Test policies on your machine with opa test

You can test a policy set on your machine with the stock opa CLI. You need no running Ironflow server for the tests, and you can run them in CI.

Step 1. Pull the helper files

ironflow policy pull ./policies

pull writes these files into the directory:

Path	Content
*.rego files	The active set, with the same names as on the server.
.ironflow/lib/irn.rego	The IRN library, package ironflow.lib.irn. Your rules import it.
.ironflow/input.schema.json	The JSON schema of input.
.ironflow-policy.json	The version, decision rule and mode. push reads it.

The helper files make opa test work. A rule that calls irn.match needs .ironflow/lib/irn.rego in the directory. Ironflow injects the same library on the server, so the local result and the server result use the same code.

push skips .ironflow/. You can commit the helper files to version control, so that CI needs no server.

Step 2. Run opa test

opa test ./policies

opa test finds every _test.rego file in the directory. Write tests in package ironflow.authz_test for rules in package ironflow.authz. Ironflow allows only these two package names under ironflow for your files.

package ironflow.authz_test

import data.ironflow.authz

test_contractor_denied if {
  count(authz.deny) == 1 with input as {
    "request": {"action": "runs:delete"},
    "subject": {"user_email": "bob@contractor.test"},
  }
}

Pass input the same way the engine does. For the native view, give request and subject. For a policy that reads the Envoy view, also give attributes.request.http, parsed_path and parsed_query. See Policy set input for every field.

Step 3. Check types in your editor

.ironflow/input.schema.json is the schema that the server uses to type-check package ironflow.authz. Point your tools at it, so that a wrong field name or type shows before you push:

opa check ./policies --schema ./policies/.ironflow/input.schema.json

The server runs the same check on every write. A type error in a file of package ironflow.authz fails the write with policy_set_schema_error.

Step 4. Check against the server

Local tests cannot know the server rules for file names, banned builtins and size. Run validate before you push. It makes no change:

ironflow policy validate ./policies

Then dry-run an input:

ironflow policy dry-run ./policies --input request.json

dry-run evaluates the files on the server. It uses the pinned OPA version of the engine, the 50 ms evaluation limit and the banned-builtin list. A rule that is slow or that uses a banned builtin shows here, not in opa test.

In CI

A job for a policy repository:

opa test ./policies
ironflow policy validate ./policies

Commit the pulled helper files (.ironflow/lib/irn.rego) with your rules. Do not run pull in a job that has local edits: pull overwrites files with the server copy.

validate and dry-run are rate-limited: one request every second per organization on each node, with a burst of 10. Keep the number of calls in a pipeline small.