kata-containers/regorus
1
0
Fork 0
mirror of https://github.com/microsoft/regorus.git synced 2026-08-05 02:16:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

RVM compiler & runtime optimizations: caching, instruction fusion, constant hoisting, and correctness fixes (#626)

Browse Source 
* perf!: add LRU caches for compiled regex and glob patterns

Add bounded LRU caches for compiled regex and glob patterns used by
Rego builtins, avoiding repeated recompilation of the same patterns
during policy evaluation.

New `cache` feature (included in `full-opa` and `opa-no-std`) backed by
the `lru` crate (no_std compatible) with `spin::Mutex` for thread safety.

- `src/cache.rs`: generic `LruCache<V>` wrapper, global `REGEX_CACHE`
  (default capacity 256) and `GLOB_CACHE` (default capacity 128)
- `src/builtins/regex.rs`: all regex builtins route through the cache
- `src/builtins/glob.rs`: glob.match routes through the cache
- Public API: `regorus::cache::{Config, configure, clear}`

Compilation costs avoided per cache hit:
  regex  10-55 µs  (simple to complex patterns)
  glob   10-12 µs
  LRU hit   ~10 ns

BREAKING CHANGE: new `cache` Cargo feature added to `full-opa` and
`opa-no-std` feature sets; adds `lru` as a dependency.

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>

* perf(vm): amortize per-instruction memory and time limit checks

Deduplicate per-instruction memory_check calls by hoisting them to the
main dispatch loop, and amortize monotonic_now() syscalls in the
execution timer by checking elapsed time every N instructions instead
of on every tick.

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>

* fix(vm): correct object membership to check values only, not keys

The Contains instruction for objects was checking both keys and values:

    object_fields.contains_key(v) || object_fields.values().any(|v| ...)

Per the Rego specification, `x in obj` tests whether x is a VALUE of
the object, not a key. The two-argument form `k, v in obj` is needed
to access keys. The interpreter already implemented this correctly
(values-only scan), but the RVM had the extra contains_key() check
which would incorrectly return true when the search value happened to
match a key name.

Remove the contains_key() branch so the behavior matches the interpreter
and the Rego spec. Add two regression tests:
- object_membership_checks_values_not_keys: "foo" in {"foo": "bar"}
  must be false (key, not a value)
- object_membership_finds_value: "bar" in {"foo": "bar"} must be true

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>

* perf(compiler): hoist all-constant collection literals to the literal table

When an array, set, or object literal consists entirely of compile-time
constant expressions (numbers, strings, bools, null, and nested constant
collections), the compiler now evaluates them at compile time and emits a
single Load instruction from the literal table instead of generating
per-element instructions at runtime.

Previously, a Rego expression like `x in [1, 2, 3]` would emit
ArrayCreate + three Load + three ArrayAppend instructions, allocating a
new Vec and Rc on every evaluation. With this change, the entire array
is built once during compilation and loaded as a single constant.

This optimization applies to all three collection types:
- Array literals: avoids ArrayCreate + N x (Load + ArrayAppend)
- Set literals: avoids SetCreate + N x (Load + SetAdd)
- Object literals: avoids ObjectCreate + N x (Load + Load + ObjectInsert)

The implementation adds a try_eval_const() helper that recursively
evaluates an AST expression as a constant Value, returning None if any
sub-expression is non-constant. Each compile method for collection
literals attempts the all-constant fast path first and falls through to
the existing instruction-by-instruction codegen otherwise.

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>

* perf(compiler): fuse Eq + AssertCondition into AssertEq instruction

Add a new `AssertEq { left, right }` instruction that combines equality
comparison and condition assertion into a single operation. This replaces
the previous two-instruction pattern of `Eq { dest, left, right }` followed
by `AssertCondition { condition: dest }`, saving one instruction and one
register per equality assertion.

The fused instruction checks two registers for equality and directly calls
handle_condition with the result, avoiding the intermediate boolean
register entirely. If either operand is undefined or the values differ,
the condition fails and the rule/loop backtracks.

The optimization applies to four destructuring sites:
- EqualityCheck (assignment re-binding with `x = expr; x = expr`)
- EqualityExpr (destructuring against an expression)
- EqualityValue (destructuring against a literal value)
- assert_array_length (array length validation in destructuring)

In soft_assert_mode the compiler still emits the original Eq instruction
since the boolean result register is needed by callers.

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>

* perf(compiler): fuse Not + AssertCondition into AssertNot instruction

Add a new `AssertNot { operand }` instruction that combines logical
negation and condition assertion into a single operation. This replaces
the previous two-instruction pattern of `Not { dest, operand }` followed
by `AssertCondition { condition: dest }`, saving one instruction and one
register allocation.

The fused instruction checks the operand register and passes the
condition if the value is false or undefined (per Rego semantics where
`not expr` succeeds when the expression has no results or is false),
and fails the condition if the value is true or any non-boolean truthy
value.

This was the only emission site for the Not+AssertCondition pair,
occurring in the compilation of `Literal::NotExpr` statements.

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>

* perf(vm): early exit for same-value multi-definition rules

When a rule has multiple definitions that all produce the same value
(e.g. implicit true, or identical literal), set early_exit_on_first_success
on RuleInfo so the VM can stop after the first successful definition.

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>

* feat!: expose cache configuration API to all language bindings

Add `set_cache_config` and `clear_cache` functions to every binding
so callers can tune or reset the global regex/glob pattern caches
introduced in the cache feature.

Bindings updated:
- FFI (C): `regorus_set_cache_config`, `regorus_clear_cache`
- C++ header: free functions `regorus::set_cache_config`, `regorus::clear_cache`
- Python: module-level `set_cache_config(*, regex, glob)`, `clear_cache()`
- Java: static methods on new `CacheConfig` class
- Go: package-level `SetCacheConfig`, `ClearCache`
- Ruby: module functions `Regorus.set_cache_config`, `Regorus.clear_cache`
- WASM: free functions `setCacheConfig`, `clearCache`
- C#: static methods `Engine.SetCacheConfig`, `Engine.ClearCache`

BREAKING CHANGE: Bump SERIALIZATION_VERSION from 4 to 5 due to new
AssertEq and AssertNot instruction variants added in the instruction
fusion commits. Programs serialized with version 5 cannot be loaded
by older versions of regorus.

* fix: address PR review feedback

Cache subsystem:
- Gate REGEX_CACHE and related imports behind #[cfg(feature = "regex")]
  so that building with --features cache without regex compiles correctly.
- Gate LruCache struct behind #[cfg(any(feature = "regex", feature = "glob"))].
- Add Config::MAX_CAPACITY (2^16) hard upper bound; clamp values in
  configure() to prevent unbounded cache growth.
- Use parking_lot::Mutex for std builds and spin::Mutex for no_std to
  avoid CPU spinning under contention in tight regex/glob eval loops.
- Narrow lock scopes in regex/glob builtins: release the mutex before
  compiling a pattern, then re-acquire to insert.

Java JNI binding:
- Fix cache config overflow: negative jlong values now saturate to 0
  and positive overflow saturates to usize::MAX (then clamped by
  MAX_CAPACITY) instead of silently disabling the cache.
- Gate JNI cache config/clear functions behind #[cfg(feature = "cache")].

Compiler:
- Refactor static_value_of_expr to delegate to try_eval_const,
  gaining support for negated numbers and constant collections.
- Make try_eval_const pub(in crate::languages::rego::compiler) and
  re-export through expressions.rs.
- Handle Expr::UnaryExpr with numeric literals in try_eval_const so
  collections containing negated numbers (e.g. [-1, 2]) are hoisted.

VM correctness:
- Fix Not instruction to follow Rego semantics: not expr yields
  true when expr is undefined or false, false for any other defined
  value (including non-booleans) -- no longer errors on non-boolean
  operands.
- Add enforce_memory_check() call at execute_suspendable_entry to
  ensure memory limits are checked before the first instruction.
- Update AssertNot listing comment to "exit if any defined truthy
  value" to match actual VM behaviour.
- Add doc comment on Not instruction clarifying Rego negation
  semantics.

Bindings:
- Fix C++ header indentation for set_cache_config / clear_cache.
- Propagate Cargo.lock parking_lot addition across ffi, java, python,
  and wasm binding lockfiles.

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>

---------

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
This commit is contained in:
Anand Krishnamoorthi
2026-03-23 21:00:51 -05:00
committed by GitHub
parent 898643129e
commit 83891d7782
61 changed files with 1741 additions and 110 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
.gitignore vendored
View File

@@ -25,6 +25,12 @@ bindings/ffi/regorus.ffi.hpp
bindings/*/target
# Temporary commit message files
.commit-msg.txt
# Local planning docs
docs/plans/
# C# build folders
**bin
**obj

8
Cargo.lock generated
View File

@@ -817,6 +817,12 @@ version = "0.4.29"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
[[package]]
name = "lru"
version = "0.16.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a1dc47f592c06f33f8e3aea9591776ec7c9f9e4124778ff8a3c3b87159f7e593"
[[package]]
name = "memchr"
version = "2.7.6"
@@ -1265,10 +1271,12 @@ dependencies = [
"ipnet",
"jsonschema",
"lazy_static",
"lru",
"msvc_spectre_libs",
"num-bigint",
"num-traits",
"num_cpus",
"parking_lot",
"postcard",
"prettydiff",
"rand",

6
Cargo.toml
View File

@@ -39,10 +39,11 @@ net = ["dep:ipnet"]
no_std = ["lazy_static/spin_no_std"]
opa-runtime = []
regex = ["dep:regex"]
cache = ["dep:lru"]
rvm = ["dep:postcard", "dep:indexmap"]
semver = ["dep:semver"]
allocator-memory-limits = ["std", "mimalloc", "mimalloc/allocator-memory-limits"]
std = ["rand/std", "rand/std_rng", "serde_json/std", "msvc_spectre_libs" ]
std = ["rand/std", "rand/std_rng", "serde_json/std", "msvc_spectre_libs", "dep:parking_lot" ]
time = ["dep:chrono", "dep:chrono-tz"]
uuid = ["dep:uuid"]
urlquery = ["dep:url"]
@@ -61,6 +62,7 @@ full-opa = [
"net",
"opa-runtime",
"regex",
"cache",
"semver",
"std",
"time",
@@ -105,6 +107,7 @@ thiserror = { version = "2.0", default-features = false }
data-encoding = { version = "2.8.0", optional = true, default-features=false, features = ["alloc"] }
num-bigint = { version = "0.4", default-features = false }
num-traits = { version = "0.2", default-features = false }
parking_lot = { version = "0.12", optional = true }
spin = { version = "0.9.8", default-features = false, features = ["mutex", "spin_mutex"] }
globset = { version = "0.4.16", features = ["simd-accel"], default-features = false, optional = true }
@@ -124,6 +127,7 @@ rand = { version = "0.9.0", default-features = false, features = ["thread_rng"],
# Causes the project to link with the Spectre-mitigated CRT and libs.
msvc_spectre_libs = { version = "0.1", features = ["error"], optional = true }
dashmap = { version = "6.1", default-features = false, optional = true }
lru = { version = "0.16", default-features = false, optional = true }
mimalloc = { package = "regorus-mimalloc", path = "mimalloc", version = "2.2.6", optional = true }
# rvm related deps

