mirror of
https://github.com/microsoft/regorus.git
synced 2026-08-05 02:16:11 +00:00
Improve crate documentation (#111)
- Document QueryResults - Delete snippets folder - Document Value Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
This commit is contained in:
committed by
GitHub
parent
f3884e87e5
commit
6eca85b497
@@ -28,11 +28,14 @@ fn print(span: &Span, _params: &[Ref<Expr>], args: &[Value], _strict: bool) -> R
|
||||
let mut msg = String::default();
|
||||
for a in args {
|
||||
match a {
|
||||
Value::Undefined => msg += "<undefined>",
|
||||
_ => msg += format!("{a}").as_str(),
|
||||
Value::Undefined => msg += " <undefined>",
|
||||
Value::String(s) => msg += &format!(" {s}"),
|
||||
_ => msg += &format!(" {a}"),
|
||||
};
|
||||
}
|
||||
|
||||
span.message("print", msg.as_str());
|
||||
if !msg.is_empty() {
|
||||
println!("{}", &msg[1..]);
|
||||
}
|
||||
Ok(Value::Bool(true))
|
||||
}
|
||||
|
||||
@@ -3,14 +3,16 @@
|
||||
|
||||
use crate::ast::{Expr, Ref};
|
||||
use crate::builtins;
|
||||
#[allow(unused)]
|
||||
use crate::builtins::utils::{
|
||||
ensure_args_count, ensure_object, ensure_string, ensure_string_collection,
|
||||
};
|
||||
use crate::lexer::Span;
|
||||
use crate::value::Value;
|
||||
|
||||
use std::collections::{BTreeMap, HashMap};
|
||||
use std::collections::HashMap;
|
||||
|
||||
#[allow(unused)]
|
||||
use anyhow::{anyhow, bail, Context, Result};
|
||||
|
||||
pub fn register(m: &mut HashMap<&'static str, builtins::BuiltinFcn>) {
|
||||
@@ -41,11 +43,6 @@ pub fn register(m: &mut HashMap<&'static str, builtins::BuiltinFcn>) {
|
||||
m.insert("json.is_valid", (json_is_valid, 1));
|
||||
m.insert("json.marshal", (json_marshal, 1));
|
||||
m.insert("json.unmarshal", (json_unmarshal, 1));
|
||||
#[cfg(feature = "jsonschema")]
|
||||
{
|
||||
m.insert("json.match_schema", (json_match_schema, 2));
|
||||
m.insert("json.verify_schema", (json_verify_schema, 1));
|
||||
}
|
||||
|
||||
#[cfg(feature = "yaml")]
|
||||
{
|
||||
@@ -240,7 +237,7 @@ fn urlquery_decode_object(
|
||||
Err(_) => bail!(params[0].span().error("not a valid url query")),
|
||||
};
|
||||
|
||||
let mut map = BTreeMap::new();
|
||||
let mut map = std::collections::BTreeMap::new();
|
||||
for (k, v) in url.query_pairs() {
|
||||
let key = Value::String(k.clone().into());
|
||||
let value = Value::String(v.clone().into());
|
||||
@@ -382,72 +379,3 @@ fn json_unmarshal(
|
||||
let json_str = ensure_string(name, ¶ms[0], &args[0])?;
|
||||
Value::from_json_str(&json_str).with_context(|| span.error("could not deserialize json."))
|
||||
}
|
||||
|
||||
#[cfg(feature = "jsonschema")]
|
||||
fn compile_json_schema(param: &Ref<Expr>, arg: &Value) -> Result<jsonschema::JSONSchema> {
|
||||
let schema_str = match arg {
|
||||
Value::String(schema_str) => schema_str.as_ref().to_string(),
|
||||
_ => arg.to_json_str()?,
|
||||
};
|
||||
|
||||
if let Ok(schema) = serde_json::from_str(&schema_str) {
|
||||
match jsonschema::JSONSchema::compile(&schema) {
|
||||
Ok(schema) => return Ok(schema),
|
||||
Err(e) => bail!(e.to_string()),
|
||||
}
|
||||
}
|
||||
bail!(param.span().error("not a valid json schema"))
|
||||
}
|
||||
|
||||
#[cfg(feature = "jsonschema")]
|
||||
fn json_verify_schema(
|
||||
span: &Span,
|
||||
params: &[Ref<Expr>],
|
||||
args: &[Value],
|
||||
strict: bool,
|
||||
) -> Result<Value> {
|
||||
let name = "json.verify_schema";
|
||||
ensure_args_count(span, name, params, args, 1)?;
|
||||
|
||||
Ok(Value::from_array(
|
||||
match compile_json_schema(¶ms[0], &args[0]) {
|
||||
Ok(_) => [Value::Bool(true), Value::Null],
|
||||
Err(e) if strict => bail!(params[0]
|
||||
.span()
|
||||
.error(format!("invalid schema: {e}").as_str())),
|
||||
Err(e) => [Value::Bool(false), Value::String(e.to_string().into())],
|
||||
}
|
||||
.to_vec(),
|
||||
))
|
||||
}
|
||||
|
||||
#[cfg(feature = "jsonschema")]
|
||||
fn json_match_schema(
|
||||
span: &Span,
|
||||
params: &[Ref<Expr>],
|
||||
args: &[Value],
|
||||
strict: bool,
|
||||
) -> Result<Value> {
|
||||
let name = "json.match_schema";
|
||||
ensure_args_count(span, name, params, args, 2)?;
|
||||
|
||||
// The following is expected to succeed.
