fix(policy): avoid graphql persisted deny reason conflicts

Author: johntmyers

crates/openshell-sandbox/data/sandbox-policy.rego

@@ -324,6 +324,7 @@ request_deny_reason := reason if {
 	input.request
 	deny_request
 	graphql_request_has_operations(input.request)
+	not graphql_request_has_unregistered_persisted_query(input.request, matched_endpoint_config)
 	reason := "GraphQL operation blocked by endpoint policy"
 }
 

crates/openshell-sandbox/src/opa.rs

@@ -2079,6 +2079,30 @@ process:
         assert!(!eval_l7(&engine, &input));
     }
 
+    #[test]
+    fn l7_graphql_unregistered_hash_only_query_has_deny_reason() {
+        let engine = l7_engine();
+        let input = l7_graphql_input(
+            "api.graphql.com",
+            serde_json::json!([{
+                "operation_type": "",
+                "operation_name": "Viewer",
+                "fields": [],
+                "persisted_query": true,
+                "persisted_query_hash": "missing"
+            }]),
+        );
+        let mut eng = engine.engine.lock().unwrap();
+        eng.set_input_json(&input.to_string()).unwrap();
+        let val = eng
+            .eval_rule("data.openshell.sandbox.request_deny_reason".into())
+            .unwrap();
+        assert_eq!(
+            val,
+            regorus::Value::String("GraphQL persisted query is not registered".into())
+        );
+    }
+
     #[test]
     fn l7_graphql_parse_error_denied() {
         let engine = l7_engine();