Skip to content

Policy evaluation should not entail fetching policy #31

@anderseknert

Description

@anderseknert

First of all, thanks for contributing this client to the OPA and Python ecosystems!

While browsing the source code of the check_permission function today, I noticed that it fetches the the policy identified by the policy_name argument for each request, and parses its AST JSON for the package path + rules, to use to build the actual policy query. This is extra roundtrip to OPA is quite inefficient and should normally not be needed, as the query path should either be known by the client beforehand (either via configuration, hard coded, or whatever makes the most sense), or it could query / for the default decision.

The query_rule function on the other hand looks like a fairly idiomatic approach. I would suggest making that the first and most prominent example under the Policy Evaluation section of the docs, and if not remove the check_permission example, at least include a disclaimer about the other method being the preferred one.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions