Cryptographic builtins are removed due to various reasons like FIPS
compliance. Users needing crypto builtins are encouraged to use
extensions.
Deprecated functions are also removed.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
Add `or` operator to Rego languages. Available via `rego-extensions`
Cargo feature.
If the evaluated lhs value is not false, null or undefined it is returned.
Otherwise rhs is evaluated and returned.
or operator has least precedence, and is left-associative.
closes#314
Earlier scheduler only recognized rules and would raise an
`unsafe var` error on alias.
Register alias var names to fix this.
fixes#284
Also fix clippy warning treated as error
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
- Disable default features in dependencies
- Use anyhow::Error::msg to map errors. Note: anyhow will itself be removed later.
- lazy_static/spin_no_std used in no_std environments
- ensure_no_std binary is built to target thumbv7m-none-eabi to ensure that
there are no std dependencies. thumbv7m-none-eabi target has no std support.
- The opa-no-std feature enables only those Regorus features that work with no_std.
- Enable tests with no_std
- Update sizes of regorus binary in README.md
- Ensure that regorus example can be built with only std
- Ensure that regorus example can be built with no_std
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
- `std` feature is enabled by default
- By default enable #![no_std] compilation
- Import std create if `std` feature is enabled or if testing
- Use core, alloc types
- Make it clear where std types are being used
- In no std, use BTreeMap in place of HashMap.
HashMap is not available in no std due to lack of a
secure random number generator
Note: The project does not yet compile without std feature being specified.
But it's really close to being able to do so.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
- Replace std with alloc, core in most places in src
Tests, bindings aren't changed.
- Introduce BuiltinsMap type alias inplace of HashMap.
In no_std case, this could be aliases to BTreeMap
- Fix clippy warnings
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
* `arc` feature to make engine usable from multiple threads.
`arc` is turned on by default. When enabled, std::sync::Arc
will be used instead of std::rc::Rc. The former makes regorus
types like Engine, Value, ast nodes etc Send, allowing for
usability from multiple threads.
Arc would add a performance overhead though since the reference
counting will now become atomic.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
* Make engine and related types Debug
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
* Input, Data as json. Evaluate bool queries.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
---------
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
- Separate out public, unstable and internal APIs.
- Cleanup README.md and include it as the crate documentation.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
- ignore worktrees
- feature guard time module
- Apply with modifiers before evaluating loop expressions
- Support value modifier for functions
- stubs for http.send and io.jwt.decode_verify
- Initialize with-document after initializing init data
- In case of conflict, with modifier override init-data values.
- In case of conflict, subsequent with modifier overrides earlier ones.
- Ensure that zero parameter functions are evaluated and added to document
- opa.runtime builtin
returns:
- git commit hash
- environment vars
- regorus features enabled
- builtins available
- deprecated builtins available
- If `sort_bindings` is specified, sort the bindings in OPA tests
- gather inputs, used vars and comprehensions in with modifiers
- For refs starting with `data`, ensure that modules are evaluated before looking up
value of the expression. Thie ensures that modules that have only been partly populated
(E.g via with mods) are completely evaluated before the value is looked up
- Mark rules overridden using with modifiers are evaluated.
- Exclude env vars in opa.runtime.
- Include regorus version in OPA runtime
- update to opa v0.60.0
- scheduler: Handle function refs in with modifers. Error out only if
a truly undefined ref.
- Handle undefined params, parameter expression evaluation errors before
applying with modifiers.
- When applying with modifiers, first determine whether the target is a
function. If so, handle cleanly.
- concat: raise error only in strict mode
- In strict mode, propagate errors raised by function rule execution
in case of multiple function definitions for same rule
- skip "withkeyword/builtin-builtin: arity 0" test which can never pass.
- When a mock has is being applied, clear with_function so that
other mocks won't be applied during the evaluation of the mock.
- Ability to specify strictness in tests
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
- Remove unnecessary memory allocations
- Add --non-strict flag
- Ensure that only empty modules (ones without rules) are initialzed prior to evaluating rules.
- Record rule as entry for each of its prefixes.
For example, for a rule a.b.c =... in package test, record it in
rules["data.test.a"], rules["data.test.a.b"] and rules["data.test.a.b.c"]
This allows evaluating the correct list of rules based on expessions
a.b.c, a.b, a, data.test.a.b.c, data.test.a.b, data.test.a
Closes#69Closes#70
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
- units.parse, units.parse_bytes
- json.is_valid, json.marshal, json.unmarshal
- yaml.is_valid, yaml.marshal, yaml.unmarshal
- object.subset
- set_diff
* Also print number of errors due to each missing function
* Also lock down fully passing OPA suites
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
This allows holding onto objects, caching results etc easily.
However it does introduce the overhead of ref counting.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
1. Numeric indices will be converted to strings for refs beginning with `data`
if there is not valid numeric key
2. Error out if input document already contains value for a ref
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
1. Skip recording undefined variables
2. Parse `in` correctly if it is not imported.
3. base64.decode
4. Handle `with` modifier for qualified data and input.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
When evaluating rules, upon error the last pushed scope wasn't being
popped from the stack of scopes. This causes incorrect behavior
when there are multiple definitions for the same rule name.
The fix is to make sure that the scopes are popped manually upon encountering errors.
Once the interpreter logic is locked down, then we need to clean up scope management
using Drop functions so that the cleanup happens even during short circuited return.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
Anand Krishnamoorthi