feat: As a user, I want to include the request body in the opa-input, so that I can reason about its contents #11629

wistefan · 2024-10-08T14:06:48Z

Description

In order to make decisions based on the request body, the OPA-Plugin will also forward the body when configured to do so.

Fixes #11387

Checklist

I have explained the need for this PR and the problem it solves
I have explained the changes or the new features added to this PR
I have added tests corresponding to this change
I have updated the documentation to reflect this change
I have verified that this change is backward compatible (If not, please discuss on the APISIX mailing list first)

wistefan · 2024-11-06T11:22:07Z

Is there anything I can do to get this PR forward?

github-actions · 2025-01-06T10:05:32Z

This pull request has been marked as stale due to 60 days of inactivity. It will be closed in 4 weeks if no further activity occurs. If you think that's incorrect or this pull request should instead be reviewed, please simply write any comment. Even if closed, you can still revive the PR at any time or discuss it on the dev@apisix.apache.org list. Thank you for your contributions.

apisix/plugins/opa/helper.lua

moonming · 2025-01-07T03:43:03Z

@wistefan Please synchronize the master code to trigger all CI

wistefan · 2025-01-07T07:12:58Z

@wistefan Please synchronize the master code to trigger all CI

@moonming Thank you for the review, I updated.

LuciaCabanillasRodriguez · 2025-03-24T14:24:21Z

Hello! If I want this new implementation with the request body, what should I do?

Baoyuantop · 2025-03-25T02:37:18Z

Hi @wistefan, please synchronize the latest master branch code to trigger the test.

docs/en/latest/plugins/opa.md

apisix/plugins/opa/helper.lua

LuciaCabanillasRodriguez · 2025-06-09T13:59:40Z

Hi, sorry I will take care as soon as I find time. @LuciaCabanillasRodriguez help would be very welcome, do you have the time to take a look at the test failures?

Hello! I tried to push a file to fix one of the issues, but I received a forbidden message. In any case, I solved it locally by running:

make lint
./utils/reindex t/plugin/opa3.t

LuciaCabanillasRodriguez · 2025-06-09T14:15:59Z

Regarding the error in t/discovery/consul_dump.t, I see that the test fails because the expected response from Consul isn’t being returned:
got: ''
expected: '{"service_a":[{"host":"127.0.0.1","port":30511,"weight":1}]}'

It seems like either the service_a isn’t being registered properly in Consul during the test, or the endpoint isn’t responding as expected.

As for the other warnings and errors like:
failed to do SSL handshake: certificate verify failed
http_init(): failed to load the configuration: connection refused

These appear to be related to missing services (like Consul or Etcd) or SSL verification issues, but I’m not entirely sure how to fix it with certainty.

LuciaCabanillasRodriguez · 2025-06-17T09:38:38Z

Good! I could remove one issue, the other one remains! Any help?? I would need some guidance on how to fix it

Baoyuantop · 2025-06-18T01:43:52Z

Maybe we can merge the master branch.

LuciaCabanillasRodriguez · 2025-06-24T14:15:44Z

Maybe we can merge the master branch.
Is there any update here?

Baoyuantop · 2025-06-25T02:49:00Z

docs/en/latest/plugins/opa.md

@@ -46,6 +46,7 @@ The `opa` Plugin can be used to integrate with [Open Policy Agent (OPA)](https:/
 | with_route        | boolean | False    | false   |               | When set to true, sends information about the current Route.                                                                                                                               |


Need to modify Chinese documents synchronously

Baoyuantop · 2025-06-25T02:49:35Z

docs/en/latest/plugins/opa.md

 | with_route        | boolean | False    | false   |               | When set to true, sends information about the current Route.                                                                                                                               |
 | with_service      | boolean | False    | false   |               | When set to true, sends information about the current Service.                                                                                                                             |
 | with_consumer     | boolean | False    | false   |               | When set to true, sends information about the current Consumer. Note that this may send sensitive information like the API key. Make sure to turn it on only when you are sure it is safe. |
+| with_body         | boolean | False    | false   |               | When set to true, sends the request body. |


The request body may contain sensitive information (passwords, API keys, etc.), so a security warning needs to be added.

I have just added a security warning

Baoyuantop · 2025-06-25T02:55:27Z

t/plugin/opa3.t

+POST /hello
+hello world
+--- response_body
+hello world


We need to verify the body data received by OPA during the test.

Should I do something?

You need to add more tests to verify this scenario.

Hi @wistefan, could you please take a look? I’m running into some issues with Nginx and would appreciate your help. Thanks!

Hi @LuciaCabanillasRodriguez, do you need any help with this?

Please submit additional fixes to ensure all CI tests pass.

Hi @wistefan, is there still time to deal with these?

Is there any update here?

The author may be unable to continue processing this PR.

The logs for this run have expired and are no longer available.

github-actions · 2025-11-15T10:05:37Z

This pull request has been marked as stale due to 60 days of inactivity. It will be closed in 4 weeks if no further activity occurs. If you think that's incorrect or this pull request should instead be reviewed, please simply write any comment. Even if closed, you can still revive the PR at any time or discuss it on the dev@apisix.apache.org list. Thank you for your contributions.

Baoyuantop

The current integration test is not strict enough.

In ci/pod/opa/with_body.rego, the rule allow { request.method == "POST" } makes the policy allow any POST request, regardless of whether the body is successfully sent or matched. Since all your test cases in t/plugin/opa3.t use POST, they would pass even if the body was missing or corrupted.

To truly verify that the body is being transmitted and parsed correctly by OPA, please update the rego policy to check for a specific value in the body (e.g., input.request.body.hello == "world"), and add a negative test case (e.g., sending `{"hello": "wrong"}) to ensure it gets blocked.

