Module opa 

Open Policy Agent authorization plugin (opa).

Delegates the access decision for each request to an external OPA server. The plugin builds an OPA input document describing the request (and, optionally, the matched consumer), POSTs it to <host>/v1/data/<policy>, and interprets the decision under result: allow: true continues (optionally copying selected OPA-provided headers onto the request forwarded upstream), while allow: false/missing rejects, honoring OPA-supplied status, headers, and reason. A callout or response-parse failure blocks the request by default.

Ports the APISIX opa plugin (and its opa/helper.lua input builder) onto featherbit’s shared outbound HTTP client.

Deviations from APISIX

featherbit has no route/service objects, so with_route and with_service are accepted for config compatibility but are no-ops (no route / service object is added to the input document). The input var block omits server_addr / server_port, which featherbit does not track in the request context.

Structs

OpaDecision 🔒

A parsed OPA decision (the result object of the response).

OpaPlugin

Sends an OPA input document to an external policy server and routes on the returned decision: allow: true continues (success port), otherwise rejects (error port).

Enums

OpaParseError 🔒

Why an OPA response could not be interpreted as a decision.

Functions

build_consumer 🔒

Builds the consumer object from context.message’s consumer.* keys, stripping the prefix. Returns None when no consumer is attached.

collapse_multi 🔒

Collapses a multi-valued header/query map into single strings where there is one value and arrays where there are several — mirroring OpenResty’s core.request.headers / get_uri_args shape.

parse_opa_response 🔒

Parses an OPA response body into an OpaDecision. Pure and network-free so the decision-mapping logic is unit-testable.

split_addr_port 🔒

Splits a client ip:port into (ip, port), tolerating bare IPs and bracketed IPv6.

split_host_port 🔒

Splits a Host header into (hostname, port), defaulting the port from the scheme when the host carries none.