v2.0.5

v2.0.5

OPA 1.0+ compatibility

OPA 1.0 enforces Rego v1 syntax. Policies written in the legacy v0 style (for example allow { ... }) fail to compile with errors such as:

if keyword is required before rule body

This release adds automatic backward-compatible handling when uploading policies.

Auto-upgrade on upload

update_policy_from_string(..., rego_compat=True) is now the default behavior:

1. Upload the policy as-is (works with OPA 0.x and v0 Rego).
2. If OPA rejects it due to v0 syntax, upgrade common constructs and retry.

Supported upgrades:

v0 syntax	v1 syntax
allow { ... }	allow if { ... }
deny[msg] { ... }	deny contains msg if { ... }

Compatibility matrix

Server	v0 policy	v1 policy
OPA 0.x	Works on first upload	Works
OPA 1.0+	Auto-upgraded and retried	Works on first upload

To disable auto-upgrade:

client.update_policy_from_string(policy, "my_policy", rego_compat=False)

Improvements

• RegoParseError now includes OPA’s detailed errors list in the exception message.
• AsyncOpaClient.update_policy_from_string now sends the correct Content-Type: text/plain header.
• README and CONTRIBUTING updated with Rego v1 examples and OPA version guidance.

Dependencies

• aiohttp ^3.14.1
• requests ^2.34.2
• urllib3 ^2.7.0

Upgrade notes

• New policies: use Rego v1 syntax (allow if { ... }).

• Existing v0 policies: no code changes required; the client upgrades them on upload by default.

• Integration tests: require a running OPA server; compatible with OPA 0.x and 1.0+.

• Legacy OPA mode: run OPA with --v0-compatible if you need strict v0 behavior:

  docker run -it --rm -p 8181:8181 openpolicyagent/opa run --server --addr :8181 --v0-compatible