feat: Complete target system with C# bindings and resource inference (#458)

* feat: Add Schema Registry and Validation Framework This commit introduces a comprehensive schema registry and validation framework, providing schema-based validation of resources and policy effects. - Thread-safe, in-memory registry for schema storage and management - Global registry patterns for effects and resources - Concurrent access with proper error handling - Unicode schema names support - JSON Schema-compliant validation for all primitive types - Advanced constraint validation (patterns, ranges, length limits) - Discriminated union support with anyOf schemas - Detailed error reporting with nested validation paths - Discriminated subobject validation for polymorphic schemas - **Registry Tests**: All registry operations - **Effect Tests**: Policy effect validation - **Resource Tests**: Resource validation - **Validation Tests**: Core validation engine - Thread-safety, error handling, integration scenarios, edge cases - **Dependencies**: dashmap, once_cell, regex - **Thread Safety**: Minimal locking with Rc<Schema> sharing - **Error Types**: TypeMismatch, OutOfRange, PatternMismatch, etc. - Complete schema registry and validation subsystem - Comprehensive test coverage - Foundation for policy validation in Regorus Benchmarks: - Criterion benchmarks for basic types, effects and Azure resources - Performance range: 3.22ns (string) to 34.74µs (Azure VM resource schema validation) - String withs patterns validation: 30.2µs. Need to explore whether regex caching helps bring this down. - Azure policy effects: 188ns-1.4µs Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> * feat: Complete target system with C# bindings and resource inference - Add comprehensive target system with TargetRegistry and target-aware compilation - Implement resource type inference from policy equality expressions - Create modular C# bindings with separate wrapper classes for each concept - Add thread-safe CompiledPolicy with reference counting for safe disposal - Enhance FFI with detailed error propagation and target functionality - Create TargetExampleApp demonstrating Azure Policy integration - Add CI/CD pipeline testing for all C# applications - Support target definitions with schema validation and resource selectors - Implement PolicyModule struct and target-aware compilation methods - Add comprehensive test coverage for target functionality Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> --------- Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
2026-08-05 02:16:11 +00:00 · 2025-08-19 20:23:43 -05:00
parent 3c33d31d08
commit cc917ea75d
71 changed files with 10278 additions and 1000 deletions
@@ -0,0 +1,168 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+using System;
+using System.Text;
+using System.Text.Json;
+
+#nullable enable
+namespace Regorus
+{
+    /// <summary>
+    /// Represents a compiled Regorus policy that can be evaluated efficiently.
+    /// This class wraps a pre-compiled policy that can be evaluated multiple times
+    /// with different inputs without recompilation overhead.
+    /// 
+    /// This class manages unmanaged resources and should not be copied or cloned.
+    /// Each instance represents a unique native policy object.
+    /// 
+    /// Thread Safety: This class is thread-safe for all operations. Multiple threads
+    /// can safely call EvalWithInput() concurrently, and Dispose() will safely wait
+    /// for all active evaluations to complete before freeing resources. No external
+    /// synchronization is required.
+    /// </summary>
+    public unsafe sealed class CompiledPolicy : IDisposable
+    {
+        private Internal.RegorusCompiledPolicy* _policy;
+        private int _isDisposed;
+        private int _activeEvaluations;
+
+        internal CompiledPolicy(Internal.RegorusCompiledPolicy* policy)
+        {
+            _policy = policy;
+        }
+
+        /// <summary>
+        /// Evaluates the compiled policy with the given input.
+        /// For target policies, evaluates the target's effect rule.
+        /// For regular policies, evaluates the originally compiled rule.
