How to operate on array while masking with Decision logs?

[RohitRox]

I have been trying to incorporate masking with Decision logs.
Got the basics working. But I could not get masking of keys/values inside an array working.
Documentation says something like /input/emails/0/value is perfectly allowed.
However I couldn't see working in scenario like
I have in payload

{ emails: [ { email: "[email protected]" }, { email: "[email protected]" } ] 

Tried something like this with rego

package system.log

import rego.v1

mask contains {"op": "upsert", "path": x, "value": "**EMAIL REDACTED**"} if {
	some i
	input.parsed_body.emails[i]
	x := sprintf("/input/parsed_body/emails/%v/email", [i])
}

The masking does not work.
Can somebody help me figure how we can operator on simple array items in parsed_body?

(Here' s playground link I have been experimenting: https://play.openpolicyagent.org/p/xMCAO1hNbA)

[charlieegan3]

Hi @RohitRox , thanks for the question here. I think might have a bug here, I've opened an issue for you to continue the chat there open-policy-agent/opa#6883 - please feel free to comment and follow along there.

[RohitRox]

Thanks for helping out here Charlie

[charlieegan3]

No probs! Hopefully you can use remove to get unblocked in the meantime. I've not got the bandwidth to look into the issue this week but happy to review a PR if you'd like to take a go :)

[RohitRox]

I'd love to do that. I am new comer to this project and Golang, Will try my best to come up with something.
I managed to get an upsert scenario for this use-case in mask_test.go and it fails.
I am pretty sure mkdirp needs to be refactored.
As I was analyzing other tests, I am seeing in here https://github.com/open-policy-agent/opa/blob/main/plugins/logs/mask_test.go#L481C1-L482C1
which is hinting this scenario was not supported intentionally ?!

[charlieegan3]

Hmm - now that's interesting and seems to differ what's listed in the docs. So at least one of those needs to change!

I think that since some other unusual cases are covered, e.g. upsert: undefined object: missing key, provided value, it'd be nice if we could make it work for your case too.

I'll put a note in the issue, but I think that being able to support this case is still the right thing to do.