{"record":{"id":"d7a0ad7232dfaafb","repo":"apache/druid","slug":"opa-response-field-result-must-be-a-json-boolean","errorCode":null,"errorMessage":"OPA response field [result] must be a JSON boolean","messagePattern":"OPA response field \\[result\\] must be a JSON boolean","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions-contrib/druid-opa-authorizer/src/main/java/org/apache/druid/security/opa/opatypes/OpaResponse.java","lineNumber":34,"sourceCode":" * specific language governing permissions and limitations\n * under the License.\n */\n\npackage org.apache.druid.security.opa.opatypes;\n\nimport com.fasterxml.jackson.annotation.JsonCreator;\nimport com.fasterxml.jackson.annotation.JsonProperty;\nimport com.fasterxml.jackson.databind.JsonNode;\n\npublic class OpaResponse\n{\n  private final boolean result;\n\n  @JsonCreator\n  public OpaResponse(@JsonProperty(\"result\") JsonNode result)\n  {\n    if (result == null || !result.isBoolean()) {\n      throw new IllegalArgumentException(\"OPA response field [result] must be a JSON boolean\");\n    }\n    this.result = result.booleanValue();\n  }\n\n  @JsonProperty\n  public boolean isResult()\n  {\n    return result;\n  }\n}\n","sourceCodeStart":16,"sourceCodeEnd":45,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-contrib/druid-opa-authorizer/src/main/java/org/apache/druid/security/opa/opatypes/OpaResponse.java#L16-L45","documentation":"Thrown by the OpaResponse JSON creator when the 'result' field of an OPA authorization response is missing or is not a JSON boolean. OPA's /v1/data endpoint should return {\"result\": true/false} for a boolean policy; a non-boolean result means the policy returned an object, string, or no result, so the Druid authorizer cannot interpret the decision and treats the response as malformed.","triggerScenarios":"Thrown at extensions-contrib/druid-opa-authorizer/src/main/java/org/apache/druid/security/opa/opatypes/OpaResponse.java:34 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check the OPA policy: its default rule must evaluate to a boolean (e.g. `default allow = false`, `allow { ... }`).","Test the policy directly with `opa eval` or a curl to the OPA /v1/data endpoint to confirm 'result' is a boolean.","If the policy intentionally returns non-boolean results, change it or use a wrapper that projects a boolean into 'result'.","Verify the OPA URL/request body configured in the Druid opa authorizer points at the intended policy package and path."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}