7
bindings/c/main.c
View File

@@ -11,6 +11,13 @@ int main() {
if (r.status != Ok)
goto error;
// Configure the global pattern caches.
RegorusCacheConfig cache_config = { .regex = 256, .glob = 128 };
r = regorus_set_cache_config(cache_config);
if (r.status != Ok)
goto error;
regorus_result_drop(r);
// Raise the default col limit to 2000
RegorusPolicyLengthConfig len_config = { .max_col = 2000, .max_file_bytes = 1048576, .max_lines = 20000 };
r = regorus_engine_set_policy_length_config(engine, len_config);

4
bindings/cpp/main.cpp
View File

@@ -6,6 +6,10 @@ void example()
// Create engine
regorus::Engine engine;
// Configure the global pattern caches.
RegorusCacheConfig cache_config = { 256, 128 };
regorus::set_cache_config(cache_config);
engine.set_rego_v0(true);
engine.set_enable_coverage(true);

8
bindings/cpp/regorus.hpp
View File

@@ -158,6 +158,14 @@ namespace regorus {
Engine& operator=(const Engine&) = delete;
};
inline Result set_cache_config(RegorusCacheConfig config) {
return Result(regorus_set_cache_config(config));
}
inline Result clear_cache() {
return Result(regorus_clear_cache());
}
class CompiledPolicy {
public:
explicit CompiledPolicy(RegorusCompiledPolicy* p) : policy(p) {}

39
bindings/csharp/Regorus/CacheConfig.cs Normal file
View File

@@ -0,0 +1,39 @@
// Copyright (c) Microsoft Corporation.
// Licensed under the MIT License.
using System;
namespace Regorus
{
/// <summary>
/// Global configuration for compiled pattern caches used by regex and glob builtins.
/// </summary>
public readonly struct CacheConfig
{
/// <summary>
/// Initializes a new instance of the <see cref="CacheConfig"/> struct.
/// </summary>
/// <param name="regex">Maximum cached compiled regex patterns (default 256, 0 = disabled).</param>
/// <param name="glob">Maximum cached compiled glob matchers (default 128, 0 = disabled).</param>
public CacheConfig(nuint regex, nuint glob)
{
Regex = regex;
Glob = glob;
}
/// <summary>Maximum cached compiled regex patterns (default 256).</summary>
public nuint Regex { get; }
/// <summary>Maximum cached compiled glob matchers (default 128).</summary>
public nuint Glob { get; }
internal Regorus.Internal.RegorusCacheConfig ToNative()
{
return new Regorus.Internal.RegorusCacheConfig
{
regex = Regex,
glob = Glob,
};
}
}
}

11
bindings/csharp/Regorus/Engine.cs
View File

@@ -34,6 +34,17 @@ namespace Regorus
CheckAndDropResult(Regorus.Internal.API.regorus_clear_fallback_execution_timer_config());
}
public static void SetCacheConfig(CacheConfig config)
{
var nativeConfig = config.ToNative();
CheckAndDropResult(Regorus.Internal.API.regorus_set_cache_config(nativeConfig));
}
public static void ClearCache()
{
CheckAndDropResult(Regorus.Internal.API.regorus_clear_cache());
}
private Engine(RegorusEngineHandle handle)
: base(handle, nameof(Engine))
{

26
bindings/csharp/Regorus/NativeMethods.cs
View File

@@ -458,6 +458,22 @@ namespace Regorus.Internal
#endregion
#region Cache Configuration Global Methods
/// <summary>
/// Configure the global pattern caches used by regex and glob builtins.
/// </summary>
[DllImport(LibraryName, EntryPoint = "regorus_set_cache_config", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
internal static extern RegorusResult regorus_set_cache_config(RegorusCacheConfig config);
/// <summary>
/// Clear all entries from every pattern cache.
/// </summary>
[DllImport(LibraryName, EntryPoint = "regorus_clear_cache", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
internal static extern RegorusResult regorus_clear_cache();
#endregion
#region Compilation Methods
/// <summary>
@@ -795,6 +811,16 @@ namespace Regorus.Internal
public UIntPtr max_lines;
}
/// <summary>
/// FFI representation of the cache configuration.
/// </summary>
[StructLayout(LayoutKind.Sequential)]
internal struct RegorusCacheConfig
{
public UIntPtr regex;
public UIntPtr glob;
}
/// <summary>
/// Byte buffer returned from FFI.
/// </summary>

3
bindings/csharp/TestApp/Program.cs
View File

@@ -18,6 +18,9 @@ var w = new Stopwatch();
w.Restart();
// Configure the global pattern caches.
Regorus.Engine.SetCacheConfig(new Regorus.CacheConfig(regex: 256, glob: 128));
var engine = new Regorus.Engine();
engine.SetRegoV0(true);
// Raise the default col limit to 2000

8
bindings/ffi/Cargo.lock generated
View File

@@ -657,6 +657,12 @@ version = "0.4.29"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
[[package]]
name = "lru"
version = "0.16.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a1dc47f592c06f33f8e3aea9591776ec7c9f9e4124778ff8a3c3b87159f7e593"
[[package]]
name = "memchr"
version = "2.7.6"
@@ -985,9 +991,11 @@ dependencies = [
"ipnet",
"jsonschema",
"lazy_static",
"lru",
"msvc_spectre_libs",
"num-bigint",
"num-traits",
"parking_lot",
"postcard",
"rand",
"regex",

2
bindings/ffi/Cargo.toml
View File

@@ -35,6 +35,7 @@ default = [
"rbac",
"regorus/arc",
"regorus/full-opa",
"cache",
"contention_checks",
]
ast = ["regorus/ast"]
@@ -45,6 +46,7 @@ allocator-memory-limits = ["regorus/allocator-memory-limits"]
contention_checks = ["parking_lot"]
rvm = ["regorus/rvm"]
rbac = ["regorus/azure-rbac"]
cache = ["regorus/cache"]
custom_allocator = []
[build-dependencies]

34
bindings/ffi/src/limits.rs
View File

@@ -199,6 +199,40 @@ pub extern "C" fn regorus_clear_fallback_execution_timer_config() -> RegorusResu
RegorusResult::ok_void()
}
// ---------------------------------------------------------------------------
// Cache configuration (global)
// ---------------------------------------------------------------------------
/// FFI representation of [`regorus::cache::Config`].
#[cfg(feature = "cache")]
#[repr(C)]
#[derive(Debug, Clone, Copy)]
pub struct RegorusCacheConfig {
/// Maximum compiled regex patterns (default 256, 0 = disabled).
pub regex: usize,
/// Maximum compiled glob matchers (default 128, 0 = disabled).
pub glob: usize,
}
/// Configure the global pattern caches used by `regex.*` and `glob.*` builtins.
#[cfg(feature = "cache")]
#[no_mangle]
pub extern "C" fn regorus_set_cache_config(config: RegorusCacheConfig) -> RegorusResult {
regorus::cache::configure(regorus::cache::Config {
regex: config.regex,
glob: config.glob,
});
RegorusResult::ok_void()
}
/// Clear all entries from every pattern cache.
#[cfg(feature = "cache")]
#[no_mangle]
pub extern "C" fn regorus_clear_cache() -> RegorusResult {
regorus::cache::clear();
RegorusResult::ok_void()
}
#[cfg(test)]
mod tests {
use super::{

6
bindings/go/main.go
View File

@@ -17,6 +17,12 @@ func main() {
engine := regorus.NewEngine()
defer engine.Close()
// Configure the global pattern caches.
if err = regorus.SetCacheConfig(regorus.CacheConfig{Regex: 256, Glob: 128}); err != nil {
fmt.Fprintf(os.Stderr, "error: %v\n", err)
os.Exit(1)
}
engine.SetRegoV0(true)
// Raise the default col limit to 2000
engine.SetPolicyLengthConfig(regorus.PolicyLengthConfig{MaxCol: 2000, MaxFileBytes: 1048576, MaxLines: 20000})

27
bindings/go/pkg/regorus/mod.go
View File

@@ -243,3 +243,30 @@ func (e *Engine) ClearPolicyLengthConfig() error {
}
return nil
}
type CacheConfig struct {
Regex uint
Glob uint
}
func SetCacheConfig(config CacheConfig) error {
c := C.RegorusCacheConfig{
regex: C.size_t(config.Regex),
glob: C.size_t(config.Glob),
}
result := C.regorus_set_cache_config(c)
defer C.regorus_result_drop(result)
if result.status != C.Ok {
return fmt.Errorf("%s", C.GoString(result.error_message))
}
return nil
}
func ClearCache() error {
result := C.regorus_clear_cache()
defer C.regorus_result_drop(result)
if result.status != C.Ok {
return fmt.Errorf("%s", C.GoString(result.error_message))
}
return nil
}

8
bindings/java/Cargo.lock generated
View File

@@ -539,6 +539,12 @@ version = "0.4.29"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
[[package]]
name = "lru"
version = "0.16.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a1dc47f592c06f33f8e3aea9591776ec7c9f9e4124778ff8a3c3b87159f7e593"
[[package]]
name = "memchr"
version = "2.7.6"
@@ -860,9 +866,11 @@ dependencies = [
"ipnet",
"jsonschema",
"lazy_static",
"lru",
"msvc_spectre_libs",
"num-bigint",
"num-traits",
"parking_lot",
"postcard",
"rand",
"regex",

3
bindings/java/Cargo.toml
View File

@@ -14,9 +14,10 @@ keywords = ["interpreter", "opa", "policy-as-code", "rego"]
crate-type = ["cdylib"]
[features]
default = ["ast", "coverage", "regorus/std", "regorus/full-opa"]
default = ["ast", "cache", "coverage", "regorus/std", "regorus/full-opa"]
coverage = ["regorus/coverage"]
ast = ["regorus/ast"]
cache = ["regorus/cache"]
[dependencies]
anyhow = "1.0"

4
bindings/java/Test.java
View File

@@ -1,6 +1,7 @@
// Copyright (c) Microsoft Corporation.
// Licensed under the MIT License.
import com.microsoft.regorus.CacheConfig;
import com.microsoft.regorus.Engine;
import com.microsoft.regorus.PolicyLengthConfig;
import com.microsoft.regorus.PolicyModule;
@@ -10,6 +11,9 @@ import com.microsoft.regorus.Rvm;
public class Test {
public static void main(String[] args) {
// Configure the global pattern caches.
CacheConfig.configure(new CacheConfig(256, 128));
try (Engine engine = new Engine()) {
String pkg = engine.addPolicy(
"hello.rego",

31
bindings/java/src/lib.rs
View File

@@ -399,6 +399,37 @@ pub extern "system" fn Java_com_microsoft_regorus_Engine_nativeClearPolicyLength
engine.clear_policy_length_config();
}
#[cfg(feature = "cache")]
#[no_mangle]
pub extern "system" fn Java_com_microsoft_regorus_CacheConfig_nativeSetCacheConfig(
_env: JNIEnv,
_class: JClass,
regex: jlong,
glob: jlong,
) {
regorus::cache::configure(regorus::cache::Config {
regex: if regex < 0 {
0
} else {
usize::try_from(regex).unwrap_or(usize::MAX)
},
glob: if glob < 0 {
0
} else {
usize::try_from(glob).unwrap_or(usize::MAX)
},
});
}
#[cfg(feature = "cache")]
#[no_mangle]
pub extern "system" fn Java_com_microsoft_regorus_CacheConfig_nativeClearCache(
_env: JNIEnv,
_class: JClass,
) {
regorus::cache::clear();
}
#[no_mangle]
pub extern "system" fn Java_com_microsoft_regorus_Engine_nativeDestroyEngine(
_env: JNIEnv,

