Inlined schemas cannot be scoped per rule

Short description

With the following two documentation sections on metadata scope and inlined schemas in mind:

• https://www.openpolicyagent.org/docs/latest/policy-language/#scope
• https://www.openpolicyagent.org/docs/latest/policy-language/#inlined-schema-format

I create two rules, each with a rule-scoped input schema on the same property, but each rule expecting a different data type. My expectation is for this to be a perfectly common use-case, however opa eval seems to render one of them invalid arbitrarily and without warning, which is quite surprising if intentional.

$ opa version
Version: 1.4.2
Build Commit:
Build Timestamp:
Build Hostname:
Go Version: go1.24.2
Platform: linux/amd64
Rego Version: v1
WebAssembly: unavailable

package example

# METADATA
# scope: rule
# schemas:
# - input.a: {type: number}
rule_1 if {
  input.a > 3
}

# METADATA
# scope: rule
# schemas:
# - input.a: {type: string}
rule_2 if {
  input.a == "test"
}

Steps To Reproduce

1. Put the above package into example.rego.
2. Try to eval any one of the rules, or the base package, for example:

for i in {1..7}; do opa eval -b . -f pretty data.example.rule_1; done

Expected behavior

I expect both rules to always return an undefined decision. What actually happens is some executions indeterministically return undefined, while others return a type error.

for i in {1..7}; do opa eval -b . -f pretty data.example.rule_1; done
1 error occurred: example.rego:16: rego_type_error: match error
        left  : number
        right : string
1 error occurred: example.rego:16: rego_type_error: match error
        left  : number
        right : string
1 error occurred: example.rego:16: rego_type_error: match error
        left  : number
        right : string
1 error occurred: example.rego:16: rego_type_error: match error
        left  : number
        right : string
undefined
undefined
1 error occurred: example.rego:16: rego_type_error: match error
        left  : number
        right : string

for i in {1..7}; do opa eval -b . -f pretty data.example.rule_2; done
undefined
undefined
1 error occurred: example.rego:16: rego_type_error: match error
        left  : number
        right : string
1 error occurred: example.rego:16: rego_type_error: match error
        left  : number
        right : string
undefined
undefined
undefined

Additional context

Changing the schema of rule_1 to # - input.a: {type: [number, string]} renders both rules undefined as expected, but changing rule_2 does not. So there seems to be a "first one wins" implication. 🤔 Either way, the intent is to represent unique input property types per rule, so this is not an acceptable workaround.

[anderseknert]

Yeah, that does seem like an issue. Thanks for raising it!

[johanfylling]

Fixed in #7680