Using OPA REST API always returns "false" while command line and playground return "true"

[MrLightSpeed0]

Expected Behavior

The results of API call should be the same command line or Playground

Actual Behavior

API calls always returns false

Steps to Reproduce the Problem

Here is my simple policy (playPolicy.rego):

package play

default allow = false

allow {
  input.method == "GET"
}

Here is my input file (playInput.json)

{
    "method": "GET"
}

1. when I try this using RegoPlayground, the evaluation is true (https://play.openpolicyagent.org/p/cIWCURitWQ)

2. I then tried it using command line (I am using OPA 0.34.1)

3. Then I deployed a docker container (downloaded from the official location) out of port 9090. I tried port 8181 on my linux as well also I tried various opa versions as well, same results.
   docker run -d -p 9090:9090 --name opa openpolicyagent/opa:0.34.1 run --server --log-level debug -a :9090

4. Then I uploaded my policy using following command:
   curl -X PUT --data-binary @playPolicy.rego localhost:9090/v1/policies/play

5. Then I used GET to retrieve the contents
   curl localhost:9090/v1/policies/play
   all looked good

6. Then I query with following call to get results and I got false, which is very strange!
   curl -X POST localhost:9090/v1/data/play/allow -d @playInput.json -H 'Content-Type: application/json'

7. Tried with PostMan as well, same results

8. As part of debug, I added print() to my policies and run it on command line. my value was printed out correctly and the return was true. So am I calling API wrong? I added ?explain=full&pretty to the API call. although I dont quite understand the meaning of it, here is detail:

{
    "explanation": [
        "query:1     Enter data.play.allow = _",
        "query:1     | Eval data.play.allow = _",
        "query:1     | Index data.play.allow (matched 0 rules)",
        "play:3      | Enter data.play.allow",
        "play:3      | | Eval true",
        "play:3      | | Exit data.play.allow",
        "query:1     | Exit data.play.allow = _",
        "query:1     Redo data.play.allow = _",
        "query:1     | Redo data.play.allow = _",
        "play:3      | Redo data.play.allow",
        "play:3      | | Redo true"
    ],
    "result": false
}

Please help. Many thanks!!!

• Eric

Additional Info

[srenatus]

For the v1 data API, input needs to be wrapped in {"input": ... }. Does that do the trick, perhaps?

[MrLightSpeed0]

For the v1 data API, input needs to be wrapped in {"input": ... }. Does that do the trick, perhaps?

YES! IT DOES!! Thank you so much!!!

[gituserjava]

@srenatus , I am getting the exact same issue however in my case the input is generated by the http request and sent to OPA; I am not passing any input manually. How will be the format in such a case? Please advise.

Below is policy and the input that is working in rego playground.

Policy:

package demo

default allow = false

allow = {
        input.headers["x-custom-header"] == "foo"
}

Input in rego playground:

{
       "headers": {
              "x-custom-header" :"foo"
        }
}

Rego playground output:

{
     "allow": [
           true
     ]
}

[srenatus]

generated by the http request and sent to OPA;

And what is doing that generation...?

If push comes to shove, the v0 API doesn't require the wrapping. But perhaps there's a better solution.

[gituserjava]

@srenatus , from postman I am calling my endpoint by passing the header x-custom-header: foo. It is first routed to envoy sidecar which in turn calls OPA and forwards the request headers to OPA. I am assuming headers are sent as standard HTTP format and not in the JSON that you see in the input above. Essentially the browser is preparing the http request. Please advise.

GET /api/v1/employees/departments
Accept: */*
x-custom-header : foo

[srenatus]

Let's make this another question, what do you think? Seems quite different from the problem at hand here, with envoy in the mix.

[gituserjava]

@srenatus , that makes sense. I added new ticket here:
#60