+        /// </summary>
+        /// <param name="inputJson">JSON encoded input data (resource) to validate against the policy</param>
+        /// <returns>The evaluation result as JSON string</returns>
+        /// <exception cref="Exception">Thrown when policy evaluation fails</exception>
+        /// <exception cref="ObjectDisposedException">Thrown when the policy has been disposed</exception>
+        public string? EvalWithInput(string inputJson)
+        {
+            // Increment active evaluations count
+            System.Threading.Interlocked.Increment(ref _activeEvaluations);
+            try
+            {
+                ThrowIfDisposed();
+                
+                var inputBytes = Encoding.UTF8.GetBytes(inputJson + char.MinValue);
+                fixed (byte* inputPtr = inputBytes)
+                {
+                    return CheckAndDropResult(Internal.API.regorus_compiled_policy_eval_with_input(_policy, inputPtr));
+                }
+            }
+            finally
+            {
+                // Decrement active evaluations count
+                System.Threading.Interlocked.Decrement(ref _activeEvaluations);
+            }
+        }
+
+        /// <summary>
+        /// Gets information about the compiled policy including metadata about modules,
+        /// target configuration, and resource types.
+        /// </summary>
+        /// <returns>Policy information containing module IDs, target name, applicable resource types, entry point rule, and parameters</returns>
+        /// <exception cref="Exception">Thrown when getting policy info fails</exception>
+        /// <exception cref="ObjectDisposedException">Thrown when the policy has been disposed</exception>
+        public PolicyInfo GetPolicyInfo()
+        {
+            ThrowIfDisposed();
+            var jsonResult = CheckAndDropResult(Internal.API.regorus_compiled_policy_get_policy_info(_policy));
+            
+            if (string.IsNullOrEmpty(jsonResult))
+            {
+                throw new Exception("Failed to get policy info: empty response");
+            }
+
+            try
+            {
+                var options = new JsonSerializerOptions
+                {
+                    PropertyNameCaseInsensitive = true
+                };
+                
+                return JsonSerializer.Deserialize<PolicyInfo>(jsonResult!, options) 
+                    ?? throw new Exception("Failed to deserialize policy info");
+            }
+            catch (JsonException ex)
+            {
+                throw new Exception($"Failed to parse policy info JSON: {ex.Message}", ex);
+            }
+        }
+
+        public void Dispose()
+        {
+            Dispose(disposing: true);
+            GC.SuppressFinalize(this);
+        }
+
+        private void Dispose(bool disposing)
+        {
+            if (System.Threading.Interlocked.CompareExchange(ref _isDisposed, 1, 0) == 0)
+            {
+                if (_policy != null)
+                {
+                    // Wait for all active evaluations to complete
+                    while (System.Threading.Volatile.Read(ref _activeEvaluations) > 0)
+                    {
+                        System.Threading.Thread.Yield();
+                    }
+                    
+                    Internal.API.regorus_compiled_policy_drop(_policy);
+                    _policy = null;
+                }
+            }
+        }
+
+        ~CompiledPolicy() => Dispose(disposing: false);
+
+        private void ThrowIfDisposed()
+        {
+            if (_isDisposed != 0)
+                throw new ObjectDisposedException(nameof(CompiledPolicy));
+        }
+
+        private string? StringFromUTF8(IntPtr ptr)
+        {
+#if NETSTANDARD2_1
+            return System.Runtime.InteropServices.Marshal.PtrToStringUTF8(ptr);
+#else
+            int len = 0;
+            while (System.Runtime.InteropServices.Marshal.ReadByte(ptr, len) != 0) { ++len; }
+            byte[] buffer = new byte[len];
+            System.Runtime.InteropServices.Marshal.Copy(ptr, buffer, 0, buffer.Length);
+            return Encoding.UTF8.GetString(buffer);
+#endif
+        }
+
+        private string? CheckAndDropResult(Internal.RegorusResult result)
+        {
+            try
+            {
+                if (result.status != Internal.RegorusStatus.Ok)
+                {
+                    var message = StringFromUTF8((IntPtr)result.error_message);
+                    throw new Exception(message ?? "Unknown error occurred");
+                }
+
+                return result.data_type switch
+                {
+                    Internal.RegorusDataType.String => StringFromUTF8((IntPtr)result.output),
+                    Internal.RegorusDataType.Boolean => result.bool_value.ToString().ToLowerInvariant(),
+                    Internal.RegorusDataType.Integer => result.int_value.ToString(),
+                    Internal.RegorusDataType.None => null,
+                    _ => StringFromUTF8((IntPtr)result.output)
+                };
+            }
+            finally
+            {
+                Internal.API.regorus_result_drop(result);
+            }
+        }
+    }
+}