62
bindings/java/src/main/java/com/microsoft/regorus/CacheConfig.java Normal file
View File

@@ -0,0 +1,62 @@
/**
* Copyright (c) Microsoft Corporation.
* Licensed under the MIT License.
**/
package com.microsoft.regorus;
/**
* Global configuration for compiled pattern caches used by regex and glob builtins.
*
* <p>Capacity of 0 disables the corresponding cache.
*/
public final class CacheConfig {
static {
System.loadLibrary("regorus_java");
}
private static native void nativeSetCacheConfig(long regex, long glob);
private static native void nativeClearCache();
/**
* Maximum cached compiled regex patterns (default 256).
*/
public final long regex;
/**
* Maximum cached compiled glob matchers (default 128).
*/
public final long glob;
/**
* Create a new cache configuration.
*
* @param regex Maximum cached compiled regex patterns (0 = disabled).
* @param glob Maximum cached compiled glob matchers (0 = disabled).
*/
public CacheConfig(long regex, long glob) {
if (regex < 0) {
throw new IllegalArgumentException("regex must be non-negative");
}
if (glob < 0) {
throw new IllegalArgumentException("glob must be non-negative");
}
this.regex = regex;
this.glob = glob;
}
/**
* Apply this cache configuration globally.
*/
public static void configure(CacheConfig config) {
nativeSetCacheConfig(config.regex, config.glob);
}
/**
* Clear all entries from every pattern cache.
*/
public static void clear() {
nativeClearCache();
}
}

8
bindings/python/Cargo.lock generated
View File

@@ -510,6 +510,12 @@ version = "0.4.29"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
[[package]]
name = "lru"
version = "0.16.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a1dc47f592c06f33f8e3aea9591776ec7c9f9e4124778ff8a3c3b87159f7e593"
[[package]]
name = "memchr"
version = "2.7.6"
@@ -919,9 +925,11 @@ dependencies = [
"ipnet",
"jsonschema",
"lazy_static",
"lru",
"msvc_spectre_libs",
"num-bigint",
"num-traits",
"parking_lot",
"postcard",
"rand",
"regex",

3
bindings/python/Cargo.toml
View File

@@ -15,8 +15,9 @@ keywords = ["interpreter", "opa", "policy-as-code", "rego"]
crate-type = ["cdylib"]
[features]
default = ["ast", "coverage", "regorus/std", "regorus/full-opa"]
default = ["ast", "cache", "coverage", "regorus/std", "regorus/full-opa"]
ast = ["regorus/ast"]
cache = ["regorus/cache"]
coverage = ["regorus/coverage"]
[dependencies]

23
bindings/python/src/lib.rs
View File

@@ -622,10 +622,33 @@ impl Rvm {
}
}
/// Configure the global pattern caches used by `regex.*` and `glob.*` builtins.
///
/// * `regex`: Maximum cached compiled regex patterns (default 256, 0 = disabled).
/// * `glob`: Maximum cached compiled glob matchers (default 128, 0 = disabled).
#[cfg(feature = "cache")]
#[pyfunction]
#[pyo3(signature = (*, regex = 256, glob = 128))]
fn set_cache_config(regex: usize, glob: usize) {
::regorus::cache::configure(::regorus::cache::Config { regex, glob });
}
/// Clear all entries from every pattern cache.
#[cfg(feature = "cache")]
#[pyfunction]
fn clear_cache() {
::regorus::cache::clear();
}
#[pymodule]
pub fn regorus(_py: Python<'_>, m: &Bound<'_, PyModule>) -> PyResult<()> {
m.add_class::<crate::Engine>()?;
m.add_class::<crate::Program>()?;
m.add_class::<crate::Rvm>()?;
#[cfg(feature = "cache")]
{
m.add_function(wrap_pyfunction!(set_cache_config, m)?)?;
m.add_function(wrap_pyfunction!(clear_cache, m)?)?;
}
Ok(())
}

3
bindings/python/test.py
View File

@@ -6,6 +6,9 @@ import sys
if hasattr(sys.stdout, "reconfigure"):
sys.stdout.reconfigure(encoding="utf-8")
# Configure the global pattern caches.
regorus.set_cache_config(regex=256, glob=128)
# Create engine
engine = regorus.Engine()

7
bindings/ruby/Cargo.lock generated
View File

@@ -549,6 +549,12 @@ version = "0.4.29"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
[[package]]
name = "lru"
version = "0.16.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a1dc47f592c06f33f8e3aea9591776ec7c9f9e4124778ff8a3c3b87159f7e593"
[[package]]
name = "magnus"
version = "0.8.2"
@@ -926,6 +932,7 @@ dependencies = [
"ipnet",
"jsonschema",
"lazy_static",
"lru",
"msvc_spectre_libs",
"num-bigint",
"num-traits",

3
bindings/ruby/ext/regorusrb/Cargo.toml
View File

@@ -11,8 +11,9 @@ crate-type = ["cdylib"]
path = "src/lib.rs"
[features]
default = ["ast", "coverage", "regorus/std", "regorus/full-opa"]
default = ["ast", "cache", "coverage", "regorus/std", "regorus/full-opa"]
ast = ["regorus/ast"]
cache = ["regorus/cache"]
coverage = ["regorus/coverage"]
[dependencies]

37
bindings/ruby/ext/regorusrb/src/lib.rs
View File

@@ -14,6 +14,13 @@ struct PolicyLengthSpec {
max_lines: usize,
}
#[cfg(feature = "cache")]
#[derive(Deserialize)]
struct CacheConfigSpec {
regex: usize,
glob: usize,
}
#[derive(Default)]
#[magnus::wrap(class = "Regorus::Engine")]
pub struct Engine {
@@ -417,5 +424,35 @@ fn init(ruby: &Ruby) -> Result<(), Error> {
// ast
engine_class.define_method("get_ast_as_json", method!(Engine::get_ast_as_json, 0))?;
// cache configuration (module-level)
#[cfg(feature = "cache")]
{
regorus_module
.define_module_function("set_cache_config", magnus::function!(set_cache_config, 1))?;
regorus_module.define_module_function("clear_cache", magnus::function!(clear_cache, 0))?;
}
Ok(())
}
#[cfg(feature = "cache")]
fn set_cache_config(ruby: &Ruby, hash: magnus::RHash) -> Result<(), Error> {
let spec: CacheConfigSpec = serde_magnus::deserialize(ruby, hash).map_err(|e| {
Error::new(
runtime_error(),
format!("Failed to deserialize cache config: {e}"),
)
})?;
regorus::cache::configure(regorus::cache::Config {
regex: spec.regex,
glob: spec.glob,
});
Ok(())
}
#[cfg(feature = "cache")]
fn clear_cache() -> Result<(), Error> {
regorus::cache::clear();
Ok(())
}

5
bindings/ruby/test/test_regorus.rb
View File

@@ -188,6 +188,11 @@ class TestRegorus < Minitest::Test
@engine.clear_policy_length_config
end
def test_set_cache_config
::Regorus.set_cache_config({ regex: 256, glob: 128 })
::Regorus.clear_cache
end
def alice_results
{
result: [

8
bindings/wasm/Cargo.lock generated
View File

@@ -558,6 +558,12 @@ version = "0.4.29"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
[[package]]
name = "lru"
version = "0.16.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a1dc47f592c06f33f8e3aea9591776ec7c9f9e4124778ff8a3c3b87159f7e593"
[[package]]
name = "memchr"
version = "2.7.6"
@@ -917,9 +923,11 @@ dependencies = [
"ipnet",
"jsonschema",
"lazy_static",
"lru",
"msvc_spectre_libs",
"num-bigint",
"num-traits",
"parking_lot",
"postcard",
"rand",
"regex",

4
bindings/wasm/Cargo.toml
View File

@@ -32,9 +32,11 @@ default = [
"regorus/time",
"regorus/uuid",
"regorus/urlquery",
"regorus/yaml"
"regorus/yaml",
"cache"
]
ast = ["regorus/ast"]
cache = ["regorus/cache"]
coverage = ["regorus/coverage"]
[dependencies]

28
bindings/wasm/src/lib.rs
View File

@@ -35,6 +35,34 @@ struct PolicyLengthSpec {
max_lines: usize,
}
#[cfg(feature = "cache")]
#[derive(Deserialize)]
struct CacheConfigSpec {
regex: usize,
glob: usize,
}
/// Configure the global pattern caches used by regex and glob builtins.
///
/// Accepts a JS object: `{ regex, glob }`.
#[cfg(feature = "cache")]
#[wasm_bindgen(js_name = "setCacheConfig")]
pub fn set_cache_config(config: JsValue) -> Result<(), JsValue> {
let spec: CacheConfigSpec = serde_wasm_bindgen::from_value(config).map_err(error_to_jsvalue)?;
regorus::cache::configure(regorus::cache::Config {
regex: spec.regex,
glob: spec.glob,
});
Ok(())
}
/// Clear all entries from every pattern cache.
#[cfg(feature = "cache")]
#[wasm_bindgen(js_name = "clearCache")]
pub fn clear_cache() {
regorus::cache::clear();
}
#[wasm_bindgen]
pub struct Program {
program: Arc<RvmProgram>,

3
bindings/wasm/test.js
View File

@@ -3,6 +3,9 @@
var regorus = require('./pkg/regorusjs');
// Configure the global pattern caches.
regorus.setCacheConfig({ regex: 256, glob: 128 });
// Create an engine.
var engine = new regorus.Engine();

32
src/builtins/glob.rs
View File

@@ -52,11 +52,33 @@ fn make_delimiters_unix_style(s: &str, delimiters: &[char]) -> Result<String> {
}
fn make_glob(pattern: &str, span: &Span) -> Result<GlobMatcher> {
Ok(GlobBuilder::new(pattern)
.literal_separator(true)
.build()
.or_else(|_| bail!(span.error("invalid glob")))?
.compile_matcher())
#[cfg(feature = "cache")]
{
{
let mut cache = crate::cache::GLOB_CACHE.lock();
if let Some(matcher) = cache.get(pattern) {
return Ok(matcher.clone());
}
}
let matcher = GlobBuilder::new(pattern)
.literal_separator(true)
.build()
.or_else(|_| bail!(span.error("invalid glob")))?
.compile_matcher();
{
let mut cache = crate::cache::GLOB_CACHE.lock();
cache.put(alloc::string::String::from(pattern), matcher.clone());
}
Ok(matcher)
}
#[cfg(not(feature = "cache"))]
{
Ok(GlobBuilder::new(pattern)
.literal_separator(true)
.build()
.or_else(|_| bail!(span.error("invalid glob")))?
.compile_matcher())
}
}
fn glob_match(span: &Span, params: &[Ref<Expr>], args: &[Value], _strict: bool) -> Result<Value> {

