How to compose batch object

[lukyer]

Hi all,
I'm fighting Rego to achieve simple bulk operation (i.e. evaluate permissions for these 1000 entities at once). How can I compose this resulting object regardless some rule evaluation is FALSE ? The falsy rule always terminate the main flow. Basically I need standard else branching in rules 😄

I have also tried comprehension with no luck. Another thing I tried is to compose several objects with truthy logic only and try to merge it in the end but merge/map is not easily doable using std lib.

I must have been missing something basic 😄

Minimal example: https://play.openpolicyagent.org/p/uPp6OmMyx0

Thanks!

[anderseknert]

Hi @lukyer!

If no return value is defined for a rule or function, Rego will consider the result to be undefined on failure (i.e. if not all of the conditions in the body are true). As you noted, encountering undefined stops policy evaluation. When working with boolean rules (e.g. "allow", etc) it's a comon practice to assign a default value of false to the rule so that failure still evalutes to something, whiich would be boolean false.

Functions cannot yet have a default value assigned, so you'll commonly see either another function declaration to handle the "other" case, or simply an else clause to deal with the failure case.

Your example using else to ensure the functions return false rather than undefined: https://play.openpolicyagent.org/p/P7U3SyohSq

[lukyer]

@anderseknert thanks! That is the else syntax for functions I was missing 😄

I have tried the default value for functions as you noted with no luck but I haven't discovered this trick. It would be great to document it here and/or here.

[anderseknert]

Yeah, at least a pointer to the docs on else from that first link (the section on functions) would be good, I think. If you'd want to create an issue — or even a PR — to have that added, that'd be great 🙂

[lukyer]

open-policy-agent/opa#4996

[anderseknert]

Nice, thanks 👍