|
||||
let document: serde_json::Value = serde_json::from_str(&args[0].to_json_str()?)?;
|
||||
|
||||
Ok(Value::from_array(
|
||||
match compile_json_schema(¶ms[1], &args[1]) {
|
||||
Ok(schema) => match schema.validate(&document) {
|
||||
Ok(_) => [Value::Bool(true), Value::Null],
|
||||
Err(e) => [
|
||||
Value::Bool(false),
|
||||
Value::from_array(e.map(|e| Value::String(e.to_string().into())).collect()),
|
||||
],
|
||||
},
|
||||
Err(e) if strict => bail!(params[1]
|
||||
.span()
|
||||
.error(format!("invalid schema: {e}").as_str())),
|
||||
Err(e) => [Value::Bool(false), Value::String(e.to_string().into())],
|
||||
}
|
||||
.to_vec(),
|
||||
))
|
||||
}
|
||||
|
||||
@@ -23,6 +23,12 @@ pub fn register(m: &mut HashMap<&'static str, builtins::BuiltinFcn>) {
|
||||
m.insert("object.subset", (subset, 2));
|
||||
m.insert("object.union", (object_union, 2));
|
||||
m.insert("object.union_n", (object_union_n, 1));
|
||||
|
||||
#[cfg(feature = "jsonschema")]
|
||||
{
|
||||
m.insert("json.match_schema", (json_match_schema, 2));
|
||||
m.insert("json.verify_schema", (json_verify_schema, 1));
|
||||
}
|
||||
}
|
||||
|
||||
fn json_filter_impl(v: &Value, filter: &Value) -> Value {
|
||||
@@ -382,3 +388,72 @@ fn object_union_n(
|
||||
|
||||
Ok(u)
|
||||
}
|
||||
|
||||
#[cfg(feature = "jsonschema")]
|
||||
fn compile_json_schema(param: &Ref<Expr>, arg: &Value) -> Result<jsonschema::JSONSchema> {
|
||||
let schema_str = match arg {
|
||||
Value::String(schema_str) => schema_str.as_ref().to_string(),
|
||||
_ => arg.to_json_str()?,
|
||||
};
|
||||
|
||||
if let Ok(schema) = serde_json::from_str(&schema_str) {
|
||||
match jsonschema::JSONSchema::compile(&schema) {
|
||||
Ok(schema) => return Ok(schema),
|
||||
Err(e) => bail!(e.to_string()),
|
||||
}
|
||||
}
|
||||
bail!(param.span().error("not a valid json schema"))
|
||||
}
|
||||
|
||||
#[cfg(feature = "jsonschema")]
|
||||
fn json_verify_schema(
|
||||
span: &Span,
|
||||
params: &[Ref<Expr>],
|
||||
args: &[Value],
|
||||
strict: bool,
|
||||
) -> Result<Value> {
|
||||
let name = "json.verify_schema";
|
||||
ensure_args_count(span, name, params, args, 1)?;
|
||||
|
||||
Ok(Value::from_array(
|
||||
match compile_json_schema(¶ms[0], &args[0]) {
|
||||
Ok(_) => [Value::Bool(true), Value::Null],
|
||||
Err(e) if strict => bail!(params[0]
|
||||
.span()
|
||||
.error(format!("invalid schema: {e}").as_str())),
|
||||
Err(e) => [Value::Bool(false), Value::String(e.to_string().into())],
|
||||
}
|
||||
.to_vec(),
|
||||
))
|
||||
}
|
||||
|
||||
#[cfg(feature = "jsonschema")]
|
||||
fn json_match_schema(
|
||||
span: &Span,
|
||||
params: &[Ref<Expr>],
|
||||
args: &[Value],
|
||||
strict: bool,
|
||||
) -> Result<Value> {
|
||||
let name = "json.match_schema";
|
||||
ensure_args_count(span, name, params, args, 2)?;
|
||||
|
||||
// The following is expected to succeed.
