func evaluateOPAPolicy()

in codelabs/health_data_analysis_codelab/src/uwear/workload.go [345:399]
45 lines of code
8 McCabe index (conditional complexity)

func evaluateOPAPolicy(ctx context.Context, token jwt.Token, ekm string, policyData string) (bool, error) {
	var claims jwt.MapClaims
	var ok bool
	if claims, ok = token.Claims.(jwt.MapClaims); !ok {
		return false, fmt.Errorf("failed to get the claims from the JWT")
	}

	module := fmt.Sprintf(opaPolicy, ekm)

	var json map[string]any
	err := util.UnmarshalJSON([]byte(policyData), &json)
	store := inmem.NewFromObject(json)

	// Bind 'allow' to the value of the policy decision
	// Bind 'hw_verified', 'image_verified', 'audience_verified, 'nonce_verified' to their respective policy evaluations
	query, err := rego.New(
		rego.Query(regoQuery),                          // Argument 1 (Query string)
		rego.Store(store),                              // Argument 2 (Data store)
		rego.Module("confidential_space.rego", module), // Argument 3 (Policy module)
	).PrepareForEval(ctx)

	if err != nil {
		fmt.Printf("Error creating query: %v\n", err)
		return false, err
	}

	fmt.Println("Performing OPA query evaluation...")
	results, err := query.Eval(ctx, rego.EvalInput(claims))

	if err != nil {
		fmt.Printf("Error evaluating OPA policy: %v\n", err)
		return false, err
	} else if len(results) == 0 {
		fmt.Println("Undefined result from evaluating OPA policy")
		return false, err
	} else if result, ok := results[0].Bindings["allow"].(bool); !ok {
		fmt.Printf("Unexpected result type: %v\n", ok)
		fmt.Printf("Result: %+v\n", result)
		return false, err
	}

	fmt.Println("OPA policy evaluation completed.")

	fmt.Println("OPA policy result values:")
	for key, value := range results[0].Bindings {
		fmt.Printf("[ %s ]: %v\n", key, value)
	}
	result := results[0].Bindings["allow"]
	if result == true {
		fmt.Println("Policy check PASSED")
		return true, nil
	}
	fmt.Println("Policy check FAILED")
	return false, nil
}