Conversion of Rules defined in Json to Rego

[trinoy]

Hello Team,

We are trying to build an layer on top of rego to enable developers to writes policy in JSON and down the line may be though a user interface(which can generate a JSON). For example something like

"rule": {
          "if": {
            "allOf": [ // possible values allOf / anyOf
              {
                "value": "user.roles",
                "contains": {
                 "value" : "123"
                }
              }
            ]
          },
          "then": {
            "allow": "true"
          },
          "else": {
            "allow": "false"
          }
        }
      }
    }

We would like to convert this to something

allow {
  input.user.roles[_] = "123" 
}

Could you please help us if there is a way to support this via UDF functions , Json to rego AST etc. Would like to understand if this is possible and if yes what direction we should look into

Thanks
Trinoy

[charlieegan3]

Converting the JSON policy in an automated way isn't a simple job, but using the JSON from rego is doable: https://play.openpolicyagent.org/p/UQnIce70En

It's not the cleanest policy, but it might unblock you.

My recommendation would be to take the time and re-write the policy in Rego in the long term but the example above might allow you to make some quick progress with OPA initially. Lmk how that goes.

[trinoy]

we have a requirement to publish our tool to a wide range of users - Product, Developers, QA and all dont have knowledge of rego. we want to build a lightweight policy editor UI on top of Json model and do the heavy lifting and convert the json model to rego.

[ashutosh-narkar]

FWIW we did some experiments in generating Rego code from an OpenAPI spec if that's helpful. See this for details.

[trinoy]

thanks will look into the code. Btw do you convert the OpenAPI spec into rego UDF functions, rego AST or use a template approach ?

[ashutosh-narkar]

It uses the Extensions Object in the OpenAPI 3.0 specification to generate Rego rules that return boolean values, collections etc. The spec would be provided by the user.

[trinoy]

thanks for the information

[ashutosh-narkar]

This blog may also be a good reference. It's a YAML representation of Rego.