77
src/builtins/regex.rs
View File

@@ -12,6 +12,39 @@ use crate::*;
use anyhow::{bail, Result};
use regex::Regex;
// ---------------------------------------------------------------------------
// Compiled-regex cache (feature = "cache")
//
// When enabled, compiled Regex objects are stored in a bounded LRU cache
// protected by a Mutex (parking_lot when std, spin when no_std).
// The capacity is configurable at runtime
// via regorus::cache::configure().
// ---------------------------------------------------------------------------
/// Compile a regex pattern, using the cache when the `cache` feature
/// is enabled and falling back to direct compilation otherwise.
fn get_or_compile_regex(pattern: &str) -> core::result::Result<Regex, regex::Error> {
#[cfg(feature = "cache")]
{
{
let mut cache = crate::cache::REGEX_CACHE.lock();
if let Some(re) = cache.get(pattern) {
return Ok(re.clone());
}
}
let re = Regex::new(pattern)?;
{
let mut cache = crate::cache::REGEX_CACHE.lock();
cache.put(alloc::string::String::from(pattern), re.clone());
Ok(re)
}
}
#[cfg(not(feature = "cache"))]
{
Regex::new(pattern)
}
}
pub fn register(m: &mut builtins::BuiltinsMap<&'static str, builtins::BuiltinFcn>) {
m.insert(
"regex.find_all_string_submatch_n",
@@ -39,8 +72,8 @@ fn find_all_string_submatch_n(
let value = ensure_string(name, &params[1], &args[1])?;
let n = ensure_numeric(name, &params[2], &args[2])?;
let pattern =
Regex::new(&pattern).or_else(|_| bail!(params[0].span().error("invalid regex")))?;
let re = get_or_compile_regex(&pattern)
.or_else(|_| bail!(params[0].span().error("invalid regex")))?;
if !n.is_integer() {
bail!(params[2].span().error("n must be an integer"));
@@ -53,8 +86,7 @@ fn find_all_string_submatch_n(
};
Ok(Value::from_array(
pattern
.captures_iter(&value)
re.captures_iter(&value)
.map(|capture| {
let groups = capture
.iter()
@@ -86,8 +118,8 @@ fn find_n(span: &Span, params: &[Ref<Expr>], args: &[Value], _strict: bool) -> R
let value = ensure_string(name, &params[1], &args[1])?;
let n = ensure_numeric(name, &params[2], &args[2])?;
let pattern =
Regex::new(&pattern).or_else(|_| bail!(params[0].span().error("invalid regex")))?;
let re = get_or_compile_regex(&pattern)
.or_else(|_| bail!(params[0].span().error("invalid regex")))?;
if !n.is_integer() {
bail!(params[2].span().error("n must be an integer"));
@@ -100,8 +132,7 @@ fn find_n(span: &Span, params: &[Ref<Expr>], args: &[Value], _strict: bool) -> R
};
Ok(Value::from_array(
pattern
.find_iter(&value)
re.find_iter(&value)
.map(|m| {
let value = Value::String(m.as_str().into());
// Guard match accumulation while pushing each substring.
@@ -116,8 +147,11 @@ fn find_n(span: &Span, params: &[Ref<Expr>], args: &[Value], _strict: bool) -> R
fn is_valid(span: &Span, params: &[Ref<Expr>], args: &[Value], _strict: bool) -> Result<Value> {
let name = "regex.is_valid";
ensure_args_count(span, name, params, args, 1)?;
Ok(ensure_string(name, &params[0], &args[0])
.map_or(Value::Bool(false), |p| Value::Bool(Regex::new(&p).is_ok())))
Ok(
ensure_string(name, &params[0], &args[0]).map_or(Value::Bool(false), |p| {
Value::Bool(get_or_compile_regex(&p).is_ok())
}),
)
}
pub fn regex_match(
@@ -131,9 +165,9 @@ pub fn regex_match(
let pattern = ensure_string(name, &params[0], &args[0])?;
let value = ensure_string(name, &params[1], &args[1])?;
let pattern =
Regex::new(&pattern).or_else(|_| bail!(params[0].span().error("invalid regex")))?;
Ok(Value::Bool(pattern.is_match(&value)))
let re = get_or_compile_regex(&pattern)
.or_else(|_| bail!(params[0].span().error("invalid regex")))?;
Ok(Value::Bool(re.is_match(&value)))
}
fn regex_replace(
@@ -149,15 +183,13 @@ fn regex_replace(
let pattern = ensure_string(name, &params[1], &args[1])?;
let value = ensure_string(name, &params[2], &args[2])?;
let pattern = match Regex::new(&pattern) {
let re = match get_or_compile_regex(&pattern) {
Ok(p) => p,
// TODO: This behavior is due to OPA test not raising error. Should we raise error?
_ => return Ok(Value::Undefined),
};
Ok(Value::String(
pattern.replace_all(&s, value.as_ref()).into(),
))
Ok(Value::String(re.replace_all(&s, value.as_ref()).into()))
}
fn regex_split(span: &Span, params: &[Ref<Expr>], args: &[Value], _strict: bool) -> Result<Value> {
@@ -166,11 +198,10 @@ fn regex_split(span: &Span, params: &[Ref<Expr>], args: &[Value], _strict: bool)
let pattern = ensure_string(name, &params[0], &args[0])?;
let value = ensure_string(name, &params[1], &args[1])?;
let pattern =
Regex::new(&pattern).or_else(|_| bail!(params[0].span().error("invalid regex")))?;
let re = get_or_compile_regex(&pattern)
.or_else(|_| bail!(params[0].span().error("invalid regex")))?;
Ok(Value::from_array(
pattern
.split(&value)
re.split(&value)
.map(|s| {
let value = Value::String(s.into());
// Guard output accumulation as each split segment is emitted.
@@ -211,13 +242,13 @@ fn regex_template_match(
}
// Fetch pattern, excluding delimiters.
let pattern = Regex::new(&template[start + delimiter_start.len()..end])
let re = get_or_compile_regex(&template[start + delimiter_start.len()..end])
.or_else(|_| bail!(params[0].span().error("invalid regex")))?;
// Skip preceding literal in value.
value = &value[start..];
let m = match pattern.find(value) {
let m = match re.find(value) {
Some(m) if m.start() == 0 => m,
_ => return Ok(Value::Bool(false)),
};

171
src/cache.rs Normal file
View File

@@ -0,0 +1,171 @@
// Copyright (c) Microsoft Corporation.
// Licensed under the MIT License.
//! Compiled-pattern caches for Rego builtins.
//!
//! When the `cache` feature is enabled, compiled [`regex::Regex`] and
//! [`globset::GlobMatcher`] objects are held in bounded LRU caches so that
//! repeated evaluations of the same pattern avoid recompilation.
//!
//! # Examples
//!
//! ```ignore
//! use regorus::cache;
//!
//! // Configure cache capacities (0 = disabled).
//! cache::configure(cache::Config {
//! regex: 256,
//! glob: 128,
//! });
//!
//! // Flush all cached patterns.
//! cache::clear();
//! ```
#[cfg(any(feature = "regex", feature = "glob"))]
use core::num::NonZeroUsize;
#[cfg(any(feature = "regex", feature = "glob"))]
use lazy_static::lazy_static;
#[cfg(all(feature = "std", any(feature = "regex", feature = "glob")))]
use parking_lot::Mutex;
#[cfg(all(not(feature = "std"), any(feature = "regex", feature = "glob")))]
use spin::Mutex;
#[cfg(any(feature = "regex", feature = "glob"))]
use alloc::string::String;
/// Configuration for builtin pattern caches.
///
/// Each field controls the maximum number of compiled patterns held in the
/// corresponding LRU cache. A value of `0` disables that cache entirely
/// (every lookup recompiles). Values exceeding [`Config::MAX_CAPACITY`] are
/// clamped silently.
#[derive(Debug, Clone, Copy)]
pub struct Config {
/// Maximum compiled regex patterns (default 256).
pub regex: usize,
/// Maximum compiled glob matchers (default 128).
pub glob: usize,
}
impl Config {
/// Hard upper bound for any single cache capacity (2^16 = 65 536).
pub const MAX_CAPACITY: usize = 1 << 16;
}
impl Default for Config {
fn default() -> Self {
Self {
regex: 256,
glob: 128,
}
}
}
// ---------------------------------------------------------------------------
// Internal generic LRU wrapper
// ---------------------------------------------------------------------------
#[cfg(any(feature = "regex", feature = "glob"))]
pub(crate) struct LruCache<V> {
inner: Option<lru::LruCache<String, V>>,
}
#[cfg(any(feature = "regex", feature = "glob"))]
impl<V> LruCache<V> {
pub(crate) fn new(capacity: usize) -> Self {
Self {
inner: NonZeroUsize::new(capacity).map(lru::LruCache::new),
}
}
/// Look up a key, returning a reference if present. Promotes to most-recent.
pub(crate) fn get(&mut self, key: &str) -> Option<&V> {
self.inner.as_mut()?.get(key)
}
/// Insert a key-value pair. Evicts the least-recently-used entry if full.
pub(crate) fn put(&mut self, key: String, value: V) {
if let Some(cache) = self.inner.as_mut() {
cache.put(key, value);
}
}
/// Remove all entries.
pub(crate) fn clear(&mut self) {
if let Some(cache) = self.inner.as_mut() {
cache.clear();
}
}
/// Resize the cache. If new capacity is 0, disables the cache.
pub(crate) fn resize(&mut self, capacity: usize) {
match NonZeroUsize::new(capacity) {
Some(cap) => match self.inner.as_mut() {
Some(cache) => cache.resize(cap),
None => self.inner = Some(lru::LruCache::new(cap)),
},
None => {
self.inner = None;
}
}
}
/// Number of entries currently cached.
#[allow(dead_code)]
pub(crate) fn len(&self) -> usize {
self.inner.as_ref().map_or(0, lru::LruCache::len)
}
}
// ---------------------------------------------------------------------------
// Global regex cache
// ---------------------------------------------------------------------------
#[cfg(feature = "regex")]
lazy_static! {
pub(crate) static ref REGEX_CACHE: Mutex<LruCache<regex::Regex>> =
Mutex::new(LruCache::new(Config::default().regex));
}
// ---------------------------------------------------------------------------
// Global glob cache
// ---------------------------------------------------------------------------
#[cfg(feature = "glob")]
lazy_static! {
pub(crate) static ref GLOB_CACHE: Mutex<LruCache<globset::GlobMatcher>> =
Mutex::new(LruCache::new(Config::default().glob));
}
// ---------------------------------------------------------------------------
// Public API
// ---------------------------------------------------------------------------
/// Apply a new cache configuration.
///
/// Resizes each cache to the specified capacity. Existing entries are
/// preserved (subject to LRU eviction if the new capacity is smaller).
/// Values exceeding [`Config::MAX_CAPACITY`] are clamped.
pub fn configure(config: Config) {
let regex = config.regex.min(Config::MAX_CAPACITY);
let glob = config.glob.min(Config::MAX_CAPACITY);
#[cfg(feature = "regex")]
REGEX_CACHE.lock().resize(regex);
#[cfg(feature = "glob")]
GLOB_CACHE.lock().resize(glob);
// Suppress unused-variable warnings when neither regex nor glob is enabled.
let _ = (regex, glob);
}
/// Remove all entries from every pattern cache.
pub fn clear() {
#[cfg(feature = "regex")]
REGEX_CACHE.lock().clear();
#[cfg(feature = "glob")]
GLOB_CACHE.lock().clear();
}

4
src/interpreter.rs
View File

@@ -289,7 +289,7 @@ impl Interpreter {
}
fn execution_timer_tick(&mut self, work_units: u32) -> Result<()> {
if self.execution_timer.limit().is_none() {
if !self.execution_timer.accumulate(work_units) {
return Ok(());
}
@@ -297,7 +297,7 @@ impl Interpreter {
return Ok(());
};
self.execution_timer.tick(work_units, now)?;
self.execution_timer.check_now(now)?;
Ok(())
}

