Using OR condition in OPA rego

user_14239883 0
Viewed 3180

I want to do an OR operation for the following where the count of my arr is not equal to 0 and that my email does not contain "test.com", however my rule is producing an error, any help on how to improve it in one line is much appreciated! Thank you in advance

any([count(arr) != 0, not contains(email, "test.com")])
open-policy-agent rego
2 Answers

More generally, Rego does not allow OR-ing statements in the same function. Using any() works well for simple cases, but can become unwieldy for complex ones so it is considered an antipattern.

Instead, Rego uses incremental rules, where every statement within each Rule is AND-ed together, and rules of the same name are OR-ed together.

Consider the following deny rule. In short, it says that we will deny the request if at least one of:

  1. The user is not an admin, or
  2. Today is Sunday.
deny {
    input.role != "admin"
}

deny {
    time.weekday(time.now_ns()) == "Sunday"
}

This would only allow requests to the admin role on days other than Sunday. If instead we said:

deny {
    input.role != "admin"
    time.weekday(time.now_ns()) == "Sunday"
}

We would then only deny requests from non-admin roles on Sunday. Requests from admin would always be allowed.

user_25929620

The not keyword is a bit of a special case in that it can't be used inside of many contexts such as the array of your example. I believe this could be improved in OPA, but until then you can trivially avoid it for at most cases, like the one you provided:

any([count(arr) != 0, contains(email, "test.com") == false])
user_118492430
Related