How to create OPA rego policy for a whitelist? - policy

Question

I am trying to implement a whitelist policy in OPA rego. The purpose of the policy is to block all attributes except for attributes that have been whitelisted. However, I cannot get it to work.
Here is my rego policy:
package play
whitelisted_attributes =
{
"foo.bar",
"hello.from.*.world"
}
default allow = false
default not_in_whitelist = true
not_in_whitelist {
whitelisted := {attr | attr := input.attributes[_]; glob.match(whitelisted_attributes[_], ["."], attr)}
count(whitelisted) == 0
}
allow {
not not_in_whitelist
}
Here is my input:
{
"attributes": [
"foo.bar"
]
}
Here is the output according to the Rego Playground:
{
"allow": false,
"not_in_whitelist": true,
"whitelisted_attributes": [
"foo.bar",
"hello.from.*.world"
]
}
As you can see, "allow" should be true since the input is found in the whitelist. Also, "not_in_whitelist" should be false since the input attribute is in the whitelist.

Answer 1

What's happening here is that since one of the elements is in the whitelist, the not_in_whitelist rule is going to evaluate to undefined (since that's what a rule where all conditions aren't met evaluates to).
Since not_in_whitelist evaluates to undefined, the rule will be assigned the default value of true:
default not_in_whitelist = true
The allow rule will then invert that in the not check, making the rule fail (since not true == false):
allow {
not not_in_whitelist
}
I'd suggest simply removing the default assignment for not_in_whitelist.

Answer 2

Thanks #Devoops for your tip. I went back to the Rego Playground and after much trial and error came up with a working policy. I'm posting it here for others with similar needs.
package play
default allow = false
default in_whitelist = false
whitelist =
{
"foo.bar",
"hello.from.*.world"
}
num_attributes := count(input.attributes)
in_whitelist {
glob.match(whitelist[_], ["."], input.attributes[_])
}
not_in_whitelist = result {
num_attributes == 1
result := (in_whitelist == false)
}
not_in_whitelist = result {
num_attributes > 1
whitelisted := {attr | attr := input.attributes[_]; glob.match(whitelist[_], ["."], attr)}
result := (count(whitelisted) < num_attributes)
}
allow {
not not_in_whitelist
}
deny[msg] {
not_in_whitelist
msg = sprintf("You are only allowed to modify the following whitelisted attributes: %v", [whitelist])
}