fix(plugin/opa): safely remove upstream when sending route to opa

apisix/plugins/opa/helper.lua

@@ -49,9 +49,10 @@ end
 
 
 local function build_http_route(conf, ctx, remove_upstream)
-    local route = core.table.clone(ctx.matched_route).value
+    local route = core.table.deepcopy(ctx.matched_route).value
 
     if remove_upstream and route and route.upstream then
+        -- unimportant to send upstream info to OPA
         route.upstream = nil
     end
 

ci/pod/docker-compose.plugin.yml

@@ -182,8 +182,11 @@ services:
     restart: unless-stopped
     ports:
       - 8181:8181
-    command: run -s /example.rego /echo.rego /data.json
+    command: run -s /example.rego /echo.rego /data.json /with_route.rego
     volumes:
+      - type: bind
+        source: ./ci/pod/opa/with_route.rego
+        target: /with_route.rego
       - type: bind
         source: ./ci/pod/opa/example.rego
         target: /example.rego

ci/pod/opa/with_route.rego

@@ -0,0 +1,24 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+package with_route
+default allow = false
+
+allow {
+  input.route.name == "valid"
+}
+
+status_code = 403 {not allow}

t/plugin/opa2.t

@@ -224,3 +224,91 @@ GET /hello?user=elisa
 --- error_code: 403
 --- response_body chomp
 {"info":[]}
+
+
+
+=== TEST 9: create route: `with_route = true` and opa validation passes when route name == "valid"
+--- config
+    location /t {
+        content_by_lua_block {
+            local t = require("lib.test_admin").test
+            local code, body = t('/apisix/admin/routes/1',
+                ngx.HTTP_PUT,
+                [[{
+                    "name": "valid",
+                    "plugins": {
+                        "opa": {
+                            "host": "http://127.0.0.1:8181",
+                            "policy": "with_route",
+                            "with_route": true
+                        }
+                    },
+                    "upstream": {
+                        "nodes": {
+                            "127.0.0.1:1980": 1
+                        },
+                        "type": "roundrobin"
+                    },
+                    "uri": "/hello"
+                }]]
+                )
+
+            if code >= 300 then
+                ngx.status = code
+            end
+            ngx.say(body)
+        }
+    }
+--- response_body
+passed
+
+
+
+=== TEST 10: hit route
+--- request
+GET /hello
+--- error_code: 200
+
+
+
+=== TEST 11: create route: `with_route = true` and opa validation fails when route name != "valid"
+--- config
+    location /t {
+        content_by_lua_block {
+            local t = require("lib.test_admin").test
+            local code, body = t('/apisix/admin/routes/1',
+                ngx.HTTP_PUT,
+                [[{
+                    "name": "not_valid",
+                    "plugins": {
+                        "opa": {
+                            "host": "http://127.0.0.1:8181",
+                            "policy": "with_route",
+                            "with_route": true
+                        }
+                    },
+                    "upstream": {
+                        "nodes": {
+                            "127.0.0.1:1980": 1
+                        },
+                        "type": "roundrobin"
+                    },
+                    "uri": "/hello"
+                }]]
+                )
+
+            if code >= 300 then
+                ngx.status = code
+            end
+            ngx.say(body)
+        }
+    }
+--- response_body
+passed
+
+
+
+=== TEST 12: hit route
+--- request
+GET /hello
+--- error_code: 403