|
||||
let document: serde_json::Value = serde_json::from_str(&args[0].to_json_str()?)?;
|
||||
|
||||
Ok(Value::from_array(
|
||||
match compile_json_schema(¶ms[1], &args[1]) {
|
||||
Ok(schema) => match schema.validate(&document) {
|
||||
Ok(_) => [Value::Bool(true), Value::Null],
|
||||
Err(e) => [
|
||||
Value::Bool(false),
|
||||
Value::from_array(e.map(|e| Value::String(e.to_string().into())).collect()),
|
||||
],
|
||||
},
|
||||
Err(e) if strict => bail!(params[1]
|
||||
.span()
|
||||
.error(format!("invalid schema: {e}").as_str())),
|
||||
Err(e) => [Value::Bool(false), Value::String(e.to_string().into())],
|
||||
}
|
||||
.to_vec(),
|
||||
))
|
||||
}
|
||||
|
||||
+182
-30
@@ -16,6 +16,7 @@ use std::path::Path;
|
||||
use anyhow::Result;
|
||||
|
||||
/// The Rego evaluation engine.
|
||||
///
|
||||
#[derive(Clone)]
|
||||
pub struct Engine {
|
||||
modules: Vec<Ref<Module>>,
|
||||
@@ -31,6 +32,7 @@ impl Default for Engine {
|
||||
}
|
||||
|
||||
impl Engine {
|
||||
/// Create an instance of [Engine].
|
||||
pub fn new() -> Self {
|
||||
Self {
|
||||
modules: vec![],
|
||||
@@ -39,6 +41,29 @@ impl Engine {
|
||||
}
|
||||
}
|
||||
|
||||
/// Add a policy.
|
||||
///
|
||||
/// The policy file will be parsed and converted to AST representation.
|
||||
/// Multiple policy files may be added to the engine.
|
||||
///
|
||||
/// * `path`: A filename to be associated with the policy.
|
||||
/// * `rego`: The rego policy code.
|
||||
///
|
||||
/// ```
|
||||
/// # use regorus::*;
|
||||
/// # fn main() -> anyhow::Result<()> {
|
||||
/// let mut engine = Engine::new();
|
||||
///
|
||||
/// engine.add_policy(
|
||||
/// "test.rego".to_string(),
|
||||
/// r#"
|
||||
/// package test
|
||||
/// allow = input.user == "root"
|
||||
/// "#.to_string())?;
|
||||
/// # Ok(())
|
||||
/// # }
|
||||
/// ```
|
||||
///
|
||||
pub fn add_policy(&mut self, path: String, rego: String) -> Result<()> {
|
||||
let source = Source::new(path, rego);
|
||||
let mut parser = Parser::new(&source)?;
|
||||
@@ -48,6 +73,22 @@ impl Engine {
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Add a policy from a given file.
|
||||
///
|
||||
/// The policy file will be parsed and converted to AST representation.
|
||||
/// Multiple policy files may be added to the engine.
|
||||
///
|
||||
/// * `path`: Path to the policy file (.rego).
|
||||
///
|
||||
/// ```
|
||||
/// # use regorus::*;
|
||||
/// # fn main() -> anyhow::Result<()> {
|
||||
/// let mut engine = Engine::new();
|
||||
///
|
||||
/// engine.add_policy_from_file("tests/aci/framework.rego")?;
|
||||
/// # Ok(())
|
||||
/// # }
|
||||
/// ```
|
||||
pub fn add_policy_from_file<P: AsRef<Path>>(&mut self, path: P) -> Result<()> {
|
||||
let source = Source::from_file(path)?;
|
||||
let mut parser = Parser::new(&source)?;
|
||||
@@ -56,28 +97,163 @@ impl Engine {
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Set the input document.
|
||||
///
|
||||
/// * `input`: Input documented. Typically this [Value] is constructed from JSON or YAML.
|
||||
///
|
||||
/// ```
|
||||
/// # use regorus::*;
|
||||
/// # fn main() -> anyhow::Result<()> {
|
||||
/// let mut engine = Engine::new();
|
||||
///
|
||||
/// let input = Value::from_json_str(r#"
|
||||
/// {
|
||||
/// "role" : "admin",
|
||||
/// "action": "delete"
|
||||
/// }"#)?;
|
||||
///
|
||||
/// engine.set_input(input);
|
||||
/// # Ok(())
|
||||
/// # }
|
||||
/// ```
|
||||
pub fn set_input(&mut self, input: Value) {
|
||||
self.interpreter.set_input(input);
|
||||
}
|
||||
|
||||
/// Clear the data document.
|
||||
///
|
||||
/// The data document will be reset to an empty object.
|
||||
///
|
||||
/// ```
|
||||
/// # use regorus::*;
|
||||
/// # fn main() -> anyhow::Result<()> {
|
||||
/// let mut engine = Engine::new();
|
||||
///
|
||||
/// engine.clear_data();
|
||||
///
|
||||
/// // Evaluate data.
|
||||
/// let results = engine.eval_query("data".to_string(), false)?;
|
||||
///
|
||||
/// // Assert that it is empty object.
