Fields of partial evaluation result: queries, support. What to do next?

[mcelik34]

I am getting this result. Can you help about where should I check out or what to do next? Any comprehensive guide about how to interpret Compile API output?
Command: opa eval "data.endpoints.ids" -d ./policy -f pretty -p -u data.users -u data.orders

+-----------+----------------------------+
| Query 1   | data.partial.endpoints.ids |
+-----------+----------------------------+
| Support 1 | package partial.endpoints  |
|           |                            |
|           | default ids = []           |
+-----------+----------------------------+

Edit: I realized that the result above is because of that I didn't supply a data which is not unknown. I did it for this time. Now, it looks like this, which is better :) :

+-----------+------------------------------------------------------------------------+
| Query 1   | data.users[i8].id = "0x0"                                              |
|           | data.users[i8].role = "kasiyer"                                        |
|           | data.partial.endpoint.order.get.ids                                    |
+-----------+------------------------------------------------------------------------+
| Query 2   | data.users[i22].id = "0x0"                                             |
|           | data.users[i22].role = "sef"                                           |
|           | data.partial.endpoint.order.get.ids                                    |
+-----------+------------------------------------------------------------------------+
| Support 1 | package partial.endpoint.order.get                                     |
|           |                                                                        |
|           | ids[__local56__9] {                                                    |
|           |   data.users[i11].id = "0x0"                                           |
|           |   data.users[i11].role = "kasiyer"                                     |
|           |   not data.partial.__not9_2_12__(order9)                               |
|           |   __local56__9 = data.orders[_09].id                                   |
|           |   order9 = data.orders[_09]                                            |
|           | }                                                                      |
|           |                                                                        |
|           | ids[__local57__16] {                                                   |
|           |   data.users[i18].id = "0x0"                                           |
|           |   data.users[i18].role = "sef"                                         |
|           |   not order16.delivery.delivered_at                                    |
|           |   __local57__16 = data.orders[_116].id                                 |
|           |   order16 = data.orders[_116]                                          |
|           | }                                                                      |
+-----------+------------------------------------------------------------------------+
| Support 2 | package partial                                                        |
|           |                                                                        |
|           | __not13_3_14__(__local73__13) {                                        |
|           |   time.now_ns() - time.parse_rfc3339_ns(__local73__13) < 3600000000000 |
|           | }                                                                      |
|           |                                                                        |
|           | __not9_2_12__(order9) {                                                |
|           |   order9.payment.done = true                                           |
|           |   order9.delivery.delivered_at                                         |
|           |   not data.partial.__not13_3_14__(order9.delivery.delivered_at)        |
|           | }                                                                      |
+-----------+------------------------------------------------------------------------+

I have checked out many pages about how to use the results of a PE.
... including https://blog.openpolicyagent.org/write-policy-in-opa-enforce-policy-in-sql-d9d24db93bf4

I have not seen a mention or code piece regarding "support" field and a query like "data.partial" neither in pages nor github@.../contrib/data_filter_... but only here:

...Compile API, OPA returns a new set of queries and supporting policies. ...

Ultimately, I am trying to reach a setup such as:

Process the HTTP API request with OPA.
    Validate JWT
    Partially evaluate .allow, .ids and .fields depending on endpoint request sent
        "subject, action, object, conditions" combinations are in policies    
Process output of partial evaluation in related express.js endpoint block
    Transform partial evaluation to mongoDB query
    Query mongoDB

Or it maybe making evaluation request to OPA in endpoint blocks of express.js. For requests which requires working on only single or a couple of documents, it is perfect. But, anyway, when it comes to collection, without partial evaluation, I see, for now, the only option that requires to fetch all documents of related collections to OPA from mongoDB beforehand. No way.

[srenatus]

"Support" are extra modules that PE generates in the process of partially evaluating your query given your known/unknown inputs. There are constructs that care only expressible in Rego with the help of rules, that cannot be put into queries alone. That's what ends up in supporting modules.

For the sake of translating the queries that are the result of PE into SQL, or MongoDB, any other form of query language, support modules are a problem: Translating them is much more difficult than translating a query. I'd thus try to rewrite the policy in such a way that you end up without support modules if you want to get closer to your desired setup.

[ysheng26]

Thanks for the reply :)

I'm also interested in this topic. Are there any rule of thumbs or guides about what queries would generate "Support" modules? in other words how can I make sure my queries are not going to generate support modules when doing partial compilations?

[srenatus]

how can I make sure my queries are not going to generate support modules when doing partial compilations?

I'm afraid there's no guidelines for that. The general direction is that anything that goes beyond disjunctive normal form (disjunction of a conjunctions of simple expressions) needs support modules.

For example,

package foo
import rego.v1
default allow := false
allow if input.token

if input is unknown, and the query is data.foo.allow, then PE will end up with

true if input.token is defined, false otherwise

and that's not something you can express as (P1 AND ...) OR (P3 AND ...) ... (DNF). The problem there is the default rule.

Now, similar situations can happen with other constructs. And every will also give you support modules, because PE doesn't unravel it when its arguments are unknown.

It's easiest to try out several things, to get a feel for it, I'm afraid. Hope this helps!