func EvalTracer(tracertopdown.Tracer)EvalOption

EvalTracer configures a tracer for a Prepared Query's evaluation

Deprecated: Use EvalQueryTracer instead.

package mainimport ("context""fmt""github.com/open-policy-agent/opa/v1/rego")func main() {ctx := context.Background()// Create query that returns a single boolean value.rego := rego.New(rego.Query("data.authz.allow"),rego.Module("example.rego",`package authzimport rego.v1default allow = falseallow if {input.open == "sesame"}`,),rego.Input(map[string]any{"open": "sesame"}),)// Run evaluation.rs, err := rego.Eval(ctx)if err != nil {panic(err)}// Inspect result.fmt.Println("allowed:", rs.Allowed())}

Output:allowed: true

package mainimport ("context""fmt""github.com/open-policy-agent/opa/v1/ast""github.com/open-policy-agent/opa/v1/rego")func main() {ctx := context.Background()// Define a simple policy.module := `package exampleimport rego.v1default allow = falseallow if {input.identity = "admin"}allow if {input.method = "GET"}`// Compile the module. The keys are used as identifiers in error messages.compiler, err := ast.CompileModules(map[string]string{"example.rego": module,})// Create a new query that uses the compiled policy from above.rego := rego.New(rego.Query("data.example.allow"),rego.Compiler(compiler),rego.Input(map[string]any{"identity": "bob","method":   "GET",},),)// Run evaluation.rs, err := rego.Eval(ctx)if err != nil {// Handle error.}// Inspect results.fmt.Println("len:", len(rs))fmt.Println("value:", rs[0].Expressions[0].Value)fmt.Println("allowed:", rs.Allowed()) // helper method}

Output:len: 1value: trueallowed: true

package mainimport ("context""fmt""github.com/open-policy-agent/opa/v1/ast""github.com/open-policy-agent/opa/v1/rego")func main() {ctx := context.Background()r := rego.New(rego.Query("data.example.p"),rego.Module("example_error.rego",`package exampleimport rego.v1p = true if { not q[x] }q = {1, 2, 3} if { true }`,))_, err := r.Eval(ctx)switch err := err.(type) {case ast.Errors:for _, e := range err {fmt.Println("code:", e.Code)fmt.Println("row:", e.Location.Row)fmt.Println("filename:", e.Location.File)}default:// Some other error occurred.}}

Output:code: rego_unsafe_var_errorrow: 4filename: example_error.rego

package mainimport ("bytes""context""encoding/json""fmt""github.com/open-policy-agent/opa/v1/rego")func main() {ctx := context.Background()// Raw input data that will be used in evaluation.raw := `{"users": [{"id": "bob"}, {"id": "alice"}]}`d := json.NewDecoder(bytes.NewBufferString(raw))// Numeric values must be represented using json.Number.d.UseNumber()var input anyif err := d.Decode(&input); err != nil {panic(err)}// Create a simple query over the input.rego := rego.New(rego.Query("input.users[idx].id = user_id"),rego.Input(input))//Run evaluation.rs, err := rego.Eval(ctx)if err != nil {// Handle error.}// Inspect results.fmt.Println("len:", len(rs))fmt.Println("bindings.idx:", rs[1].Bindings["idx"])fmt.Println("bindings.user_id:", rs[1].Bindings["user_id"])}

Output:len: 2bindings.idx: 1bindings.user_id: alice

package mainimport ("context""fmt""github.com/open-policy-agent/opa/v1/rego")func main() {ctx := context.Background()// Create query that produces multiple bindings for variable.rego := rego.New(rego.Query(`a = ["ex", "am", "ple"]; x = a[_]; not p[x]`),rego.Package(`example`),rego.Module("example.rego", `package exampleimport rego.v1p contains "am" if { true }`),)// Run evaluation.rs, err := rego.Eval(ctx)// Inspect results.fmt.Println("len:", len(rs))fmt.Println("err:", err)for i := range rs {fmt.Printf("bindings[\"x\"]: %v (i=%d)\n", rs[i].Bindings["x"], i)}}

