Skip to main content

Set Built-ins

FunctionDescriptionOPAWasmSwiftJava
x & y​

x & y

Returns the intersection of two sets.

Arguments:
x (set[any])

the first set

y (set[any])

the second set

Returns:
z (set[any])

the intersection of x and y

v0.17.0✓0.0.10.1.0
intersection​

y := intersection(xs)

Returns the intersection of the given input sets.

Arguments:
xs (set[set[any]])

set of sets to intersect

Returns:
y (set[any])

the intersection of all xs sets

v0.17.0✓0.0.10.1.0
x - y​

x - y

Minus subtracts the second number from the first number or computes the difference between two sets.

Arguments:
x (any<number, set[any]>)
y (any<number, set[any]>)
Returns:
z (any<number, set[any]>)

the difference of x and y

v0.17.0✓0.0.10.1.0
x | y​

x | y

Returns the union of two sets.

Arguments:
x (set[any])
y (set[any])
Returns:
z (set[any])

the union of x and y

v0.17.0✓0.0.10.1.0
union​

y := union(xs)

Returns the union of the given input sets.

Arguments:
xs (set[set[any]])

set of sets to merge

Returns:
y (set[any])

the union of all xs sets

v0.17.0✓0.0.10.1.0

Examples​

intersection​

intersection returns the values that appear in every set of a set-of-sets. Comparing a caller's granted scopes with the scopes an endpoint requires is a typical case: anything left after subtracting the intersection from the requirement is missing.

Checking that required scopes are present

intersection returns the values common to every set you pass in. A typical use is comparing a caller's granted scopes with the scopes an endpoint requires: if the intersection is smaller than the requirement, something is missing.

policy.rego
package play

granted := {s | some s in input.granted}
required := {s | some s in input.required}

present := intersection({granted, required})

missing := required - present

default allow := false

allow if count(missing) == 0

deny contains msg if {
	count(missing) > 0
	msg := sprintf("missing required scopes: %v", [missing])
}
Output
{
  "allow": false,
  "deny": [
    "missing required scopes: {\"write:payments\"}"
  ],
  "granted": [
    "read:orders",
    "read:profile",
    "write:orders"
  ],
  "missing": [
    "write:payments"
  ],
  "present": [
    "read:orders"
  ],
  "required": [
    "read:orders",
    "write:payments"
  ]
}
Loading...
input.json
{
  "granted": [
    "read:orders",
    "write:orders",
    "read:profile"
  ],
  "required": [
    "read:orders",
    "write:payments"
  ]
}
data.json
{}

Open in OPA Playground