v2.1.0

Changelog

All notable changes to this project will be documented in this file.

[v2.1.0]

Added

• OpaClient.compile_query / AsyncOpaClient.compile_query — support for OPA's
  Compile API (POST /v1/compile), enabling partial evaluation of a query against
  a chosen set of unknowns (e.g. compiling a policy into a residual filter for
  use with data.reports-style authorization-as-filter patterns).
• AsyncOpaClient now retries requests on connection errors and on 500/502/504
  responses, honoring the retries option the same way the sync client's
  urllib3.Retry-backed session already did.
• OpaClient.get_config / AsyncOpaClient.get_config — support for OPA's
  GET /v1/config endpoint, returning the server's active configuration.
• OpaClient.get_metrics / AsyncOpaClient.get_metrics — support for OPA's
  GET /metrics endpoint, returning Prometheus-formatted performance metrics.
• OpaClient.patch_data / AsyncOpaClient.patch_data — support for PATCH /v1/data,
  enabling partial updates to existing data using a JSON Patch (RFC 6902) document
  instead of overwriting the whole document.

Changed

• AsyncOpaClient now inherits from BaseClient, removing ~70 lines of duplicated
  property boilerplate and sharing the Rego-compat helper methods with the sync client.

Fixed

• AsyncOpaClient.update_or_create_data raised AttributeError instead of
  RegoParseError on a 400 response, because AsyncOpaClient did not inherit
  BaseClient and therefore lacked _raise_rego_parse_error.

• AsyncOpaClient.check_permission sent requests to a duplicated /v1/data/data/...
  endpoint (the AST-derived package path already includes a leading data segment),
  causing it to silently return an empty result instead of the permission decision.

• AsyncOpaClient raised TypeError instead of the intended exception in several
  error paths (update_policy_from_file, policy_to_file, check_permission) because
  FileError, PolicyNotFoundError, PathNotFoundError, and CheckPermissionError
  were called with only one of their two required constructor arguments.

• OpaClient.ad_hoc_query and AsyncOpaClient.ad_hoc_query now send the ad hoc query
  and input document in the JSON body of a POST /v1/query request, matching OPA's
  REST API contract, instead of mixing a GET-style q query parameter with an
  unrelated JSON body.

v2.0.5

v2.0.5

OPA 1.0+ compatibility

OPA 1.0 enforces Rego v1 syntax. Policies written in the legacy v0 style (for example allow { ... }) fail to compile with errors such as:

if keyword is required before rule body

This release adds automatic backward-compatible handling when uploading policies.

Auto-upgrade on upload

update_policy_from_string(..., rego_compat=True) is now the default behavior:

1. Upload the policy as-is (works with OPA 0.x and v0 Rego).
2. If OPA rejects it due to v0 syntax, upgrade common constructs and retry.

Supported upgrades:

v0 syntax	v1 syntax
allow { ... }	allow if { ... }
deny[msg] { ... }	deny contains msg if { ... }

Compatibility matrix

Server	v0 policy	v1 policy
OPA 0.x	Works on first upload	Works
OPA 1.0+	Auto-upgraded and retried	Works on first upload

To disable auto-upgrade:

client.update_policy_from_string(policy, "my_policy", rego_compat=False)

Improvements

• RegoParseError now includes OPA’s detailed errors list in the exception message.
• AsyncOpaClient.update_policy_from_string now sends the correct Content-Type: text/plain header.
• README and CONTRIBUTING updated with Rego v1 examples and OPA version guidance.

Dependencies

• aiohttp ^3.14.1
• requests ^2.34.2
• urllib3 ^2.7.0

Upgrade notes

• New policies: use Rego v1 syntax (allow if { ... }).

• Existing v0 policies: no code changes required; the client upgrades them on upload by default.

• Integration tests: require a running OPA server; compatible with OPA 0.x and 1.0+.

• Legacy OPA mode: run OPA with --v0-compatible if you need strict v0 behavior:

  docker run -it --rm -p 8181:8181 openpolicyagent/opa run --server --addr :8181 --v0-compatible

v2.0.4

Update dependencies to fix vulnerabilities

Full Changelog: v2.0.3...v2.0.4

v2.0.3

What's Changed

• Fix BaseClient not respecting retries and timeout by @TheRealHaoLiu in #30
• fix issue #32 by @Turall in #33
• fix issue #31 by @Turall in #34

New Contributors

• @TheRealHaoLiu made their first contribution in #30

Full Changelog: v2.0.2...v2.0.3

RELEASE

What's Changed

• Add expressions for raised errros by @FHaggs in #27

New Contributors

• @FHaggs made their first contribution in #27

Full Changelog: v2.0.0...v2.0.2

V2.0.0

Full Changelog: 91e0e43

This RELEASE is not compatible with v.1.*

v.1.3.7

Full Changelog: v1.3.5...v.1.3.7

RELEASE

v1.3.6

update dependencies

RELEASE

What's Changed

• Update certifi dependency by @cbrand in #20

New Contributors

• @cbrand made their first contribution in #20

Full Changelog: 1.3.4...v1.3.5

RELEASE

What's Changed

• Added poetry and formatter to the OPA client by @sabuhish in #14
• applied fix to return multiple rules in a policy by @migster8 in #18

New Contributors

• @migster8 made their first contribution in #18

Full Changelog: v1.3.3...1.3.4