RightOperand value as a list in policy definition is returned as a quoted string of objects instead of list

[akshayadsap]

Description

When creating a PolicyDefinition where the right operand (odrl:rightOperand)  is a list of strings, the connector accepts the payload, but on retrieval (GET policy), the rightOperand is serialized as a single JSON string that contains the connector’s internal value representation, e.g. "[{@value={chars=BPNPROVIDER, string=BPNPROVIDER, valueType=STRING}}, …]" instead of a JSON array of string literals.
 

To Reproduce

1. Create a policy definition (management API)
   Endpoint: POST /management/v3/policydefinitions (policydefinitions endpoint)
   Body:

[1]

{
    "@context": [
        {
            "@vocab": "https://w3id.org/edc/v0.0.1/ns/"
        },
        {
            "edc": "https://w3id.org/edc/v0.0.1/ns/"
        },
        {
            "odrl": "http://www.w3.org/ns/odrl/2/"
        },
        {
            "tx": "https://w3id.org/tractusx/v0.0.1/ns/"
        },
        {
            "cx-policy": "https://w3id.org/catenax/policy/"
        }
    ],
    "@type": "edc:PolicyDefinition",
       "@id": "policy-dc90b627-667f-4bd3-bdb3-ec15737a23d5",
    "edc:policy": {
        "@type": "odrl:Set",
        "odrl:permission": [
            {
                "@type": "odrl:Permission",
                "odrl:action": {
                    "@type": "odrl:Action",
                    "@id": "odrl:use"
                },
                "odrl:constraint": [{
                    "@type": "odrl:Constraint",
                    "odrl:leftOperand": {
                        "@type": "odrl:LeftOperand",
                        "@id": "tx:BusinessPartnerNumber"
                    },
                    "odrl:operator": {
                        "@type": "odrl:Operator",
                        "@id": "odrl:isAnyOf"
                    },
                    "odrl:rightOperand": ["BPNPROVIDER", "BPNFOSS0000"]
                },
                {
                    "@type": "odrl:Constraint",
                    "odrl:leftOperand": {
                        "@type": "odrl:LeftOperand",
                        "@id": "cx-policy:UsagePurpose"
                    },
                    "odrl:operator": {
                        "@type": "odrl:Operator",
                        "@id": "odrl:isAnyOf"
                    },
                    "odrl:rightOperand": ["cx.core.digitalTwinRegistry:1", "cx.core.industrycore:1"]
                }
                ]
            }
        ],
        "odrl:prohibition": [],
        "odrl:obligation": []
    },
    "edc:privateProperties": {
        "policyType": "access",
        "description": "Policy with BPGroup having 1 entry with eq operator",
        "name": "Single Postman BPN Policy"
    }
}

2. Retrieve the policy
   Endpoint: GET /management/v3/policydefinitions/{{policyId}}
   Response:

[2]

{
    "@id": "policy-f43580eb-f382-40d2-be9b-9e0dfa387fe9",
    "@type": "PolicyDefinition",
    "createdAt": 1756984113459,
    "policy": {
        "@id": "2f878449-0b25-4e09-8e65-02e9952131e8",
        "@type": "odrl:Set",
        "odrl:permission": {
            "odrl:action": {
                "@id": "odrl:use"
            },
            "odrl:constraint": [
                {
                    "odrl:leftOperand": {
                        "@id": "tx:BusinessPartnerNumber"
                    },
                    "odrl:operator": {
                        "@id": "odrl:isAnyOf"
                    },
                    "odrl:rightOperand": "[{@value={chars=BPNPROVIDER, string=BPNPROVIDER, valueType=STRING}}, {@value={chars=BPNFOSS0000, string=BPNFOSS0000, valueType=STRING}}]"
                },
                {
                    "odrl:leftOperand": {
                        "@id": "cx-policy:UsagePurpose"
                    },
                    "odrl:operator": {
                        "@id": "odrl:isAnyOf"
                    },
                    "odrl:rightOperand": "[{@value={chars=cx.core.digitalTwinRegistry:1, string=cx.core.digitalTwinRegistry:1, valueType=STRING}}, {@value={chars=cx.core.industrycore:1, string=cx.core.industrycore:1, valueType=STRING}}]"
                }
            ]
        },
        "odrl:prohibition": [],
        "odrl:obligation": []
    },
    "privateProperties": {
        "description": "Policy with BPGroup having 1 entry with eq operator",
        "policyType": "access",
        "name": "Single Postman BPN Policy"
    },
    "@context": {
        "@vocab": "https://w3id.org/edc/v0.0.1/ns/",
        "edc": "https://w3id.org/edc/v0.0.1/ns/",
        "tx": "https://w3id.org/tractusx/v0.0.1/ns/",
        "tx-auth": "https://w3id.org/tractusx/auth/",
        "cx-policy": "https://w3id.org/catenax/policy/",
        "odrl": "http://www.w3.org/ns/odrl/2/"
    }
}

The list is returned in this format
For BPN:

"[{@value={chars=BPNPROVIDER, string=BPNPROVIDER, valueType=STRING}}, {@value={chars=BPNFOSS0000, string=BPNFOSS0000, valueType=STRING}}]" 

 
For usage purpose:

"[{@value={chars=cx.core.digitalTwinRegistry:1, string=cx.core.digitalTwinRegistry:1, valueType=STRING}}, {@value={chars=cx.core.industrycore:1, string=cx.core.industrycore:1, valueType=STRING}}]"

 
We see that there was an old bug which was created and was closed.
#1674
 
But with the DSP 2025-1, the value must be provided as an array. The current approach would violate the json schema because it mandates that BusinessPartnerNumbers and BusinessPartnerGroups be passed as arrays:
 
https://github.com/catenax-eV/cx-odrl-profile/blob/main/schema/constraint/business-partner-group-constraint-schema.json
 
https://github.com/catenax-eV/cx-odrl-profile/blob/main/schema/constraint/business-partner-number-constraint-schema.json
 
Could you please provide your feedback on this?

[arnoweiss]

relates #2246

[lgblaumeiser]

It has been decided, that this is currently not priority. It is an issue due to the inability of the EDC to handle right operands of another type than string rightfully. The response here is the consequence.

[ronjaquensel]

Updating the (de)serialization and handling of arrays in the right operand is a more complex topic and therefore will take some time. In the meantime, negotiation of these policies still works and the evaluation functions can handle this format as well, where required. Thus, for now policies with an array as right operand work, correctly handling and displaying them will be tackled after the next release.