opa
opa copied to clipboard
Improve rule indexer to support multiple expressions
Currently, rule index lookups only support static expressions of the form <ref> = <constant>
where the <ref>
typically refers to an input value. In many cases, it would be advantageous if rule index lookups could resolve more dynamic expressions in the context of queries like...
x = input.method
y = upper(x)
y = "GET"
To achieve this, the rule index construction will need to be more intelligent and lookups may need to perform evaluation (recursively).
#4894 revealed that "naked refs" (for the lack of a better term) also aren't considered for indexing.
E.g.
allow {
input.just_be_present
}
whereas something like this is,
allow {
input.just_be_present != false
}
through the ordinary rewriting to an equal expression, and that being indexed.