feat: As a user, I want to include the request body in the opa-input, so that I can reason about its contents

apisix/plugins/opa.lua

@@ -51,6 +51,7 @@ local schema = {
         with_route = {type = "boolean", default = false},
         with_service = {type = "boolean", default = false},
         with_consumer = {type = "boolean", default = false},
+        with_body = {type = "boolean", default = false}
     },
     required = {"host", "policy"}
 }

apisix/plugins/opa/helper.lua

@@ -34,9 +34,25 @@ local function build_var(conf, ctx)
     }
 end
 
+local function get_body_for_request()
+    local original_body, err = core.request.get_body()
+    if err ~= nil then
+        return nil, "failed to get request body: " .. err
+    end
+    if original_body == nil then
+        return nil
+    end
+    -- decode to prevent double encoded json objects
+    local body, err = core.json.decode(original_body)
+    if err ~= nil then
+        -- if its not json, the body can just be added
+        body = original_body
+    end
+    return body
+end
 
 local function build_http_request(conf, ctx)
-    return {
+    local http = {
         scheme  = core.request.get_scheme(ctx),
         method  = core.request.get_method(),
         host    = core.request.get_host(ctx),
@@ -45,8 +61,18 @@ local function build_http_request(conf, ctx)
         headers = core.request.headers(ctx),
         query   = core.request.get_uri_args(ctx),
     }
-end
 
+    if conf.with_body then
+        local body, err = get_body_for_request()
+        if err then
+            core.log.warn(err)
+        else
+            http.body = body
+        end
+    end
+
+    return http
+end
 
 local function build_http_route(conf, ctx, remove_upstream)
     local route = core.table.deepcopy(ctx.matched_route).value

ci/pod/docker-compose.plugin.yml

@@ -182,11 +182,14 @@ services:
     restart: unless-stopped
     ports:
       - 8181:8181
-    command: run -s /example.rego /echo.rego /data.json /with_route.rego
+    command: run -s /example.rego /echo.rego /data.json /with_route.rego /with_body.rego
     volumes:
       - type: bind
         source: ./ci/pod/opa/with_route.rego
         target: /with_route.rego
+      - type: bind
+        source: ./ci/pod/opa/with_body.rego
+        target: /with_body.rego
       - type: bind
         source: ./ci/pod/opa/example.rego
         target: /example.rego

ci/pod/opa/with_body.rego

@@ -0,0 +1,29 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+package with_body
+
+import input.request
+
+default allow = false
+
+allow {
+    request.method == "POST"
+}
+
+allow {
+    request.body
+}

docs/en/latest/plugins/opa.md

@@ -46,6 +46,7 @@ The `opa` Plugin can be used to integrate with [Open Policy Agent (OPA)](https:/
 | with_route        | boolean | False    | false   |               | When set to true, sends information about the current Route.                                                                                                                               |
 | with_service      | boolean | False    | false   |               | When set to true, sends information about the current Service.                                                                                                                             |
 | with_consumer     | boolean | False    | false   |               | When set to true, sends information about the current Consumer. Note that this may send sensitive information like the API key. Make sure to turn it on only when you are sure it is safe. |
+| with_body         | boolean | False    | false   |               | When set to true, sends the request body. |
 
 ## Data definition
 

t/plugin/opa3.t

@@ -0,0 +1,91 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+use t::APISIX 'no_plan';
+
+repeat_each(1);
+no_long_string();
+no_root_location();
+
+add_block_preprocessor(sub {
+    my ($block) = @_;
+
+    if (!defined $block->request) {
+        $block->set_value("request", "GET /t");
+    }
+});
+
+run_tests();
+
+__DATA__
+
+
+=== TEST 1: setup route with plugin
+--- config
+    location /t {
+        content_by_lua_block {
+            local t = require("lib.test_admin").test
+            local code, body = t('/apisix/admin/routes/1',
+                ngx.HTTP_PUT,
+                [[{
+                        "methods": ["POST"],
+                        "plugins": {
+                            "opa": {
+                                "host": "http://127.0.0.1:8181",
+                                "policy": "with_body",
+                                "with_body": true
+                            }
+                        },
+                        "upstream": {
+                            "nodes": {
+                                "127.0.0.1:1980": 1
+                            },
+                            "type": "roundrobin"
+                        },
+                        "uris": ["/hello", "/test"]
+                }]]
+                )
+
+            if code >= 300 then
+                ngx.status = code
+            end
+            ngx.say(body)
+        }
+    }
+--- response_body
+passed
+
+=== TEST 2: hit route (with empty request)
+--- request
+POST /hello
+--- response_body
+hello world
+
+=== TEST 3: hit route (with json request)
+--- request
+POST /hello
+{
+    "hello": "world"
+}
+--- response_body
+hello world
+
+=== TEST 4: hit route (with non-json request)
+--- request
+POST /hello
+hello world
+--- response_body
+hello world