Output:len: 2err: <nil>bindings["x"]: ex (i=0)bindings["x"]: ple (i=1)

package mainimport ("context""fmt""github.com/open-policy-agent/opa/v1/rego")func main() {ctx := context.Background()// Create query that produces multiple documents.rego := rego.New(rego.Query("data.example.p[x]"),rego.Module("example.rego",`package exampleimport rego.v1p = {"hello": "alice", "goodbye": "bob"} if { true }`,))// Run evaluation.rs, err := rego.Eval(ctx)// Inspect results.fmt.Println("len:", len(rs))fmt.Println("err:", err)for i := range rs {fmt.Printf("bindings[\"x\"]: %v (i=%d)\n", rs[i].Bindings["x"], i)fmt.Printf("value: %v (i=%d)\n", rs[i].Expressions[0].Value, i)}}

Output:len: 2err: <nil>bindings["x"]: goodbye (i=0)value: bob (i=0)bindings["x"]: hello (i=1)value: alice (i=1)

package mainimport ("context""fmt""os""github.com/open-policy-agent/opa/v1/logging""github.com/open-policy-agent/opa/v1/storage/disk""github.com/open-policy-agent/opa/v1/rego""github.com/open-policy-agent/opa/v1/storage""github.com/open-policy-agent/opa/v1/util")func main() {ctx := context.Background()data := `{        "example": {            "users": {"alice": {"likes": ["dogs", "clouds"]},"bob": {"likes": ["pizza", "cats"]}}        }    }`var json map[string]anyerr := util.UnmarshalJSON([]byte(data), &json)if err != nil {// Handle error.}// Manually create a persistent storage-layer in a temporary directory.rootDir, err := os.MkdirTemp("", "rego_example")if err != nil {panic(err)}defer os.RemoveAll(rootDir)// Configure the store to partition data at `/example/users` so that each// user's data is stored on a different row. Assuming the policy only reads// data for a single user to process the policy query, OPA can avoid loading// _all_ user data into memory this way.store, err := disk.New(ctx, logging.NewNoOpLogger(), nil, disk.Options{Dir:        rootDir,Partitions: []storage.Path{{"example", "user"}},})if err != nil {// Handle error.}err = storage.WriteOne(ctx, store, storage.AddOp, storage.RootPath, json)if err != nil {// Handle error}// Run a query that returns the valuers, err := rego.New(rego.Query(`data.example.users["alice"].likes`),rego.Store(store)).Eval(ctx)if err != nil {// Handle error.}// Inspect the result.fmt.Println("value:", rs[0].Expressions[0].Value)// Re-open the store in the same directory.store.Close(ctx)store2, err := disk.New(ctx, logging.NewNoOpLogger(), nil, disk.Options{Dir:        rootDir,Partitions: []storage.Path{{"example", "user"}},})if err != nil {// Handle error.}// Run the same query with a new store.rs, err = rego.New(rego.Query(`data.example.users["alice"].likes`),rego.Store(store2)).Eval(ctx)if err != nil {// Handle error.}// Inspect the result and observe the same result.fmt.Println("value:", rs[0].Expressions[0].Value)}

Output:value: [dogs clouds]value: [dogs clouds]

package mainimport ("context""fmt""github.com/open-policy-agent/opa/v1/rego")func main() {ctx := context.Background()// Create very simple query that binds a single variable.rego := rego.New(rego.Query("x = 1"))// Run evaluation.rs, err := rego.Eval(ctx)// Inspect results.fmt.Println("len:", len(rs))fmt.Println("bindings:", rs[0].Bindings)fmt.Println("err:", err)}