61
src/languages/rego/compiler/destructuring.rs
View File

@@ -91,6 +91,19 @@ impl<'a> Compiler<'a> {
AssignmentPlan::EqualityCheck { lhs_expr, rhs_expr } => {
let lhs_reg = self.compile_rego_expr_with_span(lhs_expr, lhs_expr.span(), false)?;
let rhs_reg = self.compile_rego_expr_with_span(rhs_expr, rhs_expr.span(), false)?;
if !self.soft_assert_mode {
// AssertEq handles the equality assertion inline; the returned
// register is not used as a boolean by the caller — it is the
// expression's "result register" for potential downstream use.
self.emit_instruction(
Instruction::AssertEq {
left: lhs_reg,
right: rhs_reg,
},
span,
);
return Ok(lhs_reg);
}
let dest = self.alloc_register();
self.emit_instruction(
Instruction::Eq {
@@ -100,9 +113,6 @@ impl<'a> Compiler<'a> {
},
span,
);
if !self.soft_assert_mode {
self.emit_instruction(Instruction::AssertCondition { condition: dest }, span);
}
Ok(dest)
}
AssignmentPlan::WildcardMatch {
@@ -196,35 +206,47 @@ impl<'a> Compiler<'a> {
DestructuringPlan::EqualityExpr(expected_expr) => {
let expected_reg =
self.compile_rego_expr_with_span(expected_expr, expected_expr.span(), false)?;
let cmp_reg = self.alloc_register();
if self.soft_assert_mode {
let cmp_reg = self.alloc_register();
self.emit_instruction(
Instruction::Eq {
dest: cmp_reg,
left: value_register,
right: expected_reg,
},
span,
);
return Ok(Some(cmp_reg));
}
self.emit_instruction(
Instruction::Eq {
dest: cmp_reg,
Instruction::AssertEq {
left: value_register,
right: expected_reg,
},
span,
);
if self.soft_assert_mode {
return Ok(Some(cmp_reg));
}
self.emit_instruction(Instruction::AssertCondition { condition: cmp_reg }, span);
}
DestructuringPlan::EqualityValue(expected_value) => {
let expected_reg = self.load_literal_value(expected_value, span);
let cmp_reg = self.alloc_register();
if self.soft_assert_mode {
let cmp_reg = self.alloc_register();
self.emit_instruction(
Instruction::Eq {
dest: cmp_reg,
left: value_register,
right: expected_reg,
},
span,
);
return Ok(Some(cmp_reg));
}
self.emit_instruction(
Instruction::Eq {
dest: cmp_reg,
Instruction::AssertEq {
left: value_register,
right: expected_reg,
},
span,
);
if self.soft_assert_mode {
return Ok(Some(cmp_reg));
}
self.emit_instruction(Instruction::AssertCondition { condition: cmp_reg }, span);
}
DestructuringPlan::Array { element_plans } => {
self.assert_array_length(value_register, element_plans.len(), span)?;
@@ -371,16 +393,13 @@ impl<'a> Compiler<'a> {
span,
);
let cmp_reg = self.alloc_register();
self.emit_instruction(
Instruction::Eq {
dest: cmp_reg,
Instruction::AssertEq {
left: actual_len_reg,
right: expected_len_reg,
},
span,
);
self.emit_instruction(Instruction::AssertCondition { condition: cmp_reg }, span);
Ok(())
}
}

2
src/languages/rego/compiler/expressions.rs
View File

@@ -5,6 +5,8 @@
mod collection_literals;
mod operations;
pub(super) use collection_literals::try_eval_const;
use super::{Compiler, CompilerError, Register, Result};
use crate::ast::{Expr, ExprRef};
use crate::compiler::destructuring_planner::plans::BindingPlan;

66
src/languages/rego/compiler/expressions/collection_literals.rs
View File

@@ -7,20 +7,62 @@
)]
use super::{Compiler, Register, Result};
use crate::ast::ExprRef;
use crate::ast::{Expr, ExprRef};
use crate::lexer::Span;
use crate::rvm::instructions::{ArrayCreateParams, ObjectCreateParams, SetCreateParams};
use crate::rvm::Instruction;
use crate::{Rc, Value};
use alloc::collections::BTreeMap;
use alloc::collections::{BTreeMap, BTreeSet};
use alloc::vec::Vec;
/// Try to evaluate an expression as a compile-time constant.
pub(in crate::languages::rego::compiler) fn try_eval_const(expr: &Expr) -> Option<Value> {
match expr {
Expr::Number { value, .. }
| Expr::String { value, .. }
| Expr::RawString { value, .. }
| Expr::Bool { value, .. }
| Expr::Null { value, .. } => Some(value.clone()),
Expr::UnaryExpr { expr, .. } => match expr.as_ref() {
Expr::Number {
value: Value::Number(n),
..
} => Some(Value::Number(n.neg()?)),
_ => None,
},
Expr::Array { items, .. } => items
.iter()
.map(|i| try_eval_const(i.as_ref()))
.collect::<Option<Vec<_>>>()
.map(|v| Value::Array(Rc::new(v))),
Expr::Set { items, .. } => items
.iter()
.map(|i| try_eval_const(i.as_ref()))
.collect::<Option<BTreeSet<_>>>()
.map(|s| Value::Set(Rc::new(s))),
Expr::Object { fields, .. } => fields
.iter()
.map(|(_, k, v)| Some((try_eval_const(k.as_ref())?, try_eval_const(v.as_ref())?)))
.collect::<Option<BTreeMap<_, _>>>()
.map(|m| Value::Object(Rc::new(m))),
_ => None,
}
}
impl<'a> Compiler<'a> {
pub(super) fn compile_array_literal(
&mut self,
items: &[ExprRef],
span: &Span,
) -> Result<Register> {
let all_const: Option<Vec<_>> = items.iter().map(|i| try_eval_const(i.as_ref())).collect();
if let Some(values) = all_const {
let dest = self.alloc_register();
let literal_idx = self.add_literal(Value::Array(Rc::new(values)));
self.emit_instruction(Instruction::Load { dest, literal_idx }, span);
return Ok(dest);
}
let mut element_registers = Vec::with_capacity(items.len());
for item in items {
let item_reg = self.compile_rego_expr_with_span(item, item.span(), false)?;
@@ -45,6 +87,15 @@ impl<'a> Compiler<'a> {
items: &[ExprRef],
span: &Span,
) -> Result<Register> {
let all_const: Option<BTreeSet<_>> =
items.iter().map(|i| try_eval_const(i.as_ref())).collect();
if let Some(values) = all_const {
let dest = self.alloc_register();
let literal_idx = self.add_literal(Value::Set(Rc::new(values)));
self.emit_instruction(Instruction::Load { dest, literal_idx }, span);
return Ok(dest);
}
let mut element_registers = Vec::with_capacity(items.len());
for item in items {
let item_reg = self.compile_rego_expr_with_span(item, item.span(), false)?;
@@ -66,6 +117,17 @@ impl<'a> Compiler<'a> {
fields: &[(crate::lexer::Span, ExprRef, ExprRef)],
span: &Span,
) -> Result<Register> {
let all_const: Option<BTreeMap<_, _>> = fields
.iter()
.map(|(_, k, v)| Some((try_eval_const(k.as_ref())?, try_eval_const(v.as_ref())?)))
.collect();
if let Some(obj) = all_const {
let dest = self.alloc_register();
let literal_idx = self.add_literal(Value::Object(Rc::new(obj)));
self.emit_instruction(Instruction::Load { dest, literal_idx }, span);
return Ok(dest);
}
let dest = self.alloc_register();
let mut value_regs = Vec::with_capacity(fields.len());

6
src/languages/rego/compiler/mod.rs
View File

@@ -23,6 +23,7 @@ pub use error::{CompilerError, Result, SpannedCompilerError};
use crate::ast::ExprRef;
use crate::lexer::Span;
use crate::rvm::program::{Program, RuleType, SpanInfo};
use crate::value::Value;
use crate::CompiledPolicy;
use alloc::collections::{BTreeMap, BTreeSet};
use alloc::string::String;
@@ -120,6 +121,10 @@ pub struct Compiler<'a> {
rule_definitions: Vec<Vec<Vec<u32>>>,
rule_definition_function_params: Vec<Vec<Option<Vec<String>>>>,
rule_definition_destructuring_patterns: Vec<Vec<Option<u32>>>,
/// Per-rule, per-definition: the static value produced by this definition,
/// or `None` if the value is dynamic or differs across else-branches.
/// Used to compute `RuleInfo::early_exit_on_first_success`.
rule_definition_static_values: Vec<Vec<Option<Value>>>,
rule_types: Vec<RuleType>,
rule_function_param_count: Vec<Option<usize>>,
rule_result_registers: Vec<u8>,
@@ -153,6 +158,7 @@ impl<'a> Compiler<'a> {
rule_definitions: Vec::new(),
rule_definition_function_params: Vec::new(),
rule_definition_destructuring_patterns: Vec::new(),
rule_definition_static_values: Vec::new(),
rule_types: Vec::new(),
rule_function_param_count: Vec::new(),
rule_result_registers: Vec::new(),

32
src/languages/rego/compiler/program.rs
View File

@@ -99,6 +99,38 @@ impl<'a> Compiler<'a> {
};
rule_info.destructuring_blocks = destructuring_blocks;
// Compute early_exit_on_first_success: if every definition has
// the same static value, the VM can stop after the first success.
// Only relevant for Complete rules and function rules with ≥2 defs.
let static_values = self.rule_definition_static_values.get(rule_index as usize);
if let Some(svs) = static_values {
if svs.len() >= 2 {
// Check that all definitions have a known static value and
// that they are all equal.
let mut all_same = true;
let mut reference: Option<&Value> = None;
for sv in svs {
match sv {
Some(v) => match reference {
None => reference = Some(v),
Some(r) => {
if r != v {
all_same = false;
break;
}
}
},
None => {
all_same = false;
break;
}
}
}
rule_info.early_exit_on_first_success = all_same && reference.is_some();
}
}
rule_infos_map.insert(rule_index as usize, rule_info);
}

16
src/languages/rego/compiler/queries.rs
View File

@@ -242,21 +242,7 @@ impl<'a> Compiler<'a> {
compiler.compile_rego_expr_with_span(expr, expr.span(), false)
})?;
let negated_reg = self.alloc_register();
self.emit_instruction(
Instruction::Not {
dest: negated_reg,
operand: expr_reg,
},
&stmt.span,
);
self.emit_instruction(
Instruction::AssertCondition {
condition: negated_reg,
},
&stmt.span,
);
self.emit_instruction(Instruction::AssertNot { operand: expr_reg }, &stmt.span);
}
}
Ok(())

