opa

package

v0.4.2 Latest Latest Go to latest Published: Oct 26, 2026 License: Apache-2.0 Imports: 6 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/wso2/api-platform

Links

Open Source Insights

Documentation ¶

Overview ¶

Package opa provides a deterministic Open Policy Agent (OPA) data API for the opa-policy integration tests.

It answers POST /v1/data/<package path>/<rule> the way OPA's data API does: the decision of a boolean rule is {"result": true|false}, and a document the server does not define is the empty object {}. The decision is a function of the request, so a scenario chooses the outcome by the policy and rule it configures and by what it sends:

authz/policy/allow     the request header X-Opa-Decision forces an outcome (allow, deny,
                       undefined, invalid, error); without it, GET is allowed and any other
                       method is allowed only with the header X-Test-User: admin
authz/context/allow    allow only when the input carries the request metadata the gateway is
                       expected to send (method, path, headers, apiContext.apiName)
authz/token/allow      allow only when the input carries apiContext.accessToken
authz/notoken/allow    allow only when the input carries no apiContext.accessToken
authz/secured/allow    allow, but only for a caller presenting "Authorization: Bearer
                       opa-test-key"; any other caller is answered 401
authz/slow/allow       allow, after SlowDelay

Any other path is an undefined document and is answered {}.

Constants ¶

View Source

const (
	// DataPath is the prefix of OPA's data API.
	DataPath = "/v1/data/"

	// HeaderDecision is the request header, read from the OPA input's transportHeaders, that
	// forces the outcome of authz/policy/allow.
	HeaderDecision = "x-opa-decision"

	// HeaderTestUser is the request header that lets a non-GET request through authz/policy/allow.
	HeaderTestUser = "x-test-user"

	// AccessKey is the bearer token authz/secured/allow requires from its caller.
	AccessKey = "opa-test-key"

	// SlowDelay is how long authz/slow/allow takes to answer.
	SlowDelay = 3 * time.Second
)

View Source

const (
	DecisionAllow     = "allow"
	DecisionDeny      = "deny"
	DecisionUndefined = "undefined"
	DecisionInvalid   = "invalid"
	DecisionError     = "error"
)

Forced outcomes of authz/policy/allow, selected by the X-Opa-Decision request header.

View Source

const Port = 3018

Features address http://testbench:3018.

Variables ¶

This section is empty.

Functions ¶

This section is empty.

Types ¶

type Service ¶

type Service struct{}

Service implements the stateless OPA test service.

func New ¶

func New() *Service

New returns a new OPA service.

func (*Service) Handler ¶

func (s *Service) Handler() http.Handler

Handler returns the data API handler.

func (*Service) Name ¶

func (s *Service) Name() string

Name returns the service registration name.

func (*Service) Port ¶

func (s *Service) Port() int

Port returns the service's listening port.

func (*Service) Stateful ¶

func (s *Service) Stateful() bool

Stateful reports whether the service keeps request-specific state.

Source Files ¶

View all Source files

opa.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL