open policy agent 返回的 json 响应的测试属性与 opa 测试

Question

有没有办法在 OPA 返回的决定的 json 响应中测试 key/attribute 的值。（返回的响应不是 yes/no 而是 json 带有决定决定的关键 allow ）例如：

test_get_user_allowed_for_admin {
        decision["allow"] with input as {"path": ["users", "kate"], "method": "GET", "user_id": "bob"}
}

假设评估的政策是以下形式：

get_user_info = decision{
    decision := {
      "allow": input.user_id == "bob", "user_id": input.user_id,
  }
}

目前我得到一个 var decision is unsafe 错误，因为 test_get_user_allowed_for_admin 中没有定义决定，但这只是一个填充物

Answer 1

您的测试可以像检查任何其他值（例如，input、局部变量等）一样检查规则 get_user_info 生成的值

例如：

test_get_user_allowed_for_admin {
  in := {
    "path": ["users", "kate"],
    "method": "GET",
    "user_id": "bob"
  }

  result := get_user_info with input as in
  result.allow == true
  result.user_id == "bob"
}

# OR

test_get_user_allowed_for_admin_alt {
  in := {
    "path": ["users", "kate"],
    "method": "GET",
    "user_id": "bob"
  }
  result := get_user_info with input as in
  result == {"allow": true, "user_id": "bob"}
}

从技术上讲，您不必将 get_user_info 生成的值分配给变量：

test_get_user_allowed_for_admin_oneline {
  in := {
    "path": ["users", "kate"],
    "method": "GET",
    "user_id": "bob"
  }
  get_user_info.allow with input as in
}

open policy agent 返回的 json 响应的测试属性与 opa 测试

Test attribute of the json response returned by open policy agent with opa test

open-policy-agent