OPA partial evaluation issue

authz.rego

package authz

import input.user.name
import input.resource.name
import input.operation

default allow = false

roles := {
    "admin": ["*"]
}

bindings := [
    {
        "role": "admin",
        "groups": ["admins"],
        "resources": ["*"]
    }
]

allow {
    some role

    binding := active_bindings[_]
    binding.role == role

    operation := roles[role][_]
    glob.match(operation, [], input.operation)
}

active_bindings[binding] {
    binding := bindings[_]

    binding.groups[_] == input.user.groups[_]

    glob.match(binding.resources[_], [], input.resource.name)
}

test_deny_unauthenticated_request {
    req := {
        "resource": {
            "name": "foo"
        },
        "operation": "foo.read"
    }
    not allow with input as req
}

test_deny_unbound_user {
    req := {
        "user": {
            "name": "eve"
        },
        "resource": {
            "name": "foo"
        },
        "operation": "foo.read"
    }
    not allow with input as req
}

test_allow_user_in_admin_group {
    req := {
        "user": {
            "name": "bob",
            "groups": ["admins"]
        },
        "resource": {
            "name": "foo"
        },
        "operation": "foo.read"
    }
    allow with input as req
}