64
src/languages/rego/compiler/rules.rs
View File

@@ -11,7 +11,7 @@
)]
use super::{CompilationContext, Compiler, CompilerError, ContextType, Result, WorklistEntry};
use crate::ast::{Expr, Rule, RuleHead};
use crate::ast::{Expr, ExprRef, Rule, RuleHead};
use crate::compiler::destructuring_planner::plans::BindingPlan;
use crate::lexer::Span;
use crate::rvm::program::{Program, RuleType};
@@ -26,6 +26,16 @@ use alloc::sync::Arc;
use alloc::vec::Vec;
impl<'a> Compiler<'a> {
/// Extract a compile-time constant `Value` from an optional expression.
/// Returns `Some(Value::Bool(true))` for the implicit-true case (`expr_ref`
/// is `None`), delegates to `try_eval_const` for actual expressions.
fn static_value_of_expr(expr_ref: &Option<ExprRef>) -> Option<Value> {
match expr_ref {
None => Some(Value::Bool(true)),
Some(expr) => super::expressions::try_eval_const(expr.as_ref()),
}
}
pub(super) fn compute_rule_type(&self, rule_path: &str) -> Result<RuleType> {
let Some(definitions) = self.policy.inner.rules.get(rule_path) else {
return Err(CompilerError::General {
@@ -311,6 +321,10 @@ impl<'a> Compiler<'a> {
self.rule_definition_destructuring_patterns.push(Vec::new());
}
while self.rule_definition_static_values.len() <= rule_index as usize {
self.rule_definition_static_values.push(Vec::new());
}
let mut num_registers_used = 0;
let mut rule_param_count: Option<usize> = None;
@@ -525,6 +539,54 @@ impl<'a> Compiler<'a> {
self.pop_scope();
// Compute this definition's static value for early-exit analysis.
// A definition has a known static value if every body (including
// else-branches) would produce the same literal.
let def_static_value = if bodies.is_empty() {
// No bodies — value comes from the head's value_expr.
let head_value = self
.context_stack
.last()
.and_then(|ctx| ctx.value_expr.clone());
Self::static_value_of_expr(&head_value)
} else {
// Replay the same value_expr resolution as the body loop.
let head_value = self
.context_stack
.last()
.and_then(|ctx| ctx.value_expr.clone());
let mut consistent: Option<Value> = None;
let mut all_same = true;
for (bi, b) in bodies.iter().enumerate() {
let mut bve: Option<ExprRef> =
b.assign.as_ref().map(|a| a.value.clone());
if bve.is_none() && bi == 0 {
bve = head_value.clone();
}
match Self::static_value_of_expr(&bve) {
Some(v) => match &consistent {
None => consistent = Some(v),
Some(prev) => {
if *prev != v {
all_same = false;
break;
}
}
},
None => {
all_same = false;
break;
}
}
}
if all_same {
consistent
} else {
None
}
};
self.rule_definition_static_values[rule_index as usize].push(def_static_value);
self.rule_definitions[rule_index as usize].push(body_entry_points);
if self.register_counter > num_registers_used {

19
src/lib.rs
View File

@@ -176,6 +176,25 @@ pub use utils::limits::{
};
pub use value::Value;
/// Compiled-pattern caches for the `regex.*` and `glob.*` Rego builtins.
///
/// When the `cache` feature is enabled, compiled patterns are held in
/// bounded LRU caches so that repeated evaluations avoid recompilation.
///
/// # Examples
///
/// ```ignore
/// use regorus::cache;
///
/// cache::configure(cache::Config {
/// regex: 256,
/// glob: 128,
/// });
/// cache::clear();
/// ```
#[cfg(feature = "cache")]
pub mod cache;
#[cfg(feature = "arc")]
pub use alloc::sync::Arc as Rc;

6
src/rvm/instructions/display.rs
View File

@@ -242,6 +242,12 @@ impl core::fmt::Display for Instruction {
Instruction::Count { dest, collection } => {
format!("COUNT R({}) R({})", dest, collection)
}
Instruction::AssertEq { left, right } => {
format!("ASSERT_EQ R({}) R({})", left, right)
}
Instruction::AssertNot { operand } => {
format!("ASSERT_NOT R({})", operand)
}
Instruction::AssertCondition { condition } => {
format!("ASSERT_CONDITION R({})", condition)
}

13
src/rvm/instructions/mod.rs
View File

@@ -131,6 +131,8 @@ pub enum Instruction {
left: u8,
right: u8,
},
/// Rego negation - produces `true` if operand is `false` or undefined,
/// `false` for any other defined value (including non-booleans).
Not {
dest: u8,
operand: u8,
@@ -243,6 +245,17 @@ pub enum Instruction {
collection: u8,
},
/// Assert that two registers are equal - if either is undefined or they differ, fail the condition
AssertEq {
left: u8,
right: u8,
},
/// Assert negation - succeed if operand is false or undefined, fail if true
AssertNot {
operand: u8,
},
/// Assert condition - if register contains false or undefined, return undefined immediately
AssertCondition {
condition: u8,

2
src/rvm/program/core.rs
View File

@@ -85,7 +85,7 @@ pub struct Program {
impl Program {
/// Current serialization format version
pub const SERIALIZATION_VERSION: u32 = 4;
pub const SERIALIZATION_VERSION: u32 = 5;
/// Magic bytes to identify Regorus program files
pub const MAGIC: [u8; 4] = *b"REGO";
/// Maximum instructions supported (matches u16 jump targets)

23
src/rvm/program/listing.rs
View File

@@ -358,7 +358,10 @@ fn format_instruction_readable(
}
Instruction::Not { dest, operand } => {
let base = format!("{}Not r{} ← ¬r{}", indent, dest, operand);
let comment = format!("Logical NOT: !r{}", operand);
let comment = format!(
"Rego negation: true if r{} is false/undefined, false otherwise",
operand
);
align_comment(&base, &comment, config.comment_column)
}
Instruction::BuiltinCall { params_index } => {
@@ -575,6 +578,22 @@ fn format_instruction_readable(
let comment = format!("Get count/length of collection r{}", collection);
align_comment(&base, &comment, config.comment_column)
}
Instruction::AssertEq { left, right } => {
let base = format!("{}AssertEq assert r{} == r{}", indent, left, right);
let comment = format!(
"Assert r{} equals r{} (exit if unequal/undefined)",
left, right
);
align_comment(&base, &comment, config.comment_column)
}
Instruction::AssertNot { operand } => {
let base = format!("{}AssertNot assert !r{}", indent, operand);
let comment = format!(
"Assert r{} is false/undefined (exit if any defined truthy value)",
operand
);
align_comment(&base, &comment, config.comment_column)
}
Instruction::AssertCondition { condition } => {
let base = format!("{}Assert assert r{}", indent, condition);
let comment = format!("Assert r{} is true (exit if false/undefined)", condition);
@@ -899,6 +918,8 @@ const fn get_instruction_name(instruction: &Instruction) -> &'static str {
Instruction::SetCreate { .. } => "SET_CREATE",
Instruction::Contains { .. } => "CONTAINS",
Instruction::Count { .. } => "COUNT",
Instruction::AssertEq { .. } => "ASSERT_EQ",
Instruction::AssertNot { .. } => "ASSERT_NOT",
Instruction::AssertCondition { .. } => "ASSERT",
Instruction::AssertNotUndefined { .. } => "ASSERT_NOT_UNDEF",
Instruction::LoopStart { .. } => "LOOP_START",

4
src/rvm/program/serialization/binary.rs
View File

@@ -157,7 +157,7 @@ impl Program {
program.rego_v0 = Self::legacy_rego_v0(data, version).unwrap_or(false);
Ok(DeserializationResult::Partial(program))
}
4 => {
4 | 5 => {
if data.len() < 29 {
return Err("Data too short for header".to_string());
}
@@ -281,7 +281,7 @@ impl Program {
let version = Self::read_u32(data, 4).ok();
match version {
Some(1..=4) => Ok(true),
Some(1..=5) => Ok(true),
_ => Ok(false),
}
}

7
src/rvm/program/types.rs
View File

@@ -97,6 +97,11 @@ pub struct RuleInfo {
/// Optional destructuring block entry point per definition
/// Index: definition_index → Some(entry_point) | None
pub destructuring_blocks: Vec<Option<u32>>,
/// If true, all definitions are statically known to produce the same result
/// value, so the VM can stop after the first successful definition without
/// checking consistency with remaining definitions.
#[serde(default)]
pub early_exit_on_first_success: bool,
}
impl RuleInfo {
@@ -117,6 +122,7 @@ impl RuleInfo {
result_reg,
num_registers,
destructuring_blocks: alloc::vec![None; num_definitions],
early_exit_on_first_success: false,
}
}
@@ -143,6 +149,7 @@ impl RuleInfo {
result_reg,
num_registers,
destructuring_blocks: alloc::vec![None; num_definitions],
early_exit_on_first_success: false,
}
}

1
src/rvm/tests/vm.rs
View File

@@ -414,6 +414,7 @@ mod tests {
result_reg,
num_registers: 50, // Increased to accommodate test cases with higher register indices
destructuring_blocks,
early_exit_on_first_success: false,
};
program.rule_infos.push(rule_info);

53
src/rvm/vm/dispatch.rs
View File

@@ -26,7 +26,6 @@ impl RegoVM {
program: &Program,
instruction: Instruction,
) -> Result<InstructionOutcome> {
self.memory_check()?;
self.execute_load_and_move(program, instruction)
}
@@ -319,25 +318,32 @@ impl RegoVM {
Not { dest, operand } => {
let operand_value = self.get_register(operand)?;
if operand_value == &Value::Undefined {
// In Rego, `not expr` succeeds when `expr` has no results.
// When the operand evaluates to undefined we should treat it as
// a successful negation instead of propagating undefined.
self.set_register(dest, Value::Bool(true))?;
return Ok(InstructionOutcome::Continue);
}
if let Some(value) = self.to_bool(operand_value) {
self.set_register(dest, Value::Bool(!value))?;
Ok(InstructionOutcome::Continue)
} else {
Err(VmError::ArithmeticError {
message: alloc::format!(
"#undefined: logical NOT expects a boolean (operand={operand_value:?})"
),
pc: self.pc,
})
}
// In Rego, `not expr` succeeds when `expr` is undefined or false,
// and fails for any other defined value (including non-booleans like 42).
let negated = match *operand_value {
Value::Undefined => true,
Value::Bool(b) => !b,
_ => false,
};
self.set_register(dest, Value::Bool(negated))?;
Ok(InstructionOutcome::Continue)
}
AssertEq { left, right } => {
let a = self.get_register(left)?;
let b = self.get_register(right)?;
let passed = a != &Value::Undefined && b != &Value::Undefined && a == b;
self.handle_condition(passed)?;
Ok(InstructionOutcome::Continue)
}
AssertNot { operand } => {
let value = self.get_register(operand)?;
let passed = match *value {
Value::Undefined => true,
Value::Bool(b) => !b,
_ => false,
};
self.handle_condition(passed)?;
Ok(InstructionOutcome::Continue)
}
AssertCondition { condition } => {
let value = self.get_register(condition)?;
@@ -696,10 +702,9 @@ impl RegoVM {
Value::Array(ref array_items) => {
Value::Bool(array_items.contains(value_to_check))
}
Value::Object(ref object_fields) => Value::Bool(
object_fields.contains_key(value_to_check)
|| object_fields.values().any(|v| v == value_to_check),
),
Value::Object(ref object_fields) => {
Value::Bool(object_fields.values().any(|v| v == value_to_check))
}
_ => Value::Bool(false),
};