Output:len: 1bindings: map[x:1]err: <nil>

package mainimport ("context""fmt""github.com/open-policy-agent/opa/v1/rego")func main() {ctx := context.Background()// Create query that produces a single document.rego := rego.New(rego.Query("data.example.p"),rego.Module("example.rego",`package exampleimport rego.v1p = ["hello", "world"] if { true }`,))// Run evaluation.rs, err := rego.Eval(ctx)// Inspect result.fmt.Println("value:", rs[0].Expressions[0].Value)fmt.Println("err:", err)}

Output:value: [hello world]err: <nil>

package mainimport ("context""fmt""github.com/open-policy-agent/opa/v1/rego""github.com/open-policy-agent/opa/v1/storage/inmem""github.com/open-policy-agent/opa/v1/util")func main() {ctx := context.Background()data := `{        "example": {            "users": [                {                    "name": "alice",                    "likes": ["dogs", "clouds"]                },                {                    "name": "bob",                    "likes": ["pizza", "cats"]                }            ]        }    }`var json map[string]anyerr := util.UnmarshalJSON([]byte(data), &json)if err != nil {// Handle error.}// Manually create the storage layer. inmem.NewFromObject returns an// in-memory store containing the supplied data.store := inmem.NewFromObject(json)// Create new query that returns the valuerego := rego.New(rego.Query("data.example.users[0].likes"),rego.Store(store))// Run evaluation.rs, err := rego.Eval(ctx)if err != nil {// Handle error.}// Inspect the result.fmt.Println("value:", rs[0].Expressions[0].Value)}

Output:value: [dogs clouds]

package mainimport ("context""os""github.com/open-policy-agent/opa/v1/rego")func main() {ctx := context.Background()// Create very simple query that binds a single variable and enables tracing.r := rego.New(rego.Query("x = 1"),rego.Trace(true),)// Run evaluation.r.Eval(ctx)// Inspect results.rego.PrintTraceWithLocation(os.Stdout, r)}

Output:query:1     Enter x = 1query:1     | Eval x = 1query:1     | Unify x = 1query:1     | Exit x = 1query:1     Redo x = 1query:1     | Redo x = 1

package mainimport ("context""os""github.com/open-policy-agent/opa/v1/rego""github.com/open-policy-agent/opa/v1/topdown")func main() {ctx := context.Background()buf := topdown.NewBufferTracer()// Create very simple query that binds a single variable and provides a tracer.rego := rego.New(rego.Query("x = 1"),rego.QueryTracer(buf),)// Run evaluation.rego.Eval(ctx)// Inspect results.topdown.PrettyTraceWithLocation(os.Stdout, *buf)}

Output:query:1     Enter x = 1query:1     | Eval x = 1query:1     | Unify x = 1query:1     | Exit x = 1query:1     Redo x = 1query:1     | Redo x = 1

package mainimport ("bytes""context""fmt""github.com/open-policy-agent/opa/v1/rego""github.com/open-policy-agent/opa/v1/storage""github.com/open-policy-agent/opa/v1/storage/inmem")func main() {ctx := context.Background()// Create storage layer and load dummy data.store := inmem.NewFromReader(bytes.NewBufferString(`{"favourites": {"pizza": "cheese","colour": "violet"}}`))// Open a write transaction on the store that will perform write operations.txn, err := store.NewTransaction(ctx, storage.WriteParams)if err != nil {// Handle error.}// Create rego query that uses the transaction created above.inside := rego.New(rego.Query("data.favourites.pizza"),rego.Store(store),rego.Transaction(txn),)// Create rego query that DOES NOT use the transaction created above. Under// the hood, the rego package will create it's own transaction to// ensure it evaluates over a consistent snapshot of the storage layer.outside := rego.New(rego.Query("data.favourites.pizza"),rego.Store(store),)// Write change to storage layer inside the transaction.err = store.Write(ctx, txn, storage.AddOp, storage.MustParsePath("/favourites/pizza"), "pepperoni")if err != nil {// Handle error.}// Run evaluation INSIDE the transaction.rs, err := inside.Eval(ctx)if err != nil {// Handle error.}fmt.Println("value (inside txn):", rs[0].Expressions[0].Value)// Run evaluation OUTSIDE the transaction.rs, err = outside.Eval(ctx)if err != nil {// Handle error.}fmt.Println("value (outside txn):", rs[0].Expressions[0].Value)if err := store.Commit(ctx, txn); err != nil {// Handle error.}// Run evaluation AFTER the transaction commits.rs, err = outside.Eval(ctx)if err != nil {// Handle error.}fmt.Println("value (after txn):", rs[0].Expressions[0].Value)}

