cc917ea75d
feat: Complete target system with C# bindings and resource inference ( #458 )
...
* feat: Add Schema Registry and Validation Framework
This commit introduces a comprehensive schema registry and validation framework, providing schema-based validation of resources and policy effects.
- Thread-safe, in-memory registry for schema storage and management
- Global registry patterns for effects and resources
- Concurrent access with proper error handling
- Unicode schema names support
- JSON Schema-compliant validation for all primitive types
- Advanced constraint validation (patterns, ranges, length limits)
- Discriminated union support with anyOf schemas
- Detailed error reporting with nested validation paths
- Discriminated subobject validation for polymorphic schemas
- **Registry Tests**: All registry operations
- **Effect Tests**: Policy effect validation
- **Resource Tests**: Resource validation
- **Validation Tests**: Core validation engine
- Thread-safety, error handling, integration scenarios, edge cases
- **Dependencies**: dashmap, once_cell, regex
- **Thread Safety**: Minimal locking with Rc<Schema> sharing
- **Error Types**: TypeMismatch, OutOfRange, PatternMismatch, etc.
- Complete schema registry and validation subsystem
- Comprehensive test coverage
- Foundation for policy validation in Regorus
Benchmarks:
- Criterion benchmarks for basic types, effects and Azure resources
- Performance range: 3.22ns (string) to 34.74µs (Azure VM resource schema validation)
- String withs patterns validation: 30.2µs. Need to explore whether regex caching helps
bring this down.
- Azure policy effects: 188ns-1.4µs
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
* feat: Complete target system with C# bindings and resource inference
- Add comprehensive target system with TargetRegistry and target-aware compilation
- Implement resource type inference from policy equality expressions
- Create modular C# bindings with separate wrapper classes for each concept
- Add thread-safe CompiledPolicy with reference counting for safe disposal
- Enhance FFI with detailed error propagation and target functionality
- Create TargetExampleApp demonstrating Azure Policy integration
- Add CI/CD pipeline testing for all C# applications
- Support target definitions with schema validation and resource selectors
- Implement PolicyModule struct and target-aware compilation methods
- Add comprehensive test coverage for target functionality
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
---------
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2025-08-19 20:23:43 -05:00
db718654b5
feat: Add Schema Registry and Validation Framework ( #456 )
...
* feat: Add Schema Registry and Validation Framework
This commit introduces a comprehensive schema registry and validation framework, providing schema-based validation of resources and policy effects.
- Thread-safe, in-memory registry for schema storage and management
- Global registry patterns for effects and resources
- Concurrent access with proper error handling
- Unicode schema names support
- JSON Schema-compliant validation for all primitive types
- Advanced constraint validation (patterns, ranges, length limits)
- Discriminated union support with anyOf schemas
- Detailed error reporting with nested validation paths
- Discriminated subobject validation for polymorphic schemas
- **Registry Tests**: All registry operations
- **Effect Tests**: Policy effect validation
- **Resource Tests**: Resource validation
- **Validation Tests**: Core validation engine
- Thread-safety, error handling, integration scenarios, edge cases
- **Dependencies**: dashmap, once_cell, regex
- **Thread Safety**: Minimal locking with Rc<Schema> sharing
- **Error Types**: TypeMismatch, OutOfRange, PatternMismatch, etc.
- Complete schema registry and validation subsystem
- Comprehensive test coverage
- Foundation for policy validation in Regorus
Benchmarks:
- Criterion benchmarks for basic types, effects and Azure resources
- Performance range: 3.22ns (string) to 34.74µs (Azure VM resource schema validation)
- String withs patterns validation: 30.2µs. Need to explore whether regex caching helps
bring this down.
- Azure policy effects: 188ns-1.4µs
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
* Address PR feedback
- move error to a separate file
- use meaningful var names
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
* Refactor
- Reusable Registry struct
- Split and simplify tests
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
---------
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2025-08-14 15:59:30 -05:00
fc09802bfb
deps: Update dependencies across all Cargo.toml files and ignore .sln files ( #450 )
...
Dependencies updated:
- cc: 1.2.29 -> 1.2.31
- chrono-tz: 0.10.3 -> 0.10.4
- clap: 4.5.40 -> 4.5.42
- clap_builder: 4.5.40 -> 4.5.42
- clap_derive: 4.5.40 -> 4.5.41
- phf: 0.11.3 -> 0.12.1
- phf_shared: 0.11.3 -> 0.12.1
- rand: 0.9.1 -> 0.9.2
- rb-sys: 0.9.116 -> 0.9.117
- rb-sys-build: 0.9.116 -> 0.9.117
- redox_syscall: 0.5.13 -> 0.5.17
- rustix: 1.0.7 -> 1.0.8
- serde_json: 1.0.140 -> 1.0.142
- windows-targets: 0.53.2 -> 0.53.3
- winnow: 0.7.11 -> 0.7.12
Removed obsolete build dependencies:
- chrono-tz-build, parse-zoneinfo, phf_codegen, phf_generator, rand_core
Updated in: main, ffi, java, python, ruby, and wasm bindings
Added *.sln to .gitignore to exclude Visual Studio solution files
Also fix python publishing pipeline by removing non-existent dependency.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2025-08-04 19:56:27 -05:00
9487defa20
chore: Regorus v0.5.0 release ( #432 )
...