3
src/rvm/vm/execution.rs
View File

@@ -161,6 +161,7 @@ impl RegoVM {
self.reset_execution_state();
self.reset_execution_timer_state();
self.execution_state = ExecutionState::Running;
self.enforce_memory_check()?;
match self.jump_to(0_u32) {
Ok(value) => {
self.execution_state = ExecutionState::Completed {
@@ -179,6 +180,7 @@ impl RegoVM {
self.reset_execution_state();
self.reset_execution_timer_state();
self.execution_state = ExecutionState::Running;
self.enforce_memory_check()?;
match self.run_stackless_from(0) {
Ok(result) => Ok(result),
Err(err) => {
@@ -191,6 +193,7 @@ impl RegoVM {
fn execute_suspendable_entry(&mut self, entry_point_pc: usize) -> Result<Value> {
self.execution_state = ExecutionState::Running;
self.reset_execution_timer_state();
self.enforce_memory_check()?;
match self.run_stackless_from(entry_point_pc) {
Ok(result) => Ok(result),
Err(err) => {

25
src/rvm/vm/machine.rs
View File

@@ -390,7 +390,7 @@ impl RegoVM {
}
pub(super) fn execution_timer_tick(&mut self, work_units: u32) -> Result<()> {
if self.execution_timer.limit().is_none() {
if !self.execution_timer.accumulate(work_units) {
return Ok(());
}
@@ -399,7 +399,7 @@ impl RegoVM {
};
self.execution_timer
.tick(work_units, now)
.check_now(now)
.map_err(|err| match err {
LimitError::TimeLimitExceeded { elapsed, limit } => VmError::TimeLimitExceeded {
elapsed,
@@ -505,8 +505,8 @@ impl RegoVM {
}
#[cfg(all(feature = "allocator-memory-limits", not(miri)))]
pub(super) fn memory_check(&mut self) -> Result<()> {
limits::check_memory_limit_if_needed().map_err(|err| match err {
fn map_limit_error(&self, err: LimitError) -> VmError {
match err {
LimitError::MemoryLimitExceeded { usage, limit } => VmError::MemoryLimitExceeded {
usage,
limit,
@@ -516,7 +516,17 @@ impl RegoVM {
message: format!("unexpected limit error: {other}"),
pc: self.pc,
},
})
}
}
#[cfg(all(feature = "allocator-memory-limits", not(miri)))]
pub(super) fn memory_check(&mut self) -> Result<()> {
limits::check_memory_limit_if_needed().map_err(|err| self.map_limit_error(err))
}
#[cfg(all(feature = "allocator-memory-limits", not(miri)))]
pub(super) fn enforce_memory_check(&mut self) -> Result<()> {
limits::enforce_memory_limit().map_err(|err| self.map_limit_error(err))
}
#[cfg(any(miri, not(feature = "allocator-memory-limits")))]
@@ -524,6 +534,11 @@ impl RegoVM {
Ok(())
}
#[cfg(any(miri, not(feature = "allocator-memory-limits")))]
pub(super) fn enforce_memory_check(&mut self) -> Result<()> {
Ok(())
}
/// Get or create the cached dummy span for builtin calls.
pub(super) fn get_dummy_span(&mut self) -> Result<&crate::lexer::Span> {
if self.dummy_span.is_none() {

12
src/rvm/vm/rules.rs
View File

@@ -98,6 +98,11 @@ impl RegoVM {
}
} else {
first_successful_result = Some(current_result.clone());
// All definitions produce the same static value;
// no need to verify consistency with the rest.
if rule_info.early_exit_on_first_success {
break 'outer;
}
}
}
}
@@ -607,6 +612,13 @@ impl RegoVM {
}
} else {
frame_data.accumulated_result = Some(current_result);
// All definitions produce the same static value;
// skip remaining definitions.
if rule_info.early_exit_on_first_success {
frame_data.current_definition_index = frame_data.total_definitions;
frame_data.phase = RuleFramePhase::Finalizing;
return Ok(None);
}
}
}
}

66
src/utils/limits/time.rs
View File

@@ -247,6 +247,26 @@ impl ExecutionTimer {
self.last_elapsed
}
/// Increment work units and return whether a time check is due.
///
/// This method only updates the internal counter — it never reads a clock.
/// Callers should obtain the current time and call [`check_now`](Self::check_now)
/// only when this returns `true`.
pub const fn accumulate(&mut self, work_units: u32) -> bool {
let Some(config) = self.config else {
return false;
};
self.accumulated_units = self.accumulated_units.saturating_add(work_units);
if self.accumulated_units < config.check_interval.get() {
return false;
}
// Preserve the remainder so that callers do not lose fractional work.
let interval = config.check_interval.get();
self.accumulated_units %= interval;
true
}
/// Increment work units and run the periodic limit check when necessary.
pub fn tick(&mut self, work_units: u32, now: Duration) -> Result<(), LimitError> {
let Some(config) = self.config else {
@@ -471,4 +491,50 @@ mod tests {
let mut slot = super::TIME_SOURCE_OVERRIDE.lock();
*slot = previous;
}
#[test]
fn accumulate_defers_clock_reads() {
let mut timer = ExecutionTimer::new(Some(ExecutionTimerConfig {
limit: Duration::from_secs(1),
check_interval: nz(4),
}));
timer.start(Duration::from_millis(0));
// First 3 work units should not require a clock read.
for _ in 0..3 {
assert!(
!timer.accumulate(1),
"accumulate before interval must return false"
);
}
// The 4th unit crosses the interval — caller should read the clock now.
assert!(
timer.accumulate(1),
"accumulate at interval must return true"
);
// After the boundary, the counter resets — next 3 units are cheap again.
for _ in 0..3 {
assert!(
!timer.accumulate(1),
"accumulate after reset must return false"
);
}
assert!(
timer.accumulate(1),
"second interval crossing must return true"
);
}
#[test]
fn accumulate_returns_false_when_disabled() {
let mut timer = ExecutionTimer::new(None);
for _ in 0..10 {
assert!(
!timer.accumulate(1),
"disabled timer must never request a clock read"
);
}
}
}

343
tests/rvm/compiler.rs Normal file
View File

@@ -0,0 +1,343 @@
// Copyright (c) Microsoft Corporation.
// Licensed under the MIT License.
#![cfg(feature = "rvm")]
use regorus::languages::rego::compiler::Compiler;
use regorus::rvm::Instruction;
use regorus::{Engine, Rc, Value};
use std::collections::BTreeSet;
/// Compile a single-rule Rego module and return the program.
fn compile_rule(module: &str) -> std::sync::Arc<regorus::rvm::program::Program> {
let mut engine = Engine::new();
engine
.add_policy("test.rego".to_string(), module.to_string())
.expect("failed to add policy");
let compiled = engine
.compile_with_entrypoint(&Rc::from("data.test.p"))
.expect("failed to compile policy");
Compiler::compile_from_policy(&compiled, &["data.test.p"]).expect("failed to compile to RVM")
}
/// Assert that the program's instruction stream contains no collection-create
/// instructions (ArrayCreate, SetCreate, ObjectCreate), meaning the collections
/// were hoisted into the literal table.
fn assert_no_collection_create(program: &regorus::rvm::program::Program) {
for (pc, instr) in program.instructions.iter().enumerate() {
match instr {
Instruction::ArrayCreate { .. } => {
panic!("unexpected ArrayCreate at pc={pc}; expected hoisted constant")
}
Instruction::SetCreate { .. } => {
panic!("unexpected SetCreate at pc={pc}; expected hoisted constant")
}
Instruction::ObjectCreate { .. } => {
panic!("unexpected ObjectCreate at pc={pc}; expected hoisted constant")
}
_ => {}
}
}
}
/// Assert the literal table contains a value equal to `expected`.
fn assert_literal_exists(program: &regorus::rvm::program::Program, expected: &Value) {
assert!(
program.literals.iter().any(|v| v == expected),
"expected literal {:?} not found in literal table: {:?}",
expected,
program.literals
);
}
#[test]
fn constant_array_is_hoisted() {
let program = compile_rule(
r#"
package test
p := x if { x := [1, 2, 3] }
"#,
);
assert_no_collection_create(&program);
assert_literal_exists(&program, &Value::from_json_str("[1, 2, 3]").unwrap());
}
#[test]
fn constant_set_is_hoisted() {
let program = compile_rule(
r#"
package test
p := x if { x := {1, 2, 3} }
"#,
);
assert_no_collection_create(&program);
let expected_set = Value::Set(Rc::new(
[1, 2, 3]
.into_iter()
.map(Value::from)
.collect::<BTreeSet<_>>(),
));
assert_literal_exists(&program, &expected_set);
}
#[test]
fn constant_object_is_hoisted() {
let program = compile_rule(
r#"
package test
p := x if { x := {"a": 1, "b": 2} }
"#,
);
assert_no_collection_create(&program);
assert_literal_exists(
&program,
&Value::from_json_str(r#"{"a": 1, "b": 2}"#).unwrap(),
);
}
#[test]
fn nested_constant_collection_is_hoisted() {
let program = compile_rule(
r#"
package test
p := x if { x := [1, [2, 3], {"k": "v"}] }
"#,
);
assert_no_collection_create(&program);
assert_literal_exists(
&program,
&Value::from_json_str(r#"[1, [2, 3], {"k": "v"}]"#).unwrap(),
);
}
#[test]
fn non_constant_array_is_not_hoisted() {
let program = compile_rule(
r#"
package test
p := x if { y := 1; x := [y, 2, 3] }
"#,
);
// This array contains a variable reference, so it must NOT be hoisted.
let has_array_create = program
.instructions
.iter()
.any(|i| matches!(i, Instruction::ArrayCreate { .. }));
assert!(
has_array_create,
"non-constant array should use ArrayCreate"
);
}
// --- AssertEq fusion tests ---
/// Count occurrences of a specific instruction pattern in the program.
fn count_instructions(
program: &regorus::rvm::program::Program,
pred: impl Fn(&Instruction) -> bool,
) -> usize {
program.instructions.iter().filter(|i| pred(i)).count()
}
#[test]
fn equality_check_emits_assert_eq() {
// Assignment `x = 1` followed by `x = 1` triggers EqualityCheck in destructuring.
let program = compile_rule(
r#"
package test
p if { x = 1; x = 1 }
"#,
);
let assert_eq_count =
count_instructions(&program, |i| matches!(i, Instruction::AssertEq { .. }));
assert!(
assert_eq_count > 0,
"expected AssertEq instruction for equality check"
);
}
#[test]
fn destructuring_equality_emits_assert_eq() {
let program = compile_rule(
r#"
package test
p if { [1, x] := [1, 2] }
"#,
);
let assert_eq_count =
count_instructions(&program, |i| matches!(i, Instruction::AssertEq { .. }));
assert!(
assert_eq_count > 0,
"expected AssertEq for destructuring equality"
);
}
#[test]
fn not_expr_emits_assert_not() {
let program = compile_rule(
r#"
package test
p if { not false }
"#,
);
let assert_not_count =
count_instructions(&program, |i| matches!(i, Instruction::AssertNot { .. }));
assert!(
assert_not_count > 0,
"expected AssertNot for `not` expression"
);
// The Not+AssertCondition pair should be fused — no separate Not instruction.
let not_count = count_instructions(&program, |i| matches!(i, Instruction::Not { .. }));
assert_eq!(not_count, 0, "Not should be fused into AssertNot");
}
// --- B-11: early_exit_on_first_success flag tests ---
/// Find a RuleInfo by name suffix (e.g., "check" matches "data.test.check").
fn find_rule_info<'a>(
program: &'a regorus::rvm::program::Program,
name_suffix: &str,
) -> &'a regorus::rvm::program::RuleInfo {
program
.rule_infos
.iter()
.find(|ri| ri.name.ends_with(name_suffix))
.unwrap_or_else(|| panic!("no RuleInfo ending with '{name_suffix}'"))
}
#[test]
fn early_exit_set_for_implicit_true_multi_def() {
let program = compile_rule(
r#"
package test
p if { 1 == 1 }
p if { 2 == 2 }
"#,
);
let ri = find_rule_info(&program, ".p");
assert!(
ri.early_exit_on_first_success,
"two implicit-true defs should set early_exit_on_first_success"
);
}
#[test]
fn early_exit_set_for_same_literal_string() {
let program = compile_rule(
r#"
package test
p := "ok" if { 1 == 1 }
p := "ok" if { 2 == 2 }
"#,
);
let ri = find_rule_info(&program, ".p");
assert!(
ri.early_exit_on_first_success,
"two defs both returning \"ok\" should set early_exit_on_first_success"
);
}
#[test]
fn early_exit_not_set_for_different_literals() {
let program = compile_rule(
r#"
package test
p := "a" if { 1 == 1 }
p := "b" if { 2 == 2 }
"#,
);
let ri = find_rule_info(&program, ".p");
assert!(
!ri.early_exit_on_first_success,
"defs returning different literals must NOT set early_exit_on_first_success"
);
}
#[test]
fn early_exit_not_set_for_computed_values() {
let program = compile_rule(
r#"
package test
p := x if { x := 1 + 1 }
p := x if { x := 2 + 0 }
"#,
);
let ri = find_rule_info(&program, ".p");
assert!(
!ri.early_exit_on_first_success,
"computed expressions must NOT set early_exit_on_first_success"
);
}
#[test]
fn early_exit_not_set_for_single_definition() {
let program = compile_rule(
r#"
package test
p if { 1 == 1 }
"#,
);
let ri = find_rule_info(&program, ".p");
assert!(
!ri.early_exit_on_first_success,
"single definition should not set early_exit (only ≥2 defs)"
);
}
#[test]
fn early_exit_not_set_for_else_with_different_values() {
let program = compile_rule(
r#"
package test
p := "a" if { false } else := "b" if { true }
p := "a" if { true }
"#,
);
let ri = find_rule_info(&program, ".p");
assert!(
!ri.early_exit_on_first_success,
"else branches with different values must NOT set early_exit_on_first_success"
);
}
#[test]
fn early_exit_set_for_else_with_same_values() {
let program = compile_rule(
r#"
package test
p := "x" if { false } else := "x" if { true }
p := "x" if { true }
"#,
);
let ri = find_rule_info(&program, ".p");
assert!(
ri.early_exit_on_first_success,
"else branches all returning same literal should set early_exit_on_first_success"
);
}
#[test]
fn early_exit_set_for_implicit_true_function() {
let mut engine = Engine::new();
engine
.add_policy(
"test.rego".to_string(),
r#"
package test
check(x) if { x > 0 }
check(x) if { x < -10 }
p := check(5)
"#
.to_string(),
)
.expect("failed to add policy");
let compiled = engine
.compile_with_entrypoint(&Rc::from("data.test.p"))
.expect("failed to compile");
let program = Compiler::compile_from_policy(&compiled, &["data.test.p"])
.expect("failed to compile to RVM");
let ri = find_rule_info(&program, ".check");
assert!(
ri.early_exit_on_first_success,
"implicit-true function with 2 defs should set early_exit_on_first_success"
);
}

