# Run the OPA throught Docker
docker run -d --name opa -p 8181:8181 openpolicyagent/opa:0.35.0 run -s

# Create policy 'example'
curl -XPUT 'localhost:8181/v1/policies/example' \
--header 'Content-Type: text/plain' \
--data-raw 'package example

default allow = false

allow {
  input.request.http.headers["test-header"] == "only-for-test"
}'

# Test: success
curl -XPOST 'localhost:8181/v1/data/example/allow' \
--header 'Content-Type: application/json' \
--data-raw '{
  "input": {
    "request": {
      "http": {
        "headers": {
          "test-header": "only-for-test"
        }
      }
    }
  }
}'

{
    "result": true
}

# Test: failed
curl -XPOST 'localhost:8181/v1/data/example/allow' \
--header 'Content-Type: application/json' \
--data-raw '{
  "input": {
    "request": {
      "http": {
        "headers": {
          "test-header": "not-for-test"
        }
      }
    }
  }
}'

{
    "result": false
}

## Requests like this `https://apisix.apache.org/contribute?abc=123`
{
  "input": {
    "request": {
      "http": { # for HTTP subsystem（maybe can used by Stream subsystem also）
        "host": "apisix.apache.org",
        "port": "443",
        "tls": {},
        "method": "GET",
        "scheme": "https",
        "path": "/contribute",
        "query": {
          "abc" : "123"
        },
        "headers": {
          "accept-encoding": "gzip, deflate"
        }
      }
    },
    "remote_addr": "127.0.0.1",
    "upstream": {},
    "route": {},
    "consumer": {}
  }
}

## Simply decision response from OPA 
{
    "result": true | false
}

## Complex decision response from OPA (supports overwriting responses and terminating request processing)
{
    "result": {
        "allow": true | false,
        "headers":{
            "opa": "forbidden"
        },
        "statusCode": 403,
        "body": "You are not authorized to access."
    }
}