|
||||
/// assert_eq!(results.result.len(), 1);
|
||||
/// assert_eq!(results.result[0].expressions.len(), 1);
|
||||
/// assert_eq!(results.result[0].expressions[0].value, Value::new_object());
|
||||
/// # Ok(())
|
||||
/// # }
|
||||
/// ```
|
||||
pub fn clear_data(&mut self) {
|
||||
self.interpreter.set_data(Value::new_object());
|
||||
self.prepared = false;
|
||||
}
|
||||
|
||||
/// Add data document.
|
||||
///
|
||||
/// The specified data document is merged into existing data document.
|
||||
///
|
||||
/// ```
|
||||
/// # use regorus::*;
|
||||
/// # fn main() -> anyhow::Result<()> {
|
||||
/// let mut engine = Engine::new();
|
||||
///
|
||||
/// // Only objects can be added.
|
||||
/// assert!(engine.add_data(Value::from_json_str("[]")?).is_err());
|
||||
///
|
||||
/// // Merge { "x" : 1, "y" : {} }
|
||||
/// assert!(engine.add_data(Value::from_json_str(r#"{ "x" : 1, "y" : {}}"#)?).is_ok());
|
||||
///
|
||||
/// // Merge { "z" : 2 }
|
||||
/// assert!(engine.add_data(Value::from_json_str(r#"{ "z" : 2 }"#)?).is_ok());
|
||||
///
|
||||
/// // Merge { "z" : 3 }. Conflict error.
|
||||
/// assert!(engine.add_data(Value::from_json_str(r#"{ "z" : 3 }"#)?).is_err());
|
||||
///
|
||||
/// assert_eq!(
|
||||
/// engine.eval_query("data".to_string(), false)?.result[0].expressions[0].value,
|
||||
/// Value::from_json_str(r#"{ "x": 1, "y": {}, "z": 2}"#)?
|
||||
/// );
|
||||
/// # Ok(())
|
||||
/// # }
|
||||
/// ```
|
||||
pub fn add_data(&mut self, data: Value) -> Result<()> {
|
||||
self.prepared = false;
|
||||
self.interpreter.get_data_mut().merge(data)
|
||||
}
|
||||
|
||||
pub fn get_modules(&mut self) -> &Vec<Ref<Module>> {
|
||||
&self.modules
|
||||
}
|
||||
|
||||
/// Set whether builtins should raise errors strictly or not.
|
||||
///
|
||||
/// Regorus differs from OPA in that by default builtins will
|
||||
/// raise errors instead of returning Undefined.
|
||||
///
|
||||
/// ----
|
||||
/// **_NOTE:_** Currently not all builtins honor this flag and will always strictly raise errors.
|
||||
/// ----
|
||||
pub fn set_strict_builtin_errors(&mut self, b: bool) {
|
||||
self.interpreter.set_strict_builtin_errors(b)
|
||||
}
|
||||
|
||||
#[doc(hidden)]
|
||||
pub fn get_modules(&mut self) -> &Vec<Ref<Module>> {
|
||||
&self.modules
|
||||
}
|
||||
|
||||
/// Evaluate a Rego query.
|
||||
///
|
||||
/// ```
|
||||
/// # use regorus::*;
|
||||
/// # fn main() -> anyhow::Result<()> {
|
||||
/// let mut engine = Engine::new();
|
||||
///
|
||||
/// // Add policies
|
||||
/// engine.add_policy_from_file("tests/aci/framework.rego")?;
|
||||
/// engine.add_policy_from_file("tests/aci/api.rego")?;
|
||||
/// engine.add_policy_from_file("tests/aci/policy.rego")?;
|
||||
///
|
||||
/// // Add data document (if any).
|
||||
/// // If multiple data documents can be added, they will be merged together.
|
||||
/// engine.add_data(Value::from_json_file("tests/aci/data.json")?)?;
|
||||
///
|
||||
/// // At this point the policies and data have been loaded.
|
||||
/// // Either the same engine can be used to make multiple queries or the engine
|
||||
/// // can be cloned to avoid having the reload the policies and data.
|
||||
/// let _clone = engine.clone();
|
||||
///
|
||||
/// // Evaluate a query.
|
||||
/// // Load input and make query.
|
||||
/// engine.set_input(Value::new_object());
|
||||
/// let results = engine.eval_query("data.framework.mount_overlay.allowed".to_string(), false)?;
|
||||
/// assert!(results.result.is_empty());
|
||||
///
|
||||
/// // Evaluate query with different inputs.