1
tests/rvm/mod.rs
View File

@@ -1,3 +1,4 @@
// Copyright (c) Microsoft Corporation.
// Licensed under the MIT License.
mod compiler;
mod rego;

283
tests/rvm/rego/cases/early_exit_same_value.yaml Normal file
View File

@@ -0,0 +1,283 @@
# B-11: Early exit for same-value multi-definition rules
#
# When all definitions of a Complete or function rule produce the same
# static value, the VM can stop after the first successful definition.
# These tests verify correctness: both that the optimization produces
# the right result and that edge cases (different values, else branches,
# computed expressions) remain correct.
cases:
# ── Implicit-true multi-def function rules ────────────────────────
- note: implicit_true_two_definitions_first_succeeds
description: Two implicit-true definitions; first succeeds → true
modules:
- |
package test
check(x) if { x > 0 }
check(x) if { x < -10 }
p := check(5)
query: data.test.p
want_result: true
- note: implicit_true_two_definitions_second_succeeds
description: Two implicit-true definitions; only second succeeds → true
modules:
- |
package test
check(x) if { x > 100 }
check(x) if { x < 0 }
p := check(-5)
query: data.test.p
want_result: true
- note: implicit_true_two_definitions_neither_succeeds
description: Two implicit-true definitions; neither succeeds → undefined
modules:
- |
package test
check(x) if { x > 100 }
check(x) if { x < -100 }
p := check(5)
query: data.test.p
want_result: "#undefined"
- note: implicit_true_four_definitions
description: Four implicit-true defs (like mountSource_ok); third succeeds
modules:
- |
package test
validate(x) if { x == "a" }
validate(x) if { x == "b" }
validate(x) if { x == "c" }
validate(x) if { x == "d" }
p := validate("c")
query: data.test.p
want_result: true
- note: implicit_true_complete_rule_two_defs
description: Complete rule with two implicit-true defs
modules:
- |
package test
allowed if { input.role == "admin" }
allowed if { input.role == "superuser" }
p := allowed
input: {"role": "superuser"}
query: data.test.p
want_result: true
# ── Same literal value (non-true) across definitions ───────────────
- note: same_string_value_two_defs
description: Two defs returning same string constant
modules:
- |
package test
label(x) := "ok" if { x > 0 }
label(x) := "ok" if { x == 0 }
p := label(0)
query: data.test.p
want_result: "ok"
- note: same_number_value_two_defs
description: Two defs returning same numeric constant
modules:
- |
package test
code(x) := 42 if { x == "answer" }
code(x) := 42 if { x == "the answer" }
p := code("the answer")
query: data.test.p
want_result: 42
- note: same_bool_false_two_defs
description: Two defs returning explicit false
modules:
- |
package test
deny(x) := false if { x == "blocked" }
deny(x) := false if { x == "banned" }
p := deny("banned")
query: data.test.p
want_result: false
# ── Different values across definitions (NO early exit) ────────────
- note: different_string_values_first_succeeds
description: Two defs with different strings; first succeeds → its value
modules:
- |
package test
classify(x) := "positive" if { x > 0 }
classify(x) := "non-positive" if { x <= 0 }
p := classify(5)
query: data.test.p
want_result: "positive"
- note: different_string_values_second_succeeds
description: Two defs with different strings; second succeeds → its value
modules:
- |
package test
classify(x) := "positive" if { x > 0 }
classify(x) := "non-positive" if { x <= 0 }
p := classify(-3)
query: data.test.p
want_result: "non-positive"
# ── Else branches ──────────────────────────────────────────────────
- note: else_same_value_across_defs
description: Two defs, each with else, all branches return same value
modules:
- |
package test
result := "match" if {
input.x > 10
}
else := "match" if {
input.x > 5
}
result := "match" if {
input.y > 10
}
else := "match" if {
input.y > 5
}
p := result
input: {"x": 1, "y": 7}
query: data.test.p
want_result: "match"
- note: else_different_values_within_def
description: One def with else returning different value → no early exit
modules:
- |
package test
grade(x) := "A" if {
x >= 90
}
else := "B" if {
x >= 80
}
grade(x) := "C" if { x >= 70; x < 80 }
p := grade(85)
query: data.test.p
want_result: "B"
- note: else_different_values_within_def_second
description: Else chain where second definition fires
modules:
- |
package test
grade(x) := "A" if {
x >= 90
}
else := "B" if {
x >= 80
}
grade(x) := "C" if { x >= 70; x < 80 }
p := grade(75)
query: data.test.p
want_result: "C"
# ── Computed (non-literal) values → no early exit ──────────────────
- note: computed_value_two_defs
description: Defs with computed expressions → no early exit, still correct
modules:
- |
package test
double(x) := x * 2 if { x > 0 }
double(x) := x * 2 if { x < 0 }
p := double(-3)
query: data.test.p
want_result: -6
# ── Single definition (flag doesn't matter) ────────────────────────
- note: single_definition_implicit_true
description: Single implicit-true def — flag not set but works fine
modules:
- |
package test
ok(x) if { x > 0 }
p := ok(5)
query: data.test.p
want_result: true
# ── Mixed implicit-true and explicit-true ───────────────────────────
- note: mixed_implicit_and_explicit_true
description: One def has implicit true, another has explicit := true
modules:
- |
package test
valid(x) if { x > 0 }
valid(x) := true if { x == 0 }
p := valid(0)
query: data.test.p
want_result: true
# ── Default value interaction ──────────────────────────────────────
- note: implicit_true_with_default
description: Multi-def rule with default; no def succeeds → default
modules:
- |
package test
default allowed := false
allowed if { input.role == "admin" }
allowed if { input.role == "superuser" }
p := allowed
input: {"role": "viewer"}
query: data.test.p
want_result: false
- note: implicit_true_with_default_succeeds
description: Multi-def rule with default; one def succeeds → true
modules:
- |
package test
default allowed := false
allowed if { input.role == "admin" }
allowed if { input.role == "superuser" }
p := allowed
input: {"role": "admin"}
query: data.test.p
want_result: true
# ── Nested function calls with early exit ──────────────────────────
- note: nested_early_exit_functions
description: Outer function calls inner multi-def function
modules:
- |
package test
inner_ok(x) if { x == "a" }
inner_ok(x) if { x == "b" }
inner_ok(x) if { x == "c" }
outer(x, y) if {
inner_ok(x)
inner_ok(y)
}
p := outer("a", "c")
query: data.test.p
want_result: true
- note: nested_early_exit_functions_fail
description: Outer function calls inner multi-def function, inner fails
modules:
- |
package test
inner_ok(x) if { x == "a" }
inner_ok(x) if { x == "b" }
inner_ok(x) if { x == "c" }
outer(x, y) if {
inner_ok(x)
inner_ok(y)
}
p := outer("a", "d")
query: data.test.p
want_result: "#undefined"

18
tests/rvm/rego/cases/objects.yaml
View File

@@ -106,3 +106,21 @@ cases:
}
query: data.test.main
want_result: {"username": "alice123", "user_age": 25}
- note: object_membership_checks_values_not_keys
data: {}
modules:
- |
package test
main := "foo" in {"foo": "bar"}
query: data.test.main
want_result: false
- note: object_membership_finds_value
data: {}
modules:
- |
package test
main := "bar" in {"foo": "bar"}
query: data.test.main
want_result: true

6
tests/rvm/vm/suites/type_errors.yaml
View File

@@ -96,15 +96,15 @@ cases:
want_error: "#undefined"
- note: logical_not_int
description: NOT with int operand should error
example_rego: "!42"
description: NOT with non-boolean defined operand should yield false
example_rego: "not 42"
literals:
- 42
instructions:
- "Load { dest: 0, literal_idx: 0 }"
- "Not { dest: 1, operand: 0 }"
- "Return { value: 1 }"
want_error: "#undefined"
want_result: false
# Invalid indexing operations
- note: index_int_with_string_key