OpaDotNet.Wasm 1.1.0-preview0012

Open Policy Agent (OPA) WebAssembly dotnet core SDK

This is SDK for using WebAssembly (wasm) compiled Open Policy Agent Rego policies with dotnet core.

Initial implementation was based on Open Policy Agent WebAssemby NPM Module

For more information check out the guide.

Supported ABI

Getting Started

Install nuget package

dotnet add package OpaDotNet.Wasm

Usage

To evaluate OPA policy you need to:

Load compiled policy

using using OpaDotNet.Wasm;

var factory = new OpaEvaluatorFactory();

const string data = "{ \"world\": \"world\" }";

using var engine = factory.CreateFromWasm(
    File.OpenRead("policy.wasm")
    );

engine.SetDataFromRawJson(data);

Evaluate policy

IOpaEvaluator has several APIs for policy evaluation:

• EvaluatePredicate - Evaluates named policy with specified input. Response interpreted as simple true/false result.
• Evaluate - Evaluates named policy with specified input.
• EvaluateRaw - Evaluates named policy with specified raw JSON input.

var policyResult = engine.EvaluatePredicate(inp);

Check result

if (policyResult)
{
    // We've been authorized.
}
else
{
    // Can't do that.
}

Writing policy

See writing policy

Compiling policy

You have several options to compile rego policy into wasm module:

package example

default hello = false

hello {
    x := input.message
    x == data.world
}

Manually

Either use the Compile REST API or opa build CLI tool.

For example, with OPA v0.20.5+:

opa build -t wasm -e example/hello example.rego

Which is compiling the example.rego policy file. The result will be an OPA bundle with the policy.wasm binary included. See ./samples for a more comprehensive example.

See opa build --help for more details.

With OpaDotNet.Wasm.Compilation

You can use SDK to do compilation for you.

Important. You will need opa cli tool to be in your PATH or provide full path in RegoCliCompilerOptions.

using OpaDotNet.Wasm;
using OpaDotNet.Wasm.Compilation;

var options = new OptionsWrapper<RegoCliCompilerOptions>(new RegoCliCompilerOptions());
var compiler = new RegoCliCompiler(options);
var policyStream = await compiler.CompileFile("example.rego", new[] { "example/hello" });

// Use compiled policy.
var factory = new OpaEvaluatorFactory();

using var engine = factory.CreateFromBundle(policyStream);

3rd Party Libraries and Contributions

• OPA - An open source, general-purpose policy engine that unifies policy enforcement across the stack.
• Moq - The most popular and friendly mocking library for .NET.
• xUnit.net - Free, open source, community-focused unit testing tool for the .NET Framework.
• wasmtime-dotnet - .NET embedding of Wasmtime.
• IPNetwork2 - Utility classes take care of complex network, IPv4, IPv6, CIDR calculation for .NET developers.