Fix RVM evaluation of default-only rules (#664)

Default-only rules (e.g., `default deny := true` with no conditional body)
returned Undefined in the RVM instead of the default value.

Compiler:
- compute_rule_type: return Complete when rule exists only in default_rules map
- compile_worklist_rule: emit register slots and data-tree entries for
  default-only rules (else branch)

VM:
- execute_call_rule_common + execute_call_rule_suspendable: check
  default_literal_index before returning Undefined when definitions is empty

Tests:
- 3 new RVM cases (default_rules.yaml): bool, object, entry-point
- 3 new interpreter cases (default/basic.yaml): matching coverage

Co-authored-by: Mark Birger <markbirger@microsoft.com>
This commit is contained in:
Mark Birger
2026-04-07 18:38:50 +02:00
committed by GitHub
parent e5ac9a2734
commit 83ce8c3580
4 changed files with 106 additions and 2 deletions
@@ -321,6 +321,37 @@ cases:
skip: true
want_result: [5]
- note: default_only_rule_bool
data: {}
modules:
- |
package test
default deny := true
query: data.test.deny
want_result: true
- note: default_only_rule_object
data: {}
modules:
- |
package test
default deny := {"result": false, "reasons": []}
query: data.test.deny
want_result:
result: false
reasons: []
- note: default_only_rule_with_package_query
data: {}
modules:
- |
package graph.mypolicy
default deny := {"result": false, "reasons": []}
query: data.graph.mypolicy.deny
want_result:
result: false
reasons: []
- note: valid-var-in-some-in-value
data: {}
modules: