open-policy-agent / opa

Open Policy Agent (OPA) is an open source, general-purpose policy engine.
https://www.openpolicyagent.org
Apache License 2.0
9.56k stars 1.33k forks source link

OPA inspect command failing after version upgrade on mock-tests for remote/external function dependencies #6812

Closed surajupadhyay01 closed 3 months ago

surajupadhyay01 commented 3 months ago

Short description

We have observed a deviation in the OPA CLI command: inspect, after we upgraded from OPA CLI version: 0.56.0 to version: 0.65.0. The inspect command is passing in OPA CLI version 0.56.0 while failing for the version 0.65.0, when we have a remote rego function dependency, and it is mocked in the test files.

Steps To Reproduce

Rego files directory structure:

Attached the required files to the issue for reference

Below are the file contents:

  1. remote-function-error/remote-dependency/remote-policy.rego
    
    package some_remote_package.policy

This function takes in number and returns true if it is even else false

is_even(num) { print("Checking if number: ", num, " is even or not") num % 2 == 0 print(num, " is even") true } else { print(num, "is not even") false }


2. remote-function-error/local-policy/**policy.rego**

package remote.function.error.policy

import data.some_remote_package.policy.is_even as is_even

Calls the remote is_even() function in a way it will return true. So the output would be true

pdp = output { print("At PDP") is_even(0) == true print("is_even() returned true") output = true } else = output { print("is_even() returned false") output = false }


3. remote-function-error/local-policy/**policy_test.rego**

package remote.function.error.policy

Mock the remote is_even() function to return false when argument '0' is passed

mock_is_even(0) := false

test_pdp = test_result { print("test-pdp") response := pdp with data.some_remote_package.policy.is_even as mock_is_even

print("Response received: ", response)
response == false
print("Test passed with mock function")
test_result = true

} else { print("Test failed with mock function") test_result = false }


## OPA CLI INSPECT command outputs
<!--
Describe what you expected to happen.
-->
CLI Command: .\opa-0.56.exe inspect .\remote-function-error\local-policy\
Output:

NAMESPACES: +-----------------------------------+----------------------------------------------------+ | NAMESPACE | FILE | +-----------------------------------+----------------------------------------------------+ | data.remote.function.error.policy | remote-function-error\local-policy\policy.rego | | | remote-function-error...l-policy\policy_test.rego | +-----------------------------------+----------------------------------------------------+


CLI Command: .\opa-0.65.exe inspect .\remote-function-error\local-policy\
Output:

error: 1 error occurred: remote-function-error\local-policy\policy_test.rego:9: rego_type_error: undefined ref: data.remote.function.error.policy.mock_is_even data.remote.function.error.policy.mock_is_even ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ have: (number) => boolean

philipaconrad commented 3 months ago

This is could be related to #6457, I think? @johanfylling might know more. :thinking:

johanfylling commented 3 months ago

@philipaconrad, yes, this looks like it could be an unsolved edge case to the issue fixed in #6457.

surajupadhyay01 commented 3 months ago

Yes, the similar cases are mentioned in issues: https://github.com/open-policy-agent/opa/issues/6457 and https://github.com/open-policy-agent/opa/issues/6591