OPA panic on bundle deactivate when running a rego v0 bundle tarball from a policy image

[carabasdaniel]

Short description

OPA seems to throw a panic when running bundle.Deactivate on a rego v0 bundle tarball.

Examples:

• OPA v1.0.0
• Bundle contains a single hello.rego file in the policies folder

package policies.hello

# default to a "closed" system,
# only grant access when explicitly granted

default allowed = false
default visible = false
default enabled = false

allowed {
    input.role == "web-admin"
}

enabled {
    visible
}

visible {
    input.app == "web-console"
}

• Bundle manifest

{"revision":"","roots":["policies"],"rego_version":0,"metadata":{ <some builtins> }}

• In the usage scenario I'm using OPA as a library and the returned output looks like this:

panic: Unable deactivate bundle: 3 errors occurred:                                                                                                                                                    
│     hello.rego:12: rego_parse_error: `if` keyword is required before rule body                                                          
│     hello.rego:16: rego_parse_error: `if` keyword is required before rule body                                                          
│     hello.rego:20: rego_parse_error: `if` keyword is required before rule body

Steps To Reproduce ( when using OPA as a library )

1. Build a policy image or bundle tarball with the above mentioned rego file and manifest
2. Spin up the bundle
3. Slightly modify the bundle by adding another rule
4. Call the bundle.Reconfigure method and on the bundle.Deactivate method it should throw the above mentioned panic

Expected behavior

If using rego v0 it should behave as OPA v0.70.0 did and during the bundle.Deactivation process take into consideration the specified rego version not use rego v1 with a v0 bundle