Files

T

Jay Brown 2ff6e05ffc Merged in feature/permit-integration-1 (pull request #172 )

Permit integration - part 1

* WIP permit integration

* slim down build

* Merge branch 'main' of bitbucket.org:aarete/query-orchestration into feature/permit-integration-1

* omit swagger from auth

* clean build

* comment

* part 1 completed

this is the initial permitio parts and tests without integration. Also testing.md since we have a new test target `task test:permitio`

* feature flag for no jwt validation

* permit integration

* fix ci unit tests

* ci fix

* build fix

* fix home handler

* fix redirect

* test fix

* update docs for auth

2025-07-11 19:27:14 +00:00

3.3 KiB

Raw Blame History

OPA Local Policy Testing Setup

This setup allows you to test OPA (Open Policy Agent) policies with local policy files and data.

Architecture

OPA: Policy engine running in server mode
Data Loader: Automatically loads test data into OPA at startup

Quick Start

Start OPA and load data:
```
docker compose up
```
This will:
- Start OPA server on port 8181
- Wait for OPA to be healthy
- Automatically load your test data from policy-data.json
Access OPA:
- OPA API: http://localhost:8181

Modifying Test Data

Updating Policy Data (JSON)

To change the test data that policies use:

Edit the data file:
```
vi policy-data.json
```
Reload the data:
```
./put-policy-data.sh
```

The data will be loaded into OPA at /data/static/.

Example data structure:

{
  "users": [
    {
      "id": 1,
      "name": "alice",
      "role": "admin"
    }
  ],
  "permissions": {
    "admin": ["read", "write", "delete"],
    "user": ["read"]
  }
}

Updating Policy Rules (Rego)

To change the policy logic:

Edit the policy file:
```
vi policies/policy.rego
```
Restart OPA:
```
docker compose restart opa
```

OPA will reload policies automatically on restart.

Testing Policies

Query OPA directly

# Test a policy decision
curl -X POST http://localhost:8181/v1/data/example/allow \
  -H "Content-Type: application/json" \
  -d '{
    "input": {
      "user": {"role": "admin"},
      "action": "read"
    }
  }'

Check loaded data

# View all loaded data
curl http://localhost:8181/v1/data

# View specific data path
curl http://localhost:8181/v1/data/static

Check loaded policies

# View all policies
curl http://localhost:8181/v1/policies

File Structure

.
├── docker-compose.yaml          # Main orchestration file
├── policy-data.json            # Test data (modify this)
├── put-policy-data.sh          # Script to load data into OPA
├── policies/
│   └── policy.rego            # Main policy file (modify this)
└── README.md                  # This file

Common Workflows

Adding New Test Users

Edit policy-data.json
Add user to users array
Run: ./put-policy-data.sh

Adding New Permissions

Edit policy-data.json
Update permissions object
Run: ./put-policy-data.sh

Changing Policy Logic

Edit policies/policy.rego
Restart OPA: docker compose restart opa

Debugging

View logs:

# OPA logs
docker compose logs -f opa

# Data loader logs
docker compose logs data_loader

Important Notes

Data changes: Run ./put-policy-data.sh to reload data
Policy changes: Restart OPA to reload policies
Data path: JSON data is available in policies at data.static.*
Port: OPA runs on port 8181

Troubleshooting

OPA not starting

Check port 8181 is available
View logs: docker compose logs opa

Data not loading

Check data file format: cat policy-data.json | jq .
Check OPA is healthy: curl http://localhost:8181/v1/data
Run data loader manually: ./put-policy-data.sh

Policy errors

Validate Rego syntax: opa fmt policies/policy.rego
Check OPA logs: docker compose logs opa

3.3 KiB Raw Blame History