Default-only rules (e.g., `default deny := true` with no conditional body)
returned Undefined in the RVM instead of the default value.
Compiler:
- compute_rule_type: return Complete when rule exists only in default_rules map
- compile_worklist_rule: emit register slots and data-tree entries for
default-only rules (else branch)
VM:
- execute_call_rule_common + execute_call_rule_suspendable: check
default_literal_index before returning Undefined when definitions is empty
Tests:
- 3 new RVM cases (default_rules.yaml): bool, object, entry-point
- 3 new interpreter cases (default/basic.yaml): matching coverage
Co-authored-by: Mark Birger <markbirger@microsoft.com>
- Introduce ExecutionTimer/ExecutionTimerConfig to allow limiting evaluating time.
- To amortize time checking costs, checking interval can be configured via the notion of work units
- A global fallback time limit can be set to universally limit all evaluation in addition to engine level limit setting.
- Implement limnits in interpreter and RVM. In RVM, also handle suspend/resume so that time during pause is not counted.
- Add engine-level APIs to set/clear per-engine timer configuration and apply global fallback defaults.
- Surface execution-time limits through FFI and C# bindings
- Add C# tests and example usage to validate engine overrides, global fallback behavior, and compiled policy enforcement.
- Expand docs for execution-time limit
- Add interpreter YAML cases and VM unit tests for time-limit behavior and deterministic time sources.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
Handle imports that don't use the `as` clause to create a binding.
These imports are bound to the last identifier in the imported path.
Fix both interpreter and compiler.
Add tests.
fixes#541
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
- Supply chain: Use the popular num-bigint crate for handling large integers
- Optimization: Handle f64, i64, u64 directly. These will be the most common instances of a number.
OPA number semantics isn't clear.
https://github.com/open-policy-agent/opa/issues/6281
As part of this change, we update the following failing tests:
- A local test that relies on what 15.3/3 evaluates to.
With our current change, we round in a different direction than what OPA does, but consistent
with Rust. We produce 5.1000000000000005 where as the OPA test expects 5.1.
There is no clear definition in Rego of what the right answer is. Moreover, policies should not
rely on exact floating point value comparison. Therefore this deviations is justified.
The test is patched to pass.
- Another local vm test that exercised 1.1 + 2.2
- Another local vm test that exercises 5.5 - 2.2
- An OPA test that expects that a large integer number say 10e308 is printed in exponent notation.
num-bigint does not print using scientific notation and instead prints all the digits.
The benefit of preserving this compatibility is not clear. We skip this test.
- Doc tests that exercised handling floating point numbers with more than 15 (what f64 supports)
digits of precision. There is no usecase for this scenario. The tests are updated to reflect
the behavior.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
- add a dedicated `compiler/destructuring_planner` feature that precomputes binding plans for assignments, parameters, and `some in` expressions
- enrich `ScopeContext` with same-scope tracking, local scheduling hints, and module globals so the planner enforces := shadowing rules without blocking parent scopes
- wire the planner through compiler, hoist, interpreter, and engine paths while updating binding plan variants and adding query traversal helpers for dependency analysis
- document the new planner architecture and ship interpreter regressions that exercise nested destructuring, shadowing, and error reporting
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
Cryptographic builtins are removed due to various reasons like FIPS
compliance. Users needing crypto builtins are encouraged to use
extensions.
Deprecated functions are also removed.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
Add `or` operator to Rego languages. Available via `rego-extensions`
Cargo feature.
If the evaluated lhs value is not false, null or undefined it is returned.
Otherwise rhs is evaluated and returned.
or operator has least precedence, and is left-associative.
closes#314
A block with a single or expression needs to be treated as a comprehension instead of a
set/array with 1 item. e.g.: {1 | 1 }, [2 | foo]
Allow successfully parsing object comprehensions as rule body
x if { 1:2 | 1 }
fixes#306, fixes#307
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
Handle undefined values correctly in ordered-else. Previously an undefined value
in one of the blocks could cause the entire rule to evaluate to undefined.
Handle undefined values correctly in generic rule refs to prevent them from
propagating to output.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
In case of empty delimiter, Rust's split returns leading and trailing
empty strings whereas Golang's doesn't.
Change behavior to match Golang/OPA.
fixes#291
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
Earlier scheduler only recognized rules and would raise an
`unsafe var` error on alias.
Register alias var names to fix this.
fixes#284
Also fix clippy warning treated as error
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
If a rule is written to produce a constant value, then not all iterations of loops
within it need to be executed. Execution can stop via early return once the first iteration
that produces a value has been executed.
