json.remove with dynamic length arrays

[ZachTB123]

I'm looking into using OPA to handle data redaction on arbitrary json data that is provided by our users. I would like to allow users to specify fields within this data that is considered "sensitive" and should be removed when other customers access this data. My plan is that users could specify these fields in JSON dot notation and then use those to remove the data.

json.remove looks to be a good fit for what I'm doing. I can convert the user provided JSON dot notation paths into the expected paths input argument. The challenge I'm seeing is that I would want to remove object fields from all indices in an array. So for example:

If a provided path for sensitive data is like: users[*].ssn and the input data is:

{
  "users": [
    {
      "firstName": "<data>",
      "lastName": "<data>",
      "ssn": "<data>"
    },
    {
      "firstName": "<data>",
      "lastName": "<data>",
      "ssn": "<data>"
    }
  ]
}

the expected output would be:

{
  "users": [
    {
      "firstName": "<data>",
      "lastName": "<data>"
    },
    {
      "firstName": "<data>",
      "lastName": "<data>"
    }
  ]
}

I can accomplish this by doing: obj := json.remove(input, ["users/0/ssn", "users/1/ssn"]). Here is a rego playground link.

I'm wondering if there is a way to make this more dynamic. Something like obj := json.remove(input, ["users/*/ssn"]). I'm sure I could build up the paths argument by inspecting the length of the array, but before I go down that path, I was wondering if there are any wildcard options available to json.remove since the data I'm accepting is dynamic.

[anderseknert]

Hi there! No, few of the built-in functions accept glob patterns. A simple loop would be your best option here, I think:

obj.users contains redacted if {
    some user in input.users
    redacted := json.remove(user, ["ssn"])
}