How to run a specific rule passed as input

[renatosc]

How can I execute a specific rule which the package name was passed as input?

Example:

input = {
 "rulePackageNameToRun" : "newco.policy.infra.server"
  "data: ...
}

rego:

package newco.policy

decision := {
    allow := data.newco.policy.infra.server.allow with input as input.data
    allow
}

So basically I want to replace the newco.policy.infra.server above with the value from the input.rulePackageNameToRun.

Replacing the allow line above with the below (of course) does not work
allow := data[input.ruleToRun].allow with input as input.data

On a other programing languages, I would split the input.ruleToRun by dot and do something like this:

var parts = split(input.rulePackageNameToRun, ".")
var rule = data
for each p in parts {
    rule = rule[p]
}
allow = rule.allow

but I don't know how to create a equivalent rego code to the above.

PS: the data.newco.policy.infra.server.allow rule is defined on another file but available in the same bundle.

[anderseknert]

Hi there!

Longer blog on the topic of dynamic policy composition over here.

If you need to query entirely arbitrary paths, you can use object.get to query an arbitrary path under the data document, provided that at least the first part of the path (like newco in your example) is known to the compiler:

# with input.rulePackageNameToRun as "policy.infra.server"
result := object.get(data.newco, split(input.rulePackageNameToRun, "."), {})

The first path component needs to be known in order for the compiler to know that the query isn't going to be recursive, i.e. package foo querying data.foo, in turn querying data.foo forever.

[anderseknert]

Sorry, I forgot to say this before but the rule making that query can't itself be in the data.newco tree, as then object.get(data.newco ... would also be recursive.

So what you'd normally do is to have a "main" package (data.main or what have you) query for resources under another root, like data.policies, or something like that.

[renatosc]

Thanks for the reply @anderseknert, exactly what I was looking for.