This brings forth the question : What if one of the subsequent iterations would have resulted
in an error?
e.g:
x {
[1, "hello"][_] + 1
}
Such errors are not raised; consistent with OPA.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
Second lookup of an object rule without fully qualified path, resulted
in returning the object instead of the requested field.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
Previously we used to rely on whether there was a value in the
data document for a given rule path. This approach cannot handle
the case of evaluating a.b when a.b.c has been evaluated but
a.b.d has not been evaluated. Upon evaluating a.b.c, the data document
will already have a value of a.b even though a.b.d has not yet
been evaluated.
Hence we need to keep track of evaluated rules separately.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
Allow `import input` instead of erroring out.
This import is redundant and has no effect.
Emit `print` messages to stderr onstead of stdout.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
Implement `import rego.v1`
https://www.openpolicyagent.org/docs/latest/policy-language/#the-regov1-import
- `if` required before rule body
- import rego.v1 automatically imports future.keywords
- handle import shadowing
- data, input cannot be shadowed
- deprecated functions as disallowed
- rules must have assignment or body
- `contains` required for parital set
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
- Separate out public, unstable and internal APIs.
- Cleanup README.md and include it as the crate documentation.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
- ignore worktrees
- feature guard time module
- Apply with modifiers before evaluating loop expressions
- Support value modifier for functions
- stubs for http.send and io.jwt.decode_verify
- Initialize with-document after initializing init data
- In case of conflict, with modifier override init-data values.
- In case of conflict, subsequent with modifier overrides earlier ones.
- Ensure that zero parameter functions are evaluated and added to document
- opa.runtime builtin
returns:
- git commit hash
- environment vars
- regorus features enabled
- builtins available
- deprecated builtins available
- If `sort_bindings` is specified, sort the bindings in OPA tests
- gather inputs, used vars and comprehensions in with modifiers
- For refs starting with `data`, ensure that modules are evaluated before looking up
value of the expression. Thie ensures that modules that have only been partly populated
(E.g via with mods) are completely evaluated before the value is looked up
- Mark rules overridden using with modifiers are evaluated.
- Exclude env vars in opa.runtime.
- Include regorus version in OPA runtime
- update to opa v0.60.0
- scheduler: Handle function refs in with modifers. Error out only if
a truly undefined ref.
- Handle undefined params, parameter expression evaluation errors before
applying with modifiers.
- When applying with modifiers, first determine whether the target is a
function. If so, handle cleanly.
- concat: raise error only in strict mode
- In strict mode, propagate errors raised by function rule execution
in case of multiple function definitions for same rule
- skip "withkeyword/builtin-builtin: arity 0" test which can never pass.
- When a mock has is being applied, clear with_function so that
other mocks won't be applied during the evaluation of the mock.
- Ability to specify strictness in tests
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
- object.union
- object.union_n
- treat negative integers as two separate tokens (Sub and Number)
when seen in arithmetic expressions
- Ensure that fully query string is parsed
- Evaluate queries in a separate module instead of the last read module.
This correctly handles queries of the form `x = data.test.y` where x is
already a ref in `data.test`
- Handle queries producing multiple outputs in test infrastructure
- Add tests for engine
- Add tests locking down valid queries
- Update opa.passing
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
- Remove unnecessary memory allocations
- Add --non-strict flag
- Ensure that only empty modules (ones without rules) are initialzed prior to evaluating rules.
- Record rule as entry for each of its prefixes.
For example, for a rule a.b.c =... in package test, record it in
rules["data.test.a"], rules["data.test.a.b"] and rules["data.test.a.b.c"]
This allows evaluating the correct list of rules based on expessions
a.b.c, a.b, a, data.test.a.b.c, data.test.a.b, data.test.a
Closes#69Closes#70
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
Number is implemented using rust_decimal::Decimal which uses a 96 bit mantissa.
TODO:
a) Support u64, i64 variants
b) Determine desired semantics for floating-point
c) Determine desired big integer length
d) Explore other big int/big float crates
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
This reduces std::mem::size_of::<Value>() to 16 bytes.
String values are also efficiently copied like Objects, arrays, sets etc.
When multiple function rules are evaluated, ensure that constant argument values
match before running the rule. If actual parameter does not match the constant parameter,
then the rule is skipped.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
- units.parse, units.parse_bytes
- json.is_valid, json.marshal, json.unmarshal
- yaml.is_valid, yaml.marshal, yaml.unmarshal
- object.subset
- set_diff
* Also print number of errors due to each missing function
* Also lock down fully passing OPA suites
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
