The type-checker schema cache uses the annotation schema ref as key when looking up compiled schemas. This ref is missing when schemas are inlined, resulting in the empty string being used as key in the schema cache; which causes a race condition where inlined schemas declared for one rule/package will override that of another.
E.g. In the following module, only one of the two inlined schemas will be applied for both rules (the rules' sort order determines which).
package test
# METADATA
# schemas:
# - input.x: {"type": "number"}
p if {
input.x == 42
}
# METADATA
# schemas:
# - input.x: {"type": "string"}
q if {
input.x == "foo"
}
$ opa check policy.rego
1 error occurred: policy.rego:16: rego_type_error: match error
left : number
right : string
The type-checker schema cache uses the annotation schema ref as key when looking up compiled schemas. This ref is missing when schemas are inlined, resulting in the empty string being used as key in the schema cache; which causes a race condition where inlined schemas declared for one rule/package will override that of another.
E.g. In the following module, only one of the two inlined schemas will be applied for both rules (the rules' sort order determines which).