|
||||
/// engine.set_input(Value::from_json_file("tests/aci/input.json")?);
|
||||
/// let results = engine.eval_query("data.framework.mount_overlay.allowed".to_string(), false)?;
|
||||
/// assert_eq!(results.result[0].expressions[0].value, Value::from(true));
|
||||
/// # Ok(())
|
||||
/// # }
|
||||
pub fn eval_query(&mut self, query: String, enable_tracing: bool) -> Result<QueryResults> {
|
||||
self.eval_modules(enable_tracing)?;
|
||||
|
||||
let query_module = {
|
||||
let source = Source::new(
|
||||
"<query_module.rego>".to_owned(),
|
||||
"package __internal_query_module".to_owned(),
|
||||
);
|
||||
Ref::new(Parser::new(&source)?.parse()?)
|
||||
};
|
||||
|
||||
// Parse the query.
|
||||
let query_source = Source::new("<query.rego>".to_string(), query);
|
||||
let mut parser = Parser::new(&query_source)?;
|
||||
let query_node = parser.parse_user_query()?;
|
||||
let query_schedule = Analyzer::new().analyze_query_snippet(&self.modules, &query_node)?;
|
||||
self.interpreter.eval_user_query(
|
||||
&query_module,
|
||||
&query_node,
|
||||
&query_schedule,
|
||||
enable_tracing,
|
||||
)
|
||||
}
|
||||
|
||||
#[doc(hidden)]
|
||||
fn prepare_for_eval(&mut self, enable_tracing: bool) -> Result<()> {
|
||||
self.interpreter.set_traces(enable_tracing);
|
||||
|
||||
@@ -110,6 +286,7 @@ impl Engine {
|
||||
Ok(())
|
||||
}
|
||||
|
||||
#[doc(hidden)]
|
||||
pub fn eval_rule(
|
||||
&mut self,
|
||||
module: &Ref<Module>,
|
||||
@@ -124,6 +301,7 @@ impl Engine {
|
||||
Ok(self.interpreter.get_data_mut().clone())
|
||||
}
|
||||
|
||||
#[doc(hidden)]
|
||||
pub fn eval_modules(&mut self, enable_tracing: bool) -> Result<Value> {
|
||||
self.prepare_for_eval(enable_tracing)?;
|
||||
self.interpreter.clean_internal_evaluation_state();
|
||||
@@ -167,30 +345,4 @@ impl Engine {
|
||||
self.interpreter.create_rule_prefixes()?;
|
||||
Ok(self.interpreter.get_data_mut().clone())
|
||||
}
|
||||
|
||||
pub fn eval_query(&mut self, query: String, enable_tracing: bool) -> Result<QueryResults> {
|
||||
self.eval_modules(false)?;
|
||||
|
||||
let query_module = {
|
||||
let source = Source::new(
|
||||
"<query_module.rego>".to_owned(),
|
||||
"package __internal_query_module".to_owned(),
|
||||
);
|
||||
Ref::new(Parser::new(&source)?.parse()?)
|
||||
};
|
||||
|
||||
// Parse the query.
|
||||
let query_source = Source::new("<query.rego>".to_string(), query);
|
||||
let mut parser = Parser::new(&query_source)?;
|
||||
let query_node = parser.parse_user_query()?;
|
||||
let query_schedule = Analyzer::new().analyze_query_snippet(&self.modules, &query_node)?;
|
||||
|
||||
let results = self.interpreter.eval_user_query(
|
||||
&query_module,
|
||||
&query_node,
|
||||
&query_schedule,
|
||||
enable_tracing,
|
||||
)?;
|
||||
Ok(results)
|
||||
}
|
||||
}
|
||||
|
||||
+38
-17
@@ -235,6 +235,7 @@ impl Interpreter {
|
||||
self.loop_var_values.clear();
|
||||
self.scopes = vec![Scope::new()];
|
||||
self.contexts = vec![];
|
||||
self.rule_values.clear();
|
||||
}
|
||||
|
||||
fn current_module(&self) -> Result<Ref<Module>> {
|
||||
@@ -347,7 +348,7 @@ impl Interpreter {
|
||||
&& get_root_var(refr)?.text() == "data"
|
||||
{
|
||||
let index = index.to_string();
|
||||
v = obj[&index].clone();
|
||||
v = obj[index].clone();
|
||||
}
|
||||
return Ok(Self::get_value_chained(v, &path[..]));
|
||||
}
|
||||
@@ -1310,6 +1311,13 @@ impl Interpreter {
|
||||
r
|
||||
}
|
||||
|
||||
fn clear_scope(scope: &mut Scope) {
|
||||
// Set each value to undefined. This is equivalent to removing the key.
|
||||
for (_, v) in scope.iter_mut() {
|
||||
*v = Value::Undefined;
|
||||
}
|
||||
}
|
||||
|
||||
fn eval_stmts_in_loop(&mut self, stmts: &[&LiteralStmt], loops: &[LoopExpr]) -> Result<bool> {
|
||||
if loops.is_empty() {
|
||||
if !stmts.is_empty() {
|
||||
@@ -1373,9 +1381,8 @@ impl Interpreter {
|
||||
}
|
||||
}
|
||||
|
||||
// Save the current scope and restore it after evaluating the statements so
|
||||
// that the effects of the current loop iteration are cleared.
