From d405d1a726ce0d0a4eb45eabd995b3a205f4a653 Mon Sep 17 00:00:00 2001
From: Schnitz <12687466+CptSchnitz@users.noreply.github.com>
Date: Sun, 2 Aug 2026 17:06:20 +0300
Subject: [PATCH] fix: changed parsing so it works with all versions of opa
 policy

---
 docker-image/nginx-config/auth.js | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/docker-image/nginx-config/auth.js b/docker-image/nginx-config/auth.js
index c6ec4aa..49fdb99 100644
--- a/docker-image/nginx-config/auth.js
+++ b/docker-image/nginx-config/auth.js
@@ -100,13 +100,19 @@ async function opaAuth(r) {
 
     const opaResult = JSON.parse(response.responseText).result;
     if (!opaResult.allowed) {
-      r.error(opaResult.reason);
-      const returnCode = opaResult.reason.includes("no token supplied")
-        ? 401
-        : 403;
+      let reason;
+      if (opaResult.reason) {
+        reason = opaResult.reason;
+      } else if (opaResult.reasons) {
+        reason = opaResult.reasons.join(", ");
+      } else {
+        reason = "Access denied - no reason provided";
+      }
+      r.error(reason);
+      const returnCode = reason.includes("no token supplied") ? 401 : 403;
 
       r.variables.opa_result = "false";
-      r.variables.opa_reason = opaResult.reason;
+      r.variables.opa_reason = reason;
       return r.return(returnCode);
     }
     r.variables.opa_result = "true";