Way to extend builtin functions without compiling a custom version of OPA?

[jondot]

Hi,
I want to add a BIF (matching semvers), which may or may not be generally wanted by OPA/rego officially.

I'm compiling policies with OPA Go to WASM, and then executing the WASM policy with my Rust SDK. In that sense I don't care about Go executing my policy and so I don't need to implement a custom BIF in Go, but just in my Rust SDK.
All I need for now is for OPA Go, to stop telling me a function does not exist (because it parses the AST and finds a name it doesn't know).

So I compiled my own version of OPA Go with the addition:

diff --git a/ast/builtins.go b/ast/builtins.go
index 321012d..fdf7af2 100644
--- a/ast/builtins.go
+++ b/ast/builtins.go
@@ -286,6 +286,7 @@ var DefaultBuiltins = [...]*Builtin{
 	// SemVers
 	SemVerIsValid,
 	SemVerCompare,
+	SemVerIsMatch,
 
 	// Printing
 	Print,
@@ -2971,6 +2972,18 @@ var SemVerCompare = &Builtin{
 	),
 }
 
+var SemVerIsMatch = &Builtin{
+	Name:        "semver.is_match",
+	Description: "Check a semver against a version constraint",
+	Decl: types.NewFunction(
+		types.Args(
+			types.Named("a", types.S),
+			types.Named("b", types.S),
+		),
+		types.Named("result", types.N).Description("`true` if `a` is 14.0.0 and `b` is `> 13.0.0, < 15.0.0`"),
+	),
+}

I then built the policy into WASM, and executed it with my Rust SDK where I implemented a valid semver.is_match function in the Rust side.

Now to my question:

Is it possible to just tell OPA "if you see func_name, just ignore it, it is SDK dependent, compile to WASM and trust me"?

[srenatus]

Short answer: Capabilities! If you create a capabilities.json with your builtin added, then opa build -t wasm --capabilities my-caps.json will build a wasm module that understands that semver.is_match is an SDK-dependant builtin function.

An easy way to generate said capabilities file is probably to run opa capabilities --current with your own opa version you've mentiond above. You'll only need to do that once, and you can reuse the capabilities.json file for a while (until OPA has another builtin that isn't yet in your capabilities.json but that you'd like to use).

All that said, semver.is_match sounds like a very reasonable builtin to have in upstream OPA, too. That wouldn't come with an wasm-native implementation right away, but it seems like you got that sorted already 😄 If someone contributes a semver.is_match of the type you've mentioned there, you'd never have to mess with capabilities for building your wasm modules.

[jondot]

This works really well, thanks!