rego

# rule-name IS value IF body
# 多个表达式为 AND
v if { a:=1; a == 1； 2 == 2 }
# if 可以省略
v { "hello" == "world" }

# METADATA
# title: My rule
# description: A rule that determines if x is allowed.
# authors:
# - John Doe <[email protected]>
# entrypoint: true

# METADATA
# schemas:
#   - input: schema.input
#   - data.acl: schema["acl-schema"]
allow {
    access := data.acl["alice"]
    access[_] == input.operation
}

# METADATA
# schemas:
#   - input.x: {type: number}
allow {
    input.x == 42
}

# METADATA
# title: Example
# description: Example package with documentation
package example

import future.keywords.contains
import future.keywords.if

# METADATA
# title: Deny non admin users
# description: Only admin users are allowed to access these resources
# related_resources:
# - https://docs.example.com/policy/rule/E123
# custom:
#   code: 401
#   error_id: E123
deny contains {
	"code": metadata.custom.code,
	"message": sprintf("Unauthorized due to policy rule (%s, %s)", [
		metadata.custom.error_id,
		concat(",", [ref | ref := metadata.related_resources[_].ref]),
	]),
} if {
	input.admin == false

	metadata := rego.metadata.rule()
}

ok:= false
h := r  if {
	ok;
	r := {"OK":1, "X":input.X}
}

h := r  if {
	not ok;
	r := {"OK":0, "X":input.X}
}

h2 := r if {
	r:= h with input as {"X":2}
}

# 多个规则
deny[message] if {
  condition
  message := "Why";
}

# 最终
allowed if {
  true
}

headers := {
    "X-OK": "OK",
}

headers["X-OK"] = 1

headers := {
    "X-OK": "X"
} if {}
else = {
    "X-OK": 1
}