|
||||
let scope_saved = self.current_scope()?.clone();
|
||||
// Create a new scope.
|
||||
self.scopes.push(Scope::default());
|
||||
|
||||
let query_result = self.get_current_context()?.result.clone();
|
||||
match loop_expr_value {
|
||||
@@ -1401,12 +1408,13 @@ impl Interpreter {
|
||||
result = self.eval_stmts_in_loop(stmts, &loops[1..])? || result;
|
||||
}
|
||||
|
||||
self.loop_var_values.remove(&loop_expr.expr());
|
||||
*self.current_scope_mut()? = scope_saved.clone();
|
||||
Self::clear_scope(self.current_scope_mut()?);
|
||||
if let Some(ctx) = self.contexts.last_mut() {
|
||||
ctx.result = query_result.clone();
|
||||
}
|
||||
}
|
||||
|
||||
self.loop_var_values.remove(&loop_expr.expr());
|
||||
}
|
||||
Value::Set(items) => {
|
||||
for v in items.iter() {
|
||||
@@ -1424,12 +1432,12 @@ impl Interpreter {
|
||||
result = self.eval_stmts_in_loop(stmts, &loops[1..])? || result;
|
||||
}
|
||||
|
||||
self.loop_var_values.remove(&loop_expr.expr());
|
||||
*self.current_scope_mut()? = scope_saved.clone();
|
||||
Self::clear_scope(self.current_scope_mut()?);
|
||||
if let Some(ctx) = self.contexts.last_mut() {
|
||||
ctx.result = query_result.clone();
|
||||
}
|
||||
}
|
||||
self.loop_var_values.remove(&loop_expr.expr());
|
||||
}
|
||||
Value::Object(obj) => {
|
||||
for (k, v) in obj.iter() {
|
||||
@@ -1445,12 +1453,13 @@ impl Interpreter {
|
||||
if exec {
|
||||
result = self.eval_stmts_in_loop(stmts, &loops[1..])? || result;
|
||||
}
|
||||
self.loop_var_values.remove(&loop_expr.expr());
|
||||
*self.current_scope_mut()? = scope_saved.clone();
|
||||
|
||||
Self::clear_scope(self.current_scope_mut()?);
|
||||
if let Some(ctx) = self.contexts.last_mut() {
|
||||
ctx.result = query_result.clone();
|
||||
}
|
||||
}
|
||||
self.loop_var_values.remove(&loop_expr.expr());
|
||||
}
|
||||
Value::Undefined => {
|
||||
result = false;
|
||||
@@ -1461,6 +1470,8 @@ impl Interpreter {
|
||||
}
|
||||
}
|
||||
|
||||
self.scopes.pop();
|
||||
|
||||
// Return true if at least on iteration returned true
|
||||
Ok(result)
|
||||
}
|
||||
@@ -1692,7 +1703,7 @@ impl Interpreter {
|
||||
if result
|
||||
.expressions
|
||||
.iter()
|
||||
.all(|v| v.value != Value::Undefined)
|
||||
.all(|v| v.value != Value::Undefined && v.value != Value::Bool(false))
|
||||
&& !result.expressions.is_empty()
|
||||
{
|
||||
ctx.results.result.push(result);
|
||||
@@ -1811,7 +1822,7 @@ impl Interpreter {
|
||||
if result
|
||||
.expressions
|
||||
.iter()
|
||||
.all(|v| v.value != Value::Undefined)
|
||||
.all(|v| v.value != Value::Undefined && v.value != Value::Bool(false))
|
||||
&& !result.expressions.is_empty()
|
||||
{
|
||||
ctx.results.result.push(result);
|
||||
@@ -2027,10 +2038,12 @@ impl Interpreter {
|
||||
|
||||
// Handle trace function.
|
||||
// TODO: with modifier.
