Commit Graph

35 Commits

Author SHA1 Message Date
Anand Krishnamoorthi
a8a3a9809b feat!: Use num-bigint for large numbers (#500)
- Supply chain: Use the popular num-bigint crate for handling large integers
- Optimization: Handle f64, i64, u64 directly. These will be the most common instances of a number.

OPA number semantics isn't clear.
https://github.com/open-policy-agent/opa/issues/6281

As part of this change, we update the following failing tests:
- A local test that relies on what 15.3/3 evaluates to.
 With our current change, we round in a different direction than what OPA does, but consistent
 with Rust. We produce 5.1000000000000005 where as the OPA test expects 5.1.
 There is no clear definition in Rego of what the right answer is. Moreover, policies should not
 rely on exact floating point value comparison. Therefore this deviations is justified.
 The test is patched to pass.
- Another local vm test that exercised 1.1 + 2.2
- Another local vm test that exercises 5.5 - 2.2
- An OPA test that expects that a large integer number say 10e308 is printed in exponent notation.
 num-bigint does not print using scientific notation and instead prints all the digits.
 The benefit of preserving this compatibility is not clear. We skip this test.
- Doc tests that exercised handling floating point numbers with more than 15 (what f64 supports)
  digits of precision. There is no usecase for this scenario. The tests are updated to reflect
  the behavior.

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
2025-12-01 13:25:02 -06:00
Anand Krishnamoorthi
1e4ff952e6 feat!: Introduce structured destructuring plans for bindings (#485)
- add a dedicated `compiler/destructuring_planner` feature that precomputes binding plans for assignments, parameters, and `some in` expressions
- enrich `ScopeContext` with same-scope tracking, local scheduling hints, and module globals so the planner enforces := shadowing rules without blocking parent scopes
- wire the planner through compiler, hoist, interpreter, and engine paths while updating binding plan variants and adding query traversal helpers for dependency analysis
- document the new planner architecture and ship interpreter regressions that exercise nested destructuring, shadowing, and error reporting

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
2025-10-21 15:57:49 -05:00
Anand Krishnamoorthi
cc917ea75d feat: Complete target system with C# bindings and resource inference (#458)
* feat: Add Schema Registry and Validation Framework

This commit introduces a comprehensive schema registry and validation framework, providing schema-based validation of resources and policy effects.

- Thread-safe, in-memory registry for schema storage and management
- Global registry patterns for effects and resources
- Concurrent access with proper error handling
- Unicode schema names support

- JSON Schema-compliant validation for all primitive types
- Advanced constraint validation (patterns, ranges, length limits)
- Discriminated union support with anyOf schemas
- Detailed error reporting with nested validation paths
- Discriminated subobject validation for polymorphic schemas

- **Registry Tests**: All registry operations
- **Effect Tests**: Policy effect validation
- **Resource Tests**: Resource validation
- **Validation Tests**: Core validation engine
- Thread-safety, error handling, integration scenarios, edge cases

- **Dependencies**: dashmap, once_cell, regex
- **Thread Safety**: Minimal locking with Rc<Schema> sharing
- **Error Types**: TypeMismatch, OutOfRange, PatternMismatch, etc.

- Complete schema registry and validation subsystem
- Comprehensive test coverage
- Foundation for policy validation in Regorus

Benchmarks:

- Criterion benchmarks for basic types, effects and Azure resources
- Performance range: 3.22ns (string) to 34.74µs (Azure VM resource schema validation)
- String withs patterns validation: 30.2µs. Need to explore whether regex caching helps
  bring this down.
- Azure policy effects: 188ns-1.4µs

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>

* feat: Complete target system with C# bindings and resource inference

- Add comprehensive target system with TargetRegistry and target-aware compilation
- Implement resource type inference from policy equality expressions
- Create modular C# bindings with separate wrapper classes for each concept
- Add thread-safe CompiledPolicy with reference counting for safe disposal
- Enhance FFI with detailed error propagation and target functionality
- Create TargetExampleApp demonstrating Azure Policy integration
- Add CI/CD pipeline testing for all C# applications
- Support target definitions with schema validation and resource selectors
- Implement PolicyModule struct and target-aware compilation methods
- Add comprehensive test coverage for target functionality

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>

---------

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
2025-08-19 20:23:43 -05:00
Anand Krishnamoorthi
f46ab5b697 fix!: Fix glob.match behavior in presence of : (#390)
glob.match("api://*/appId", null, "api://foo.com/appId") wasn't
being handled correctly. Switch to globset crate.

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
2025-04-09 11:11:57 -07:00
Sumedh Alok Sharma
8498274356 Add tests for builtin strings::lower method (#313)
Signed-off-by: Sumedh Alok Sharma <sumsharma@microsoft.com>
2024-09-11 09:15:28 -07:00
Sumedh Alok Sharma
ecd341bbcc Add tests for builtin strings::indexof method (#311)
Signed-off-by: Sumedh Alok Sharma <sumsharma@microsoft.com>
2024-09-11 09:14:21 -07:00
Anand Krishnamoorthi
a488a84969 fix: Match OPA behavior for split (#295)
In case of empty delimiter, Rust's split returns leading and trailing
empty strings whereas Golang's doesn't.
Change behavior to match Golang/OPA.

fixes #291

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
2024-08-08 14:53:01 -07:00
Anand Krishnamoorthi
3ac9b1121e Lockdown kata test prints as well as prints of various values (#249)
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
2024-05-23 08:30:41 -07:00
Burak
5717f9c249 Partially implement Go's time format (#130)
* Partially implement Go's time format

