open-policy-agentrego

Rego - Pass if value in set is in allowed_values set


I'm trying to have a policy pass if a value in input_set matches a value in allow_values

The below policy example is also here if you'd like to modify it easier - https://play.openpolicyagent.org/

I'm sure that I'm not understanding the use of some but at this point I'm just a bit too turned around and there is probably a better way to have a check like this.

package sometesting
import future.keywords

# Check these values against `allow_values`
input_set := {"b-phone", "a-pad", "a-car"}

# If these values are in the set - don't fail the policy
allow_values := {"b-phone", "a-pad"}

# I can check the values individually like below
policy_1[result] {

    not "b-phone" in input_set
    not "a-pad" in input_set

    true
    
    result := "policy_failed"
}

# However when I try to use some, it doesn't seem to pass the policy when they match
policy_2[result] {

    some value in input_set
    not value in allow_values
    # I thought this should return : 
    # true
    # false
    # false

    true
    
    result := "policy_failed"
}

# I was expecting it to essentially end up like this and fail if one item in the some statement was false, however I seem to be a bit confused on this.
policy_3[result] {


    true
    false
    false

    true
    
    result := "policy_failed"
}

EDIT

I think this will work ( I don't have enough rep to add the answer )

policy_2[result] {

    in_allowed_values

    true
    
    result := "policy_failed"
}


in_allowed_values := false {
    contains(allow_values[_], input_values[_])
} else = true

Solution

  • I think that set intersection would be the best way to do this:

    package sometesting
    
    import future.keywords
    
    input_set := {"b-phone", "a-pad", "a-car"}
    
    allow_values := {"b-phone", "a-pad"}
    
    policy contains result if {
        input_set & allow_values == set()
    
        result := "policy_failed"
    }
    

    Here we test if the input set and the allow_values have any elements in common by computing the intersection. If this set of common elements is empty, then it's a policy violation.