|
||||
if let (Some(traces), Value::String(msg)) = (&mut self.traces, &v) {
|
||||
traces.push(msg.clone());
|
||||
return Ok(Value::Bool(true));
|
||||
};
|
||||
if name == "trace" {
|
||||
if let (Some(traces), Value::String(msg)) = (&mut self.traces, &v) {
|
||||
traces.push(msg.clone());
|
||||
return Ok(Value::Bool(true));
|
||||
}
|
||||
}
|
||||
|
||||
if let Some(name) = cache {
|
||||
self.builtins_cache.insert((name, args), v.clone());
|
||||
@@ -2374,6 +2387,14 @@ impl Interpreter {
|
||||
self.eval_rule(&module, rule)?;
|
||||
}
|
||||
}
|
||||
|
||||
let prev_module = self.set_current_module(Some(module.clone()))?;
|
||||
for rule in &module.policy {
|
||||
if !self.processed.contains(rule) {
|
||||
self.eval_default_rule(rule)?;
|
||||
}
|
||||
}
|
||||
self.set_current_module(prev_module)?;
|
||||
}
|
||||
}
|
||||
Ok(())
|
||||
@@ -3186,7 +3207,7 @@ impl Interpreter {
|
||||
self.set_current_module(prev_module)?;
|
||||
|
||||
if let Some(r) = results.result.last() {
|
||||
if r.bindings.is_empty_object()
|
||||
if matches!(&r.bindings, Value::Object(obj) if obj.is_empty())
|
||||
&& r.expressions.iter().any(|e| e.value == Value::Bool(false))
|
||||
{
|
||||
results = QueryResults::default();
|
||||
|
||||
+84
-1
@@ -139,7 +139,7 @@ pub struct Expression {
|
||||
/// # }
|
||||
/// ```
|
||||
///
|
||||
/// If any expression evaluates to false, then no results are produces.
|
||||
/// If any expression evaluates to false, then no results are produced.
|
||||
/// ```
|
||||
/// # use regorus::*;
|
||||
/// # fn main() -> anyhow::Result<()> {
|
||||
@@ -172,13 +172,96 @@ impl Default for QueryResult {
|
||||
}
|
||||
}
|
||||
|
||||
/// Results of evaluating a Rego query.
|
||||
///
|
||||
/// Generates the same `json` representation as `opa eval`.
|
||||
///
|
||||
/// Queries typically produce a single result.
|
||||
/// ```
|
||||
/// # use regorus::*;
|
||||
/// # fn main() -> anyhow::Result<()> {
|
||||
/// // Create engine and evaluate "true; true; false".
|
||||
/// let results = Engine::new().eval_query("1 + 1".to_string(), false)?;
|
||||
///
|
||||
/// assert!(results.result.len() == 1);
|
||||
/// assert_eq!(results.result[0].expressions[0].value, Value::from(2u64));
|
||||
/// assert_eq!(results.result[0].expressions[0].text.as_ref(), "1 + 1");
|
||||
/// # Ok(())
|
||||
/// # }
|
||||
/// ```
|
||||
///
|
||||
/// If any expression evaluates to false, then no results are produced.
|
||||
/// ```
|
||||
/// # use regorus::*;
|
||||
/// # fn main() -> anyhow::Result<()> {
|
||||
/// // Create engine and evaluate "true; true; false".
|
||||
/// let results = Engine::new().eval_query("true; true; false".to_string(), false)?;
|
||||
///
|
||||
/// assert!(results.result.is_empty());
|
||||
/// # Ok(())
|
||||
/// # }
|
||||
/// ```
|
||||
///
|
||||
/// Queries containing loops produce multiple results.
|
||||
/// ```
|
||||
/// # use regorus::*;
|
||||
/// # fn main() -> anyhow::Result<()> {
|
||||
/// let results = Engine::new().eval_query("x = [1, 2, 3][_]".to_string(), false)?;
|
||||
///
|
||||
/// // Three results are produced, one of each value of x.
|
||||
/// assert_eq!(results.result.len(), 3);
|
||||
///
|
||||
/// // Assert expressions and bindings of results.
|
||||
/// assert_eq!(results.result[0].expressions[0].value, Value::Bool(true));
|
||||
/// assert_eq!(results.result[0].expressions[0].text.as_ref(), "x = [1, 2, 3][_]");
|
||||
/// assert_eq!(results.result[0].bindings[&Value::from("x")], Value::from(1u64));
|
||||
///
|
||||
/// assert_eq!(results.result[1].expressions[0].value, Value::Bool(true));
|
||||
/// assert_eq!(results.result[1].expressions[0].text.as_ref(), "x = [1, 2, 3][_]");
|
||||
/// assert_eq!(results.result[1].bindings[&Value::from("x")], Value::from(2u64));
|
||||
///
|
||||
/// assert_eq!(results.result[2].expressions[0].value, Value::Bool(true));
|
||||
/// assert_eq!(results.result[2].expressions[0].text.as_ref(), "x = [1, 2, 3][_]");
|
||||
/// assert_eq!(results.result[2].bindings[&Value::from("x")], Value::from(3u64));
|
||||
/// # Ok(())
|
||||
/// # }
|
||||
/// ```
|
||||
///
|
||||
/// Loop iterations that evaluate to false or undefined don't produce results.
|
||||
/// ```
|
||||
/// # use regorus::*;
|
||||
/// # fn main() -> anyhow::Result<()> {
|
||||
/// let results = Engine::new().eval_query("x = [1, 2, 3][_]; x >= 2".to_string(), false)?;
|
||||
///
|
||||
/// // Two results are produced, one for x = 2 and another for x = 3.
|
||||
/// assert_eq!(results.result.len(), 2);
|
||||
///
|
||||
/// // Assert expressions and bindings of results.
