OPA masking a dynamic array field

user_3342496 0
Viewed 90

I'm trying to apply masking on an input and result field that is part of an array. And the size of the array is dynamic. Based on the documentation, it is instructed to provide absolute array index which is not possible in this use case. Do we have any alternative?

Eg. If one needs to mask the age field of all the students from the input document?

Input:

"students" : [
  {
    "name": "Student 1",
    "major": "Math",
    "age": "18"
  },
  {
    "name": "Student 2",
    "major": "Science",
    "age": "20"
  },
  {
    "name": "Student 3",
    "major": "Entrepreneurship",
    "age": "25"
  }
]
open-policy-agent rego
1 Answers

If you want to just generate a copy of input that has a field (or set of fields) removed from the input, you can use json.remove. The trick is to use a comprehension to compute the list of paths to remove. For example:

paths_to_remove := [sprintf("/students/%v/age", [x]) | some x; input.students[x]]
result := json.remove(input, paths_to_remove)

If you are trying to mask fields from the input document in the decision log using the Decision Log Masking feature then you would write something like:

package system.log

mask[x] {
    some i
    input.input.students[i]
    x := sprintf("/input/students/%v/age", [i])
}
user_41477250
Related