open-policy-agent / opa

Open Policy Agent (OPA) is an open source, general-purpose policy engine.
https://www.openpolicyagent.org
Apache License 2.0
9.56k stars 1.33k forks source link

JSON Schema: `additionalProperties` support #6527

Open ffortier opened 8 months ago

ffortier commented 8 months ago

Short description

I have a jsonschema containing a map definition of typed objects, but opa check is not able to detect typos in it. My current workaround is to define an array instead of a map but it might not work if I need to unify with the key as a string value.

I put some code in this repo to reproduce this issue: https://github.com/ffortier/opa-jsonschema-test

Steps To Reproduce

  1. Create a json schema with the following definition:
    {
    "$schema": "http://json-schema.org/draft-07/schema#",
    "type": "object",
    "properties": {},
    "required": [],
    "additionalProperties": {
        "$ref": "#/definitions/User"
    },
    "definitions": {
        "User": {
            "type": "object",
            "additionalProperties": false,
            "properties": {
                "name": {
                    "type": "string"
                }
            },
            "required": [
                "name"
            ]
        }
    }
    }
  2. Create a rego policy with the schemas annotation
  3. Create a rule with a typo
  4. Run opa check with the schema

Expected behavior

opa check should detect schema issues in maps but does not.

Additional context

I tested the same schema with python's jsonschema package just to be sure and the errors are detected correctly.

anderseknert commented 8 months ago

The schema feature does not currently support additionalProperties or additionalItems.

For the example above, using properties instead should work.

stale[bot] commented 7 months ago

This issue has been automatically marked as inactive because it has not had any activity in the last 30 days. Although currently inactive, the issue could still be considered and actively worked on in the future. More details about the use-case this issue attempts to address, the value provided by completing it or possible solutions to resolve it would help to prioritize the issue.