") from the command with the administrator token.

Just looking to make sure I understand how to interpret the output correctly.

Output:

  "partial": {
    "queries": [
      [
        {
          "index": 0,
          "terms": {
            "type": "ref",
            "value": [
              {
                "type": "var",
                "value": "data"
              },
              {
                "type": "string",
                "value": "partial"
              },
              {
                "type": "string",
                "value": "sas"
              },
              {
                "type": "string",
                "value": "audit"
              },
              {
                "type": "string",
                "value": "authz"
              },
              {
                "type": "string",
                "value": "allow"
              }
            ]
          }
        }
      ]
    ],
    "modules": [
      {
        "package": {
          "path": [
            {
              "type": "var",
              "value": "data"
            },
            {
              "type": "string",
              "value": "partial"
            },
            {
              "type": "string",
              "value": "sas"
            },
            {
              "type": "string",
              "value": "audit"
            },
            {
              "type": "string",
              "value": "authz"
            }
          ]
        },
        "rules": [
          {
            "body": [
              {
                "index": 0,
                "terms": {
                  "type": "boolean",
                  "value": true
                }
              }
            ],
            "default": true,
            "head": {
              "name": "allow",
              "value": {
                "type": "boolean",
                "value": false
              },
              "ref": [
                {
                  "type": "var",
                  "value": "allow"
                }
              ]
            }
          },
          {
            "body": [
              {
                "index": 0,
                "terms": [
                  {
                    "type": "ref",
                    "value": [
                      {
                        "type": "var",
                        "value": "eq"
                      }
                    ]
                  },
                  {
                    "type": "ref",
                    "value": [
                      {
                        "type": "var",
                        "value": "data"
                      },
                      {
                        "type": "string",
                        "value": "partial"
                      },
                      {
                        "type": "string",
                        "value": "sas"
                      },
                      {
                        "type": "string",
                        "value": "audit"
                      },
                      {
                        "type": "string",
                        "value": "authz"
                      },
                      {
                        "type": "string",
                        "value": "grant"
                      }
                    ]
                  },
                  {
                    "type": "var",
                    "value": "$_term_1_21"
                  }
                ],
                "with": [
                  {
                    "target": {
                      "type": "ref",
                      "value": [
                        {
                          "type": "var",
                          "value": "data"
                        },
                        {
                          "type": "string",
                          "value": "request"
                        }
                      ]
                    },
                    "value": {
                      "type": "object",
                      "value": [
                        [
                          {
                            "type": "string",
                            "value": "permission"
                          },
                          {
                            "type": "string",
                            "value": "read"
                          }
                        ],
                        [
                          {
                            "type": "string",
                            "value": "uri"
                          },
                          {
                            "type": "string",
                            "value": "/audit/entries/123"
                          }
                        ]
                      ]
                    }
                  }
                ]
              },
              {
                "index": 1,
                "terms": {
                  "type": "var",
                  "value": "$_term_1_21"
                }
              }
            ],
            "head": {
              "name": "allow",
              "value": {
                "type": "boolean",
                "value": true
              },
              "ref": [
                {
                  "type": "var",
                  "value": "allow"
                }
              ]
            }
          },
          {
            "body": [
              {
                "index": 0,
                "terms": {
                  "type": "boolean",
                  "value": true
                }
              }
            ],
            "default": true,
            "head": {
              "name": "grant",
              "value": {
                "type": "boolean",
                "value": false
              },
              "ref": [
                {
                  "type": "var",
                  "value": "grant"
                }
              ]
            }
          },
          {
            "body": [
              {
                "index": 0,
                "terms": {
                  "type": "boolean",
                  "value": true
                }
              }
            ],
            "head": {
              "name": "grant",
              "value": {
                "type": "boolean",
                "value": true
              },
              "ref": [
                {
                  "type": "var",
                  "value": "grant"
                }
              ]
            }
          },
          {
            "body": [
              {
                "index": 0,
                "terms": {
                  "type": "boolean",
                  "value": true
                }
              }
            ],
            "head": {
              "name": "grant",
              "value": {
                "type": "boolean",
                "value": true
              },
              "ref": [
                {
                  "type": "var",
                  "value": "grant"
                }
              ]
            }
          },
          {
            "body": [
              {
                "index": 0,
                "terms": [
                  {
                    "type": "ref",
                    "value": [
                      {
                        "type": "var",
                        "value": "eq"
                      }
                    ]
                  },
                  {
                    "type": "string",
                    "value": "sasboot"
                  },
                  {
                    "type": "ref",
                    "value": [
                      {
                        "type": "var",
                        "value": "data"
                      },
                      {
                        "type": "string",
                        "value": "resources"
                      },
                      {
                        "type": "var",
                        "value": "__local51__36"
                      },
                      {
                        "type": "string",
                        "value": "user"
                      }
                    ]
                  }
                ]
              }
            ],
            "head": {
              "name": "grant",
              "value": {
                "type": "boolean",
                "value": true
              },
              "ref": [
                {
                  "type": "var",
                  "value": "grant"
                }
              ]
            }
          }
        ]
      }
    ]
  }
}```

[robhafner]

Any thoughts on my previous question?

Also, is there any documentation or unit tests that might help with understanding the AST better with respect to a partial evaluation decision?

[srenatus]

I'm guessing that the "with" was inhibiting some things here. Can you retry this with your current set of policies?

[robhafner]

Seeing the following error when attempting to use the "some" keyword in the rule conditions defined in the array of the function. Is the some keyword not supported in this case? Or is there an alternative syntax that should be used? I suspect it might be the latter so I tried poking around in the OPA source code but didn't have any luck finding an example like this.

1 error occurred: policy.rego:72: rego_parse_error: unexpected some keyword some resource1 in data.resources, ^

https://play.openpolicyagent.org/p/7xD9a9MfH3

[anderseknert]

You can't use iteration directly inside of a set, but I guess you could turn it into a comprehension, like:

{match |
    some resource1 in data.resources
    match := resource1.createdBy == claims.client_id
} == {true}

[robhafner]

Thanks! That's working for this use case.

I'm also converting the authorities array from the token into a set using the following syntax as described here:

groups := {g | g = claims.authorities[_]}

When I attempt to use 'groups' in a rule condition this syntax works:

groups[_] == "unix_r&d"

However, the syntax described here to check if the value exists doesn't appear to work.

groups["unix_r&d"]

Am I am misunderstanding how this should work? In our use case a token may have many authorities so I was hoping to optimize the check by using a set instead of an array.

One additional thing that I noticed is that the use of "not" results in the following parse error.

1 error occurred: policy.rego:78: rego_parse_error: unexpected not keyword not groups[_] == "unix_r&d"

Is 'not' disallowed when using an array of sets to define the rule condition? I guess I'm trying to understand what is allowed/disallowed when using this approach to defining the rule conditions?

Playground example:
https://play.openpolicyagent.org/p/fsPJyw9RDT