LuciaCabanillasRodriguez · 2026-01-28T08:34:03Z

Could you please check the 2 failing checks? I think they are not related with opa

LuciaCabanillasRodriguez · 2026-02-10T10:53:59Z

Could you check it? I think the failing checks are not related with opa

Baoyuantop · 2026-02-11T02:37:28Z

I reran the failed test.

Sharoek · 2026-02-12T13:48:04Z

Can three people with write access review this, please?

dosubot bot added size:L This PR changes 100-499 lines, ignoring generated files. doc Documentation things enhancement New feature or request labels Oct 8, 2024

wistefan mentioned this pull request Oct 11, 2024

feat: As a user, I want to include the request body in the opa-input, so that I can reason about its contents #11387

Open

github-actions bot added the stale label Jan 6, 2025

moonming reviewed Jan 7, 2025

View reviewed changes

apisix/plugins/opa/helper.lua Outdated Show resolved Hide resolved

apisix/plugins/opa/helper.lua Outdated Show resolved Hide resolved

wistefan force-pushed the master branch from a0a86d3 to 60b1efe Compare January 15, 2025 08:45

github-actions bot removed the stale label Jan 27, 2025

Baoyuantop reviewed Mar 25, 2025

View reviewed changes

docs/en/latest/plugins/opa.md Outdated Show resolved Hide resolved

apisix/plugins/opa/helper.lua Outdated Show resolved Hide resolved

apisix/plugins/opa/helper.lua Outdated Show resolved Hide resolved

Baoyuantop added this to ⚡️ Apache APISIX Roadmap Mar 28, 2025

Baoyuantop moved this to 👀 In review in ⚡️ Apache APISIX Roadmap Mar 28, 2025

Baoyuantop moved this from 👀 In review to 🏗 In progress in ⚡️ Apache APISIX Roadmap Mar 28, 2025

Baoyuantop moved this from 🏗 In progress to 👀 In review in ⚡️ Apache APISIX Roadmap Mar 28, 2025

wistefan added 11 commits March 31, 2025 09:54

add body support for the opa plugin

5f05a50

fix method calls and test names

a04ec4b

fix linting issues

c86bc2c

fix tests

7b1a8b6

linting fixes

6eeaac5

fix linting

cea6be4

add doc

3aa6a48

clean

656a3f0

still lintign

13c775f

fix linter issues

73738b7

change the error call

cf69c83

Baoyuantop assigned LuciaCabanillasRodriguez Jun 13, 2025

Baoyuantop removed wait for update wait for the author's response in this issue/PR user responded labels Jun 13, 2025

Baoyuantop reviewed Jun 25, 2025

View reviewed changes

LuciaCabanillasRodriguez added 3 commits June 25, 2025 14:50

security warning

463b92f

updated Chinese documentation

8f6bd31

updated Chinese documentation

e50d8df

Baoyuantop added the wait for update wait for the author's response in this issue/PR label Jul 7, 2025

Baoyuantop moved this from 👀 In review to 📋 Backlog in ⚡️ Apache APISIX Roadmap Jul 29, 2025

LuciaCabanillasRodriguez added 2 commits August 12, 2025 14:49

Update docker-compose.plugin.yml and opa3.t test

9502a18

Fix test index for opa3.t

8a27c08

github-actions bot added stale and removed stale labels Nov 15, 2025

Merge branch 'apache:master' into master

4831e36

Baoyuantop reviewed Dec 17, 2025

View reviewed changes

rego policy and new test

47cc938

Baoyuantop added awaiting review and removed wait for update wait for the author's response in this issue/PR labels Dec 24, 2025

LuciaCabanillasRodriguez added 2 commits January 9, 2026 14:01

test(opa): align opa3 tests with with_body policy

523da77

docs

c750db7

		@@ -46,6 +46,7 @@ The `opa` Plugin can be used to integrate with [Open Policy Agent (OPA)](https:/
		\| with_route \| boolean \| False \| false \| \| When set to true, sends information about the current Route. \|

feat: As a user, I want to include the request body in the opa-input, so that I can reason about its contents #11629

Are you sure you want to change the base?

feat: As a user, I want to include the request body in the opa-input, so that I can reason about its contents #11629

Conversation

wistefan commented Oct 8, 2024

Description

Checklist

Uh oh!

wistefan commented Nov 6, 2024

Uh oh!

github-actions bot commented Jan 6, 2025

Uh oh!

Uh oh!

Uh oh!

moonming commented Jan 7, 2025

Uh oh!

wistefan commented Jan 7, 2025

Uh oh!

LuciaCabanillasRodriguez commented Mar 24, 2025

Uh oh!

Baoyuantop commented Mar 25, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

LuciaCabanillasRodriguez commented Jun 9, 2025

Uh oh!

LuciaCabanillasRodriguez commented Jun 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

LuciaCabanillasRodriguez commented Jun 17, 2025

Uh oh!

Baoyuantop commented Jun 18, 2025

Uh oh!

LuciaCabanillasRodriguez commented Jun 24, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Nov 15, 2025

Uh oh!

Baoyuantop left a comment

Choose a reason for hiding this comment

Uh oh!

LuciaCabanillasRodriguez commented Jan 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

LuciaCabanillasRodriguez commented Feb 10, 2026

Uh oh!

Baoyuantop commented Feb 11, 2026

Uh oh!

Sharoek commented Feb 12, 2026

Uh oh!

Reviewers

Assignees

LuciaCabanillasRodriguez commented Jun 9, 2025 •

edited

Loading

LuciaCabanillasRodriguez commented Jan 28, 2026 •

edited

Loading