Major changes:
- Implement the `net.cidr_contains` builtin
- Enable the v0 and v1 test for `net.cidr_contains`
- Add the `netip` crate to standardize CIDR searching and other
operations
Key Concept:
- Allow users to leverage the `net.cidr_contains` builtin to check
whether an IPv4 or IPv6 CIDR contains a specified IP address or
subnet.
Testing:
- All tests passing.
Signed-off-by: tjons <tylerschade99@gmail.com>
Cryptographic builtins are removed due to various reasons like FIPS
compliance. Users needing crypto builtins are encouraged to use
extensions.
Deprecated functions are also removed.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
Remove dependency on jsonwebtoken which brings in the ring crate.
Ring crate triggers governance violations.
Support for JWT will be implemented in future using a more governance
compliant crate.
BREAKING CHANGE
Prior to this PR, support for jwt builtins was minimially implemented.
Only io.jwt.decode and io.jwt.decode_verify was implemented.
With this PR, those builtins will no longer be available. They are
planned to be implemented in the future. In the meantime, they can be
brought back in via Engine::add_extension.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
Removed cryptographically insecure sha1. This existed only for OPA
compatibility.
Also exclude bindings from main workspace
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
A block with a single or expression needs to be treated as a comprehension instead of a
set/array with 1 item. e.g.: {1 | 1 }, [2 | foo]
Allow successfully parsing object comprehensions as rule body
x if { 1:2 | 1 }
fixes#306, fixes#307
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
* Add `time` to opa.passing. Disable WASM from rust.yml
Bindings will be tested using a separate workflow.
Also remove scripts that are no longer useful
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
* Remove alpha tag from version
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
---------
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
- parser: allow non-string index at any position; not just last
- impl Default for Context
- Fix width of OPA test results table
- Allow non string compoenent anywhere in rule ref; not just as last item.
- Normalize want_result before comparison.
- Ensure that object rules are created even if no definition succeed,
- Sort want_result values for "refheads/general, multiple result-set entries"
The entries are in reverse order of how OPA and regorus produce.
- Emit PASS status for each OPA testpoint
- Detect rule conflicts
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
- ignore worktrees
- feature guard time module
- Apply with modifiers before evaluating loop expressions
- Support value modifier for functions
- stubs for http.send and io.jwt.decode_verify
- Initialize with-document after initializing init data
- In case of conflict, with modifier override init-data values.
- In case of conflict, subsequent with modifier overrides earlier ones.
- Ensure that zero parameter functions are evaluated and added to document
- opa.runtime builtin
returns:
- git commit hash
- environment vars
- regorus features enabled
- builtins available
- deprecated builtins available
- If `sort_bindings` is specified, sort the bindings in OPA tests
- gather inputs, used vars and comprehensions in with modifiers
- For refs starting with `data`, ensure that modules are evaluated before looking up
value of the expression. Thie ensures that modules that have only been partly populated
(E.g via with mods) are completely evaluated before the value is looked up
- Mark rules overridden using with modifiers are evaluated.
- Exclude env vars in opa.runtime.
- Include regorus version in OPA runtime
- update to opa v0.60.0
- scheduler: Handle function refs in with modifers. Error out only if
a truly undefined ref.
- Handle undefined params, parameter expression evaluation errors before
applying with modifiers.
- When applying with modifiers, first determine whether the target is a
function. If so, handle cleanly.
- concat: raise error only in strict mode
- In strict mode, propagate errors raised by function rule execution
in case of multiple function definitions for same rule
- skip "withkeyword/builtin-builtin: arity 0" test which can never pass.
- When a mock has is being applied, clear with_function so that
other mocks won't be applied during the evaluation of the mock.
- Ability to specify strictness in tests
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
The walk builtin generates values and implicitly creates a loop over the values.
Hoist walk calls as loops and handle them. Also handle cases where return value
is bound to an extra parameter.
Closes#83
- Switch to scientific crate. Large values are printed in scientific notations.
Regular values are printed as u64, i64 or f64.
- Skip copying commit hooks in git worktrees
- urlquery.decode, urlquery.encode, urlquery.encode_object
- substring, indexof_n string builtins
- Make sprintf more OPA conformant
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
- object.union
- object.union_n
- treat negative integers as two separate tokens (Sub and Number)
when seen in arithmetic expressions
- Ensure that fully query string is parsed
- Evaluate queries in a separate module instead of the last read module.
This correctly handles queries of the form `x = data.test.y` where x is
already a ref in `data.test`
- Handle queries producing multiple outputs in test infrastructure
- Add tests for engine
- Add tests locking down valid queries
- Update opa.passing
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
- Remove unnecessary memory allocations
- Add --non-strict flag
- Ensure that only empty modules (ones without rules) are initialzed prior to evaluating rules.
- Record rule as entry for each of its prefixes.
For example, for a rule a.b.c =... in package test, record it in
rules["data.test.a"], rules["data.test.a.b"] and rules["data.test.a.b.c"]
This allows evaluating the correct list of rules based on expessions
a.b.c, a.b, a, data.test.a.b.c, data.test.a.b, data.test.a
Closes#69Closes#70
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
Number is implemented using rust_decimal::Decimal which uses a 96 bit mantissa.
TODO:
a) Support u64, i64 variants
b) Determine desired semantics for floating-point
c) Determine desired big integer length
d) Explore other big int/big float crates
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
- units.parse, units.parse_bytes
- json.is_valid, json.marshal, json.unmarshal
- yaml.is_valid, yaml.marshal, yaml.unmarshal
- object.subset
- set_diff
* Also print number of errors due to each missing function
* Also lock down fully passing OPA suites
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
