How to evaluate non-existence of a value/attribute as true

[Kamalakannangv]

Hi,
I am new to OPA/Rego language and couldn't figure out how to solve my below problem.

My input data is something like this { "object": { "value": "1" }} and want to have rule that will return true if "value" attribute is not present in the "object" or if its value is "1" i.e. "object.value" == "1".

I tried few things but couldn't get; please refer https://play.openpolicyagent.org/p/ZIJmGRgzB3.
Thanks.

[srenatus]

I suggest you use multiple allow rule bodies -- they will be implicitly OR'ed together. So something along these lines:

default allow = false

allow { # absent key
	not has_key(data.object, "value")
}

allow { # if it's there, it's got to be "1"
	data.object.value == "1"
}

See also this playground

[Kamalakannangv]

Thanks @srenatus for your quick response.

We have quite a few similar attributes (to be precise 4) and are having n x n rules; please have a look at this https://play.openpolicyagent.org/p/WPmIeNnZ8n. Here I have used 2 attributes and already having 4 ‘allow’ rules, so wanted to check with Rego experts whether this can be addressed in a better way.

[srenatus]

In this case, you can use object.get and have the default match your expected value. You can then combine your four rules into one:

allow { 
	object.get(data.object, "value1", "1") == "1"
	object.get(data.object, "value2", "test") == "test"
}

I.e. if data.object.value1 does not exit, it'll return "1"; and if it does exist, it'll return its value, which must be "1".

[Kamalakannangv]

Thanks again @srenatus for your quick response. I think this will work.