OPA reference language: how to know type of variable

Question

I am using Open Policy Language to implement policies for my microservices using JWT with roles and groups.

My OPA policy are decoding the JWT and extracting the claims. The problem is that some of this claim could be a scalar (eg. group1) or an array (eg ["group1", "group2"]) and I need to know in order to correctly process it.

The question is similar to How can one determine the type of a variable in opa?

Any help?

Answer 1

You'd commonly use the built-in is_xxxxx functions for checking types. Following your example you probably want something like:

allow {
    is_array(claims.groups)
    claims.groups[_] == "group1"
}

allow {
    is_string(claims.groups)
    claims.groups == "group1"
}