opa icon indicating copy to clipboard operation
opa copied to clipboard

Allow JSON schema verification on input when running as server

Open anderseknert opened this issue 3 years ago • 7 comments

The new (and awesome!) feature for doing schema verification of the input document should be available when running OPA as a server. This would cleanly separate input verification from "real" policy, and would eliminate the need for much of the boiler plate around input checking found in certain type of policies.. at least if the input verification was known to have run before policy evaluation.

CC @aavarghese @vazirim

anderseknert avatar Apr 01 '21 14:04 anderseknert

Doing schema verification on input would also be an alternative for some #2095 use cases. For example, instead of using the error-on-undefined "dot" operator in input documents, one could declare the property as required in JSON schema.

mattmahn avatar Apr 07 '21 17:04 mattmahn

Totally @mattmahn .. I would expect most use cases for the dot operator to vanish in schema backed policies. It would still be useful for optional and unknown values though of course.

anderseknert avatar Apr 07 '21 20:04 anderseknert

This issue has been automatically marked as inactive because it has not had any activity in the last 30 days.

stale[bot] avatar Jan 02 '22 04:01 stale[bot]

Any updates in this one?

JohnBjrk avatar Apr 19 '22 13:04 JohnBjrk

This issue has been automatically marked as inactive because it has not had any activity in the last 30 days.

stale[bot] avatar May 19 '22 14:05 stale[bot]

bot, go away. we stil has a lot of interest in this issue.

eshepelyuk avatar Jul 08 '22 04:07 eshepelyuk

This issue has been automatically marked as inactive because it has not had any activity in the last 30 days.

stale[bot] avatar Aug 07 '22 04:08 stale[bot]

This feature could help with concerns we have regarding the potential for erroneous auth-z decisions in the presence of unexpected input. We are considering developing some features around input validation for ourselves, so if there is alignment in direction here we might be able to contribute.

charlieflowers avatar Sep 25 '22 03:09 charlieflowers