OPA Data

opa-data is RAGA's policy data synchronization service, built on Bun + Express 5. It pulls user-role and role-grant data from User Service, merges it into a shared JSON file, then pushes that data to the OPA Engine. User Service calls opa-data every time a role or policy changes.

opa-data is one of three components in RAGA's OPA subsystem:

Component	Role
OPA Config	Runs the OPA server & holds the Rego policy (decision engine)
OPA Data	Syncs role & grant data from User Service into OPA
OPA Auth	The gate in front of Traefik — calls OPA on every request

Tech Stack

Layer	Technology
Runtime	Bun 1
Framework	Express 5 (TypeScript)
HTTP Client	Axios
File I/O	Bun native (file, write)
Secret Management	Infisical SDK v5

Full environment variable, endpoint, and flow diagram details are on the Technical page.

Flow at a Glance

1. User Service calls GET /role-users or GET /role-grants on opa-data whenever a role/policy changes.
2. opa-data fetches the latest data from User Service's open-api/role-users or open-api/role-grants.
3. The data is merged into a shared JSON file (/share/data.json), which the OPA Engine also reads.
4. opa-data pushes (PUT) the entire merged file to the OPA data API so authorization decisions always use the latest data.

Summary

opa-data is the one-way bridge between the RBAC structure managed in User Service and OPA's decision engine — without this service, role/policy changes in User Service would never reach OPA, and opa-auth would keep using stale data.