|
||||
/// assert_eq!(results.result[0].expressions[0].value, Value::Bool(true));
|
||||
/// assert_eq!(results.result[0].expressions[0].text.as_ref(), "x = [1, 2, 3][_]");
|
||||
/// assert_eq!(results.result[0].expressions[0].value, Value::Bool(true));
|
||||
/// assert_eq!(results.result[0].expressions[1].text.as_ref(), "x >= 2");
|
||||
/// assert_eq!(results.result[0].bindings[&Value::from("x")], Value::from(2u64));
|
||||
///
|
||||
/// assert_eq!(results.result[1].expressions[0].value, Value::Bool(true));
|
||||
/// assert_eq!(results.result[1].expressions[0].text.as_ref(), "x = [1, 2, 3][_]");
|
||||
/// assert_eq!(results.result[1].expressions[0].value, Value::Bool(true));
|
||||
/// assert_eq!(results.result[1].expressions[1].text.as_ref(), "x >= 2");
|
||||
/// assert_eq!(results.result[1].bindings[&Value::from("x")], Value::from(3u64));
|
||||
/// # Ok(())
|
||||
/// # }
|
||||
/// ```
|
||||
///
|
||||
/// See [QueryResult] for examples of different kinds of results.
|
||||
#[derive(Debug, Clone, Default, Serialize)]
|
||||
pub struct QueryResults {
|
||||
/// Collection of results of evaluting a query.
|
||||
#[serde(skip_serializing_if = "Vec::is_empty")]
|
||||
pub result: Vec<QueryResult>,
|
||||
}
|
||||
|
||||
/// Items in `unstable` are likely to change.
|
||||
#[doc(hidden)]
|
||||
pub mod unstable {
|
||||
pub use crate::ast::*;
|
||||
pub use crate::lexer::*;
|
||||
|
||||
@@ -132,6 +132,26 @@ impl From<f64> for Number {
|
||||
}
|
||||
|
||||
impl Number {
|
||||
pub fn as_u128(&self) -> Option<u128> {
|
||||
match self {
|
||||
Big(b) if b.is_integer() => match u128::try_from(&b.d) {
|
||||
Ok(v) => Some(v),
|
||||
_ => None,
|
||||
},
|
||||
_ => None,
|
||||
}
|
||||
}
|
||||
|
||||
pub fn as_i128(&self) -> Option<i128> {
|
||||
match self {
|
||||
Big(b) if b.is_integer() => match i128::try_from(&b.d) {
|
||||
Ok(v) => Some(v),
|
||||
_ => None,
|
||||
},
|
||||
_ => None,
|
||||
}
|
||||
}
|
||||
|
||||
pub fn as_u64(&self) -> Option<u64> {
|
||||
match self {
|
||||
Big(b) if b.is_integer() => match u64::try_from(&b.d) {
|
||||
|
||||
+11
-8
@@ -3,7 +3,6 @@
|
||||
|
||||
use crate::ast::Expr::*;
|
||||
use crate::ast::*;
|
||||
use crate::builtins;
|
||||
use crate::lexer::*;
|
||||
use crate::utils::*;
|
||||
|
||||
@@ -629,6 +628,7 @@ impl Analyzer {
|
||||
let mut used_vars = vec![];
|
||||
let mut comprs = vec![];
|
||||
let full_expr = expr;
|
||||
std::convert::identity(&full_expr);
|
||||
traverse(expr, &mut |e| match e.as_ref() {
|
||||
Var(v) if !matches!(v.text(), "_" | "input" | "data") => {
|
||||
let name = v.source_str();
|
||||
@@ -645,15 +645,18 @@ impl Analyzer {
|
||||
first_use.entry(name).or_insert(v.clone());
|
||||
}
|
||||
} else if !scope.inputs.contains(&name) {
|
||||
match get_path_string(full_expr, None) {
|
||||
Ok(path)
|
||||
if builtins::BUILTINS.contains_key(path.as_str())
|
||||
|| builtins::deprecated::DEPRECATED.contains_key(path.as_str()) => {
|
||||
#[cfg(feature = "deprecated")]
|
||||
{
|
||||
if let Ok(path) = get_path_string(full_expr, None) {
|
||||
if crate::builtins::BUILTINS.contains_key(path.as_str())
|
||||
|| crate::builtins::deprecated::DEPRECATED
|
||||
.contains_key(path.as_str())
|
||||
{
|
||||
return Ok(false);
|
||||
}
|
||||
}
|
||||
_ => bail!(v.error(
|
||||
format!("use of undefined variable `{name}` is unsafe").as_str()
|
||||
)),
|
||||
}
|
||||
bail!(v.error(format!("use of undefined variable `{name}` is unsafe").as_str()));
|
||||
}
|
||||
Ok(false)
|
||||
}
|
||||
|
||||
+724
-62
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user