Output:value (inside txn): pepperonivalue (outside txn): cheesevalue (after txn): pepperoni

package mainimport ("context""fmt""sort""strings""github.com/open-policy-agent/opa/v1/ast""github.com/open-policy-agent/opa/v1/rego")func main() {ctx := context.Background()// Define a simple policy for example purposes.module := `package testimport rego.v1allow if {input.method = read_methods[_]input.path = ["reviews", user]input.user = user}allow if {input.method = read_methods[_]input.path = ["reviews", _]input.is_admin}read_methods = ["GET"]`r := rego.New(rego.Query("data.test.allow == true"), rego.Module("example.rego", module))pq, err := r.Partial(ctx)if err != nil {// Handle error.}makeStable(pq.Queries)// Inspect result.for i := range pq.Queries {fmt.Printf("Query #%d: %v\n", i+1, pq.Queries[i])}}// This is typically not needed, but we do it here to ensure that our// example output is stable. We sort the result bodies, and rename the// variable that's `userX` for some number X to `user`.func makeStable(bodies []ast.Body) {for i := range bodies {ast.WalkTerms(bodies[i], func(t *ast.Term) bool {if v, ok := t.Value.(ast.Var); ok && strings.HasPrefix(string(v), "user") {t.Value = ast.Var("user")}return false})}sort.Slice(bodies, func(i, j int) bool { return bodies[i].Compare(bodies[j]) < 0 })}

Output:Query #1: "GET" = input.method; input.path = ["reviews", _]; input.is_adminQuery #2: "GET" = input.method; input.path = ["reviews", user]; user = input.user

package mainimport ("bytes""context""fmt""github.com/open-policy-agent/opa/v1/rego""github.com/open-policy-agent/opa/v1/storage/inmem")func main() {ctx := context.Background()// Define a role-based access control (RBAC) policy that decides whether to// allow or deny requests. Requests are allowed if the user is bound to a// role that grants permission to perform the operation on the resource.module := `package exampleimport rego.v1import data.bindingsimport data.rolesdefault allow = falseallow if {user_has_role[role_name]role_has_permission[role_name]}user_has_role contains role_name if {b = bindings[_]b.role = role_nameb.user = input.subject.user}role_has_permission contains role_name if {r = roles[_]r.name = role_namematch_with_wildcard(r.operations, input.operation)match_with_wildcard(r.resources, input.resource)}match_with_wildcard(allowed, value) if {allowed[_] = "*"}match_with_wildcard(allowed, value) if {allowed[_] = value}`// Define dummy roles and role bindings for the example. In real-world// scenarios, this data would be pushed or pulled into the service// embedding OPA either from an external API or configuration file.store := inmem.NewFromReader(bytes.NewBufferString(`{"roles": [{"resources": ["documentA", "documentB"],"operations": ["read"],"name": "analyst"},{"resources": ["*"],"operations": ["*"],"name": "admin"}],"bindings": [{"user": "bob","role": "admin"},{"user": "alice","role": "analyst"}]}`))// Prepare and run partial evaluation on the query. The result of partial// evaluation can be cached for performance. When the data or policy// change, partial evaluation should be re-run.r := rego.New(rego.Query("data.example.allow"),rego.Module("example.rego", module),rego.Store(store),)pr, err := r.PartialResult(ctx)if err != nil {// Handle error.}// Define example inputs (representing requests) that will be used to test// the policy.examples := []map[string]any{{"resource":  "documentA","operation": "write","subject": map[string]any{"user": "bob",},},{"resource":  "documentB","operation": "write","subject": map[string]any{"user": "alice",},},{"resource":  "documentB","operation": "read","subject": map[string]any{"user": "alice",},},}for i := range examples {// Prepare and run normal evaluation from the result of partial// evaluation.r := pr.Rego(rego.Input(examples[i]),)rs, err := r.Eval(ctx)if err != nil || len(rs) != 1 || len(rs[0].Expressions) != 1 {// Handle erorr.} else {fmt.Printf("input %d allowed: %v\n", i+1, rs[0].Expressions[0].Value)}}}

