feat(builtins): implement json.filter, json.patch, json.remove - #193
Merged
Merged
Conversation
Add the path-based JSON builtins from the object category. They operate on the decoded RegoValue tree rather than JSON text, using JSON-Pointer paths (RFC6901). - json.filter / json.remove parse the paths argument into one tree, then walk the input once to keep or drop the named locations (a shorter path subsumes a longer one). - json.patch applies RFC6902 operations (add/remove/replace/move/copy/test) by folding recursive get/insert/remove helpers over the value. Operation failures throw, surfacing as undefined under non-strict evaluation. Fixes open-policy-agent#192 Signed-off-by: Dmitry Frenkel <d_frenkel@apple.com>
DFrenkel
force-pushed
the
builtins-objects
branch
from
July 25, 2026 01:45
8eda1b0 to
114c039
Compare
philipaconrad
approved these changes
Aug 6, 2026
philipaconrad
left a comment
philipaconrad
left a comment
Member
There was a problem hiding this comment.
This looks like a correct port of the json.filter, json.patch, and json.remove builtins.
I'm not sure that I agree with all of the rationale around why edittree-style structures would be less effective here, but I do agree that porting that sort of bookkeeping structure would have enormously complicated the PR.
If we get complaints around json.patch's performance in the future, we can investigate and see if alternative data structures like the edittree design would be worth trying out.
For now though, I think this is good to ship. Thanks @DFrenkel!
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What code changed, and why?
Add the object-category JSON builtins (
json.filter,json.patch,json.remove), matching OPA Go semantics. They address nested locations by JSON-Pointer path (RFC6901: a/-separated string with~0/~1unescaping, or an array of segments) rather than operating on JSON text.filter/removetake a set or array of paths, collapse them into a single tree, and walk the input once to keep or drop the named locations; a shorter path subsumes a longer one ("a"covers"a/b").patchapplies RFC6902 operations (add/remove/replace/move/copy/test) over objects, arrays, sets, and scalars; a failed operation (bad path, failedtest, unknown op) becomes undefined under non-strict evaluation.patchis implemented directly on the immutableRegoValuetree rather than porting OPA's mutableedittree. edittree avoids re-copying the document as many edits are applied in place. BecauseRegoValueis an immutable value type (copy-on-write), the same RFC6902 behavior comes from plain recursive get/insert/remove functions that return new values. A patch applies its operations to one document and returns the result, so there's no repeated in-place editing for edittree to speed up, and copy-on-write keeps the intermediate copies cheap. It passes the fulljson-patch-testsconformance set this way.Definition of done
All relevant
json(filter|remove|patch)compliance tests pass except for existing known issuesHow to test
make fmt lint testOPA_COMPLIANCE_TESTS=".*json(filter|remove|patch).*" make test-complianceRelated Resources
Fixes #192