diff --git a/src/agentrust_telemetry/adapters/opa.py b/src/agentrust_telemetry/adapters/opa.py index 065e239..a4a3194 100644 --- a/src/agentrust_telemetry/adapters/opa.py +++ b/src/agentrust_telemetry/adapters/opa.py @@ -35,7 +35,13 @@ def opa_decision_log( raise ValueError("OPA decision log requires a non-empty decision_id") mapper = result_mapper or _boolean_decision decision = mapper(decision_log.get("result")) - if decision not in {"allow", "deny", "challenge", "not_applicable", "error"}: + if not isinstance(decision, str) or decision not in { + "allow", + "deny", + "challenge", + "not_applicable", + "error", + }: raise ValueError(f"OPA result mapper returned unsupported decision: {decision!r}") labels = decision_log.get("labels", {}) if not isinstance(labels, dict): diff --git a/tests/test_adapters.py b/tests/test_adapters.py index d67cd93..14b879d 100644 --- a/tests/test_adapters.py +++ b/tests/test_adapters.py @@ -175,11 +175,17 @@ def test_opa_requires_non_empty_string_decision_id(self): "OPA decision log requires a non-empty decision_id") def test_opa_rejects_unsupported_mapper_decision(self): - with self.assertRaises(ValueError) as caught: - self.opa_event({"decision_id": "d-1", "result": {}}, - result_mapper=lambda value: "permit") - self.assertEqual(str(caught.exception), - "OPA result mapper returned unsupported decision: 'permit'") + for decision in ("permit", {}, []): + with self.subTest(decision=decision): + with self.assertRaises(ValueError) as caught: + self.opa_event( + {"decision_id": "d-1", "result": {}}, + result_mapper=lambda value, decision=decision: decision, + ) + self.assertEqual( + str(caught.exception), + f"OPA result mapper returned unsupported decision: {decision!r}", + ) def test_opa_requires_object_labels(self): for labels in ([], None, "version=1.8.0"):