Output:input 1 allowed: trueinput 2 allowed: falseinput 3 allowed: true

package mainimport ("context""fmt""github.com/open-policy-agent/opa/v1/rego")func main() {ctx := context.Background()// Create a simple queryr := rego.New(rego.Query("input.x == 1"),)// Prepare for evaluationpq, err := r.PrepareForEval(ctx)if err != nil {// Handle error.}// Raw input data that will be used in the first evaluationinput := map[string]any{"x": 2}// Run the evaluationrs, err := pq.Eval(ctx, rego.EvalInput(input))if err != nil {// Handle error.}// Inspect results.fmt.Println("initial result:", rs[0].Expressions[0])// Update inputinput["x"] = 1// Run the evaluation with new inputrs, err = pq.Eval(ctx, rego.EvalInput(input))if err != nil {// Handle error.}// Inspect results.fmt.Println("updated result:", rs[0].Expressions[0])}

Output:initial result: falseupdated result: true

package mainimport ("context""fmt""sort""strings""github.com/open-policy-agent/opa/v1/ast""github.com/open-policy-agent/opa/v1/rego")// This is typically not needed, but we do it here to ensure that our// example output is stable. We sort the result bodies, and rename the// variable that's `userX` for some number X to `user`.func makeStable(bodies []ast.Body) {for i := range bodies {ast.WalkTerms(bodies[i], func(t *ast.Term) bool {if v, ok := t.Value.(ast.Var); ok && strings.HasPrefix(string(v), "user") {t.Value = ast.Var("user")}return false})}sort.Slice(bodies, func(i, j int) bool { return bodies[i].Compare(bodies[j]) < 0 })}func main() {ctx := context.Background()// Define a simple policy for example purposes.module := `package testimport rego.v1allow if {input.method = read_methods[_]input.path = ["reviews", user]input.user = user}allow if {input.method = read_methods[_]input.path = ["reviews", _]input.is_admin}read_methods = ["GET"]`r := rego.New(rego.Query("data.test.allow"),rego.Module("example.rego", module),)pq, err := r.PrepareForPartial(ctx)if err != nil {// Handle error.}pqs, err := pq.Partial(ctx)if err != nil {// Handle error.}makeStable(pqs.Queries)// Inspect resultfmt.Println("First evaluation")for i := range pqs.Queries {fmt.Printf("Query #%d: %v\n", i+1, pqs.Queries[i])}// Evaluate with specified inputexampleInput := map[string]string{"method": "GET",}// Evaluate again with different input and unknownspqs, err = pq.Partial(ctx,rego.EvalInput(exampleInput),rego.EvalUnknowns([]string{"input.user", "input.is_admin", "input.path"}),)if err != nil {// Handle error.}makeStable(pqs.Queries)// Inspect resultfmt.Println("Second evaluation")for i := range pqs.Queries {fmt.Printf("Query #%d: %v\n", i+1, pqs.Queries[i])}}

Output:First evaluationQuery #1: "GET" = input.method; input.path = ["reviews", _]; input.is_adminQuery #2: "GET" = input.method; input.path = ["reviews", user]; user = input.userSecond evaluationQuery #1: input.path = ["reviews", _]; input.is_adminQuery #2: input.path = ["reviews", user]; user = input.user