Use rego to compare before and after values from list of inputs

When I run the following, I can compare the values for parameter instance_class and count the number of discrepancies:

modifies_instance_class[resource_type] = num {
    some resource_type
    resource_types[resource_type]
    all := resources[resource_type]
    modifies := [res |  res:= all[_]; res.change.after.instance_class != res.change.before.instance_class]
    num := count(modifies)
}

However, I'd like to be able to use the same block of code to compare different parameters values contained in my list my_params. I've tried the following but this doesn't work.

my_params = {"instance_class", "engine_version", "identifier"}

modifies_instance_class[resource_type] = num {
    some resource_type
    some parameter
    resource_types[resource_type]
    my_params[parameter]
    all := resources[resource_type]
    modifies := [res |  res:= all[_]; res.change.after.parameter != res.change.before.parameter]
    num := count(modifies)
}

As Patrick East mentioned, there are a couple issues. I thought I'd break down each one and provide a bit more detail. Here's the final version that I came up with: https://play.openpolicyagent.org/p/rl1p43N5HR

1st problem: lookup the field using the parameter var

The expression res.change.after.parameter looks up the field named "parameter" in the the object referenced by res.change.after. In other words, the syntax foo.bar is sugar for foo["bar"]. The expression foo["bar"] selects the field "bar" (string 'bar') from the value foo. To fix this, change res.change.after.parameter to res.change.after[parameter]. Now parameter refers to the variable.

modifies_instance_class_V1[resource_type] = num {
    some resource_type, parameter
    resource_types[resource_type]
    my_params[parameter]
    all := resources[resource_type]
    modifies := [res | res:= all[_]; res.change.after[parameter] != res.change.before[parameter]]
    num := count(modifies)
}

2nd problem: make modifies_instance_class generate one value per key

The second problem is that rule will generate conflicting values for the modifies_instance_class document. Rules of the form p[x] = y { ... } generate a JSON document named p where x and y are the keys and values (respectively). OPA has to treat conflicting values for the same key as runtime errors.

For example, imagine OPA contains the following data:

resource_types = {"servers"}

resources = {
  "servers": [{
      "after": {"instance_class": "ic1", "identifier": "id1"},
      "before": {"instance_class": "ic2", "identifier": "id1"}
  }]
}

The data indicates there is one resource_type ("servers") and one server. The data for the server indicates the instance_class field changed.

When OPA evaluates the rule, it will search for variable assignments that satisfy all of the expressions in the rule body:

# This is the rule body from above.
some resource_type, parameter
resource_types[resource_type]
my_params[parameter]
all := resources[resource_type]
modifies := [res | res:= all[_]; res.change.after[parameter] != res.change.before[parameter]]
num := count(modifies)

In this case,
OPA finds values for resource_type, parameter, all, modifies, and num. Ignore the all, modifies, and _ variables for now.

In this case, OPA will find two sets of variable assignments:

{resource_type: "servers", parameter: "instance_class", num: 1}
{resource_type: "servers", parameter: "identifier", num: 0}

The problem is that the rule generates a mapping from resource_type to num. In this case, that produces {"servers": 1} and {"servers": 0}. This is the conflict. Which document is correct?

To resolve this we can simply move the my_params[parameter] expression into the body of the array comprehension.

modifies_instance_class_V2[resource_type] = num {
    some resource_type
	resource_types[resource_type]
    all := resources[resource_type]
    modifies := [[res, parameter] |   # NOTE: this generates an array of resource/parameter tuples now.
    	some parameter
	    my_params[parameter]
    	res := all[_]
    	res.change.after[parameter] != res.change.before[parameter]
    ]
    num := count(modifies)
}

With this change, OPA will only find one set of variable assignments:

{resource_type: "servers", num: 1}

> Note, if OPA were to find other values for resource_type that would be fine because those would be different keys in the document produced by modifies_instance_class.

3rd problem: what if the parameter field is missing before or after?

There is one more problem to deal with. In the examples above, we assumed that looking up the field referred to by the parameter var would always return a value. What if this is not the case? What if one of the before or after objects are missing the field?

In this case, the reference res.change.after[parameter] or res.change.before[parameter] would be undefined. If either value is undefined, the expression res.change.after[parameter] != res.change.after[parameter] is also undefined (https://www.openpolicyagent.org/docs/latest/#expressions-logical-and). If the expression is undefined, OPA cannot assert that it's true, so the result is not included in the result (or in this case, the array computed by the comprehension.)

Depending on the nature of the data, this may (or may not) matter. To deal with this we can extend the check to deal with the case where the field is undefined on one side (or both).

modifies_instance_class_V3[resource_type] = num {
    some resource_type
	resource_types[resource_type]
    all := resources[resource_type]
    modifies := [[res, parameter] |
    	some parameter
	    my_params[parameter]
    	res := all[_]
    	not same_or_both_undefined(res.change.after, res.change.before, parameter)
    ]
    num := count(modifies)
}

same_or_both_undefined(a, b, k) = true {
	a[k] == b[k]
}

same_or_both_undefined(a, b, k) = true {
	not a[k]
	not b[k]
}

> Note: In this case we have to use a helper function because want to express logical OR: https://www.openpolicyagent.org/docs/latest/#logical-or.

Couple of things:

First issue is using res.change.after.parameter in this way will cause problems. That is using a key named "parameter" and not the variable. You'll have to do something like res.change.after[parameter]. That should avoid the first error.. But exposes the next (and bigger) issue:

eval_conflict_error: object keys must be unique

The issue being the way you are combining them where you have my_params[parameter] and counting the modifies. It is going to give you a num distinct to the parameter for each resource_type (ie, some resource type x may have a num of 0 for instance_class and a 2 for identifier), which is tricky with the way you are structuring the results as a map of resource_type to num (since there are potentially >1 num for each)

If you only care about the count you could do another comprehension that checks each parameter for each resource (maybe not the best option.. but works). An example of that working is here: https://play.openpolicyagent.org/p/5T5TntBygd

modifies_instance_class[resource_type] = num {
    some resource_type
    resource_types[resource_type]
    all := resources[resource_type]
    modifies := [res |
    	res := all[_]		# For each resource
        # Check if one of the params we care about changed
        changed_params := 
; res.change.after
 != res.change.before
] 	
        count(changed_params) > 0
    ]
    num := count(modifies)
}

Note that this example isn't great for providing any kind of feedback about what changed, so as a helper it might be useful but mileage on it may vary.