* Parse date only values

* Fix leap year handling in `time.diff`

* Disable failing test case
2024-02-07 15:12:34 -08:00
Burak
49bd657a41 Implement builtin time.parse_duration_ns method (#100)
* Implement builtin `time.parse_duration_ns` method

* Parse durations properly in `test.sleep` method
2024-01-08 02:21:35 -08:00
Burak
d2eb3ecd1f Implement most of the builtin time module (#82)
* Implement builtin `time.add_date` method

* Implement builtin `time.clock` method

* Implement builtin `time.date` method

* Implement builtin `time.diff` method

* Implement builtin `time.format` method

* Migrate `time.now_ns` to `chrono`

* Implement builtin `time.parse_ns` method

* Implement builtin `time.parse_rfc3339_ns` method

* Implement builtin `time.weekday` method

* Add conditional `test` module for OPA tests

* Cache result of `time.now_ns`

* Fail in strict mode if timestamp is outside of range

* Add `ensure_i32` util

* Move `diff_between_datetimes` into its own file and include appropriate license
2023-12-31 17:07:39 -08:00
Burak
ad3282caf4 Builtin UUID module (#68)
* Implement builtin `uuid.parse` method
* Implement builtin `uuid.rfc4122` method
* Parse timestamps for v2 UUIDs
2023-12-23 09:35:20 -08:00
Burak
1fb144b145 Add tests for builtin string::format_int method (#65) 2023-12-22 09:31:57 -08:00
Anand Krishnamoorthi
f6140b6be5 More builtins and semantic improvements (#66)
- base64 builtins
- base64url builtins
- jsonschema builtins
- json.remove builtin
- handle composite index variables
- use dashu_float since rust_decimal has lesser precision

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
2023-12-21 13:34:48 -08:00
Anand Krishnamoorthi
577e1aa8db More OPA conformance; in-progress: ability to trace interpreter (#63)
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
2023-12-16 17:50:59 -08:00
Anand Krishnamoorthi
ed3492fd7b Formalize concept of a Number (#55)
Number is implemented using rust_decimal::Decimal which uses a 96 bit mantissa.
TODO:
  a) Support u64, i64 variants
  b) Determine desired semantics for floating-point
  c) Determine desired big integer length
  d) Explore other big int/big float crates

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
2023-12-01 08:45:59 -08:00
Anand Krishnamoorthi
4db2270dcf More library functions (#51)
- units.parse, units.parse_bytes
- json.is_valid, json.marshal, json.unmarshal
- yaml.is_valid, yaml.marshal, yaml.unmarshal
- object.subset
- set_diff

* Also print number of errors due to each missing function
* Also lock down fully passing OPA suites

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
2023-11-22 14:19:23 -08:00
Luong-Minh Nguyen
e838d5af65 Added semver.is_valid and semver.compare (#49)
* Completed semver.is_valid and semver.compare
* Addressed PR comments

Signed-off-by: Minh Nguyen <luonguyen@microsoft.com>

---------

Signed-off-by: Minh Nguyen <luonguyen@microsoft.com>
Co-authored-by: Anand Krishnamoorthi <anakrish@microsoft.com>
2023-11-16 16:05:02 -08:00
Anand Krishnamoorthi
a1d0f8576a Allow with modifier for builtin and user functions (#42)
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
2023-11-12 21:39:59 -08:00
Anand Krishnamoorthi
800e594d52 Arity for builtins (#28)
Old-style function call

Utility for running opa yaml tests

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
2023-10-24 10:11:50 -07:00
eric-therond
e08d13df53 fix bitwise.and and add tests (#19)
Signed-off-by: eric-therond <eric.therond.fr@gmail.com>
2023-06-22 11:27:58 -07:00
Anand Krishnamoorthi
cba0af0d3f json.filter, object.filter, object.get, object.keys, object.remove
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
2023-03-07 21:27:27 +05:30
Anand Krishnamoorthi
3c3cd312fc More string functions
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
2023-03-01 22:13:09 +05:30
Anand Krishnamoorthi
27c5afd8ee strings: concat and contains
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
2023-03-01 22:13:09 +05:30
Anand Krishnamoorthi
89e26e37a2 string concat (WIP)
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
2023-03-01 22:13:09 +05:30
Anand Krishnamoorthi
31e1c63281 Tests for aggregates builtins
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
2023-02-28 09:38:40 +05:30
Anand Krishnamoorthi
6b87e99fb9 Tests for numbers builtins
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
2023-02-28 09:38:40 +05:30
Anand Krishnamoorthi
17257f9f1d Tests for arrays builtins
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
2023-02-28 09:38:40 +05:30
Anand Krishnamoorthi
c4ae2d4cc2 Tests for types functions
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
2023-02-28 09:38:40 +05:30
Anand Krishnamoorthi
12c3d26476 Lock down numbers
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
2023-02-28 09:38:40 +05:30
Anand Krishnamoorthi
a8a1d4b820 mod function
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
2023-02-28 09:38:40 +05:30
Anand Krishnamoorthi
b30fc2599c Builtin functions for numbers (WIP)
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
2023-02-28 09:38:40 +05:30
Anand Krishnamoorthi
53030c4ada Implement comparison operators. Formalize semantics.
Rename compare.rs to comparison.rs to match OPA documentation of builtins.

Also update loop handling to ensure that the current scope is restored after
each iteration of the loop so as to undo side effects of the iteration.

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
2023-02-12 22:19:16 -08:00
Ming-Wei Shih
c0972ad2ba Update license to MIT
Signed-off-by: Ming-Wei Shih <mishih@microsoft.com>
2023-02-09 19:40:35 +00:00
Anand Krishnamoorthi
cb0b3a1790 Code from github.com/anakrish/rego-rs
Authored by anakrish and mingweishih

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
2023-02-09 10:56:54 -08:00