Also update binding versions and lock files.
Note:
- Ruby binding is not updated
- C# binding is v0.7.0. We will make it match Regorus version later.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2025-07-08 16:40:06 -05:00
444b2970a1
feat!: Indexes for nodes in the AST ( #414 )
...
Indexes allow associating extra data with nodes in the AST
using an array and then quickly looking up the array to fetch
the extra data.
- Index eidx for expressions
- Index sidx for statements
- Index qidx for queries.
AST nodes are not cloneable. Therefore once a module is created,
it is not possible to accidentally create two nodes with the same
index inadvertently via clone.
Also added IndexChecker in debug builds. When a module is parsed,
it will assert that indexes have been constructed correctly.
AST Cleanup
- Make literal expressions (null, val, number, string etc) also structs
to match all other expressions
- Merge True and False nodes into a single Bool node.
Also update dependencies.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2025-06-20 15:09:07 -05:00
39f10326cc
build(deps): Update criterion and other deps ( #412 )
...
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2025-05-23 14:00:14 -05:00
130f9685fd
feat: Updates for Policy Framework ( #405 )
...
- Documentation
- Regorus Engine is intended to be used from a single thread
- Clone the engine after adding policies and data to use from another thread
- Builtin errors strictness:
- default to less strict for OPA compatibility
- Provide API to change strictness
- Expose GetAstAsJson to C#,
This can allow writing policy validations in C#.
- Use spectre mitigated msvc crt libs (binskim compliance)
- Update dependencies
fixes #404
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2025-04-30 15:33:40 -05:00
6719456468
build: Update dependencies ( #401 )
...
Also bump up C# package version
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2025-04-29 11:06:05 -05:00
9e43bd9878
fix!: Remove cryptographic builtins ( #396 )
...
Cryptographic builtins are removed due to various reasons like FIPS
compliance. Users needing crypto builtins are encouraged to use
extensions.
Deprecated functions are also removed.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2025-04-16 12:24:19 -07:00
f46ab5b697
fix!: Fix glob.match behavior in presence of : ( #390 )
...
glob.match("api://*/appId", null, "api://foo.com/appId") wasn't
being handled correctly. Switch to globset crate.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2025-04-09 11:11:57 -07:00
c28bde3f56
build: Check-in Cargo.lock files and lockdown .net ( #384 )
...
Use frozen and locked builds
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2025-03-31 07:55:47 -07:00
4f7b9a4292
fix!: Remove ring dependency ( #380 )
...
Remove dependency on jsonwebtoken which brings in the ring crate.
Ring crate triggers governance violations.
Support for JWT will be implemented in future using a more governance
compliant crate.
BREAKING CHANGE
Prior to this PR, support for jwt builtins was minimially implemented.
Only io.jwt.decode and io.jwt.decode_verify was implemented.
With this PR, those builtins will no longer be available. They are
planned to be implemented in the future. In the meantime, they can be
brought back in via Engine::add_extension.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2025-03-14 10:49:57 -07:00
4a2df93ae2
fix!: Remove sha1 dependency ( #379 )
...
Removed cryptographically insecure sha1. This existed only for OPA
compatibility.
Also exclude bindings from main workspace
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2025-03-13 12:34:11 -07:00
c963e477a3
feat: Update to OPA v1.2.0 ( #373 )
...
Regorus now defaults to rego v1. `import rego.v1` is no longer needed.
Additionally, `future` keywords are automatically imported.
See
https://www.openpolicyagent.org/docs/latest/v0-upgrade/#changes-to-rego-in-opa-v10
to understand the differences between rego v1 and v0.
BREAKING CHANGE:
v0 style policies will error out by default. To enable v0 behavior, call engine.set_rego_v0(true) before
loading policies.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2025-03-10 11:56:01 -07:00
a1777fb7d3
build(deps): update rand requirement from 0.8.5 to 0.9.0 ( #370 )
...
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2025-03-04 07:06:43 -08:00
6174af1781
Update dependencies ( #369 )
...
Specify `js` feature for `uuid` when building wasm by
specifying it as a non-optional dependency in wasm binding's Cargo.toml.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2025-03-03 15:53:47 -08:00
1bfe38f9af
fix: Lock wasm-bindgen version to 0.2.94 ( #342 )
...
v0.2.95 causes a crash with wasm tests in CI
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2024-11-06 12:04:59 -08:00
df73b20192
build(deps): update jsonschema requirement from 0.22.3 to 0.23.0 ( #331 )
2024-10-15 10:29:41 -07:00
20eece58ed
Update binding versions ( #287 )
...
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2024-07-28 12:32:39 +05:30
46e28b36f8
feat: get_policies: Way to obtain policy files and content ( #267 )
...
closes #254
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2024-06-19 00:01:55 -07:00
ee898e112e
Update binding versions for next release ( #270 )
...
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2024-06-18 23:39:12 -07:00
df98c8d168
Provide ability to get JSON representation of policy AST ( #266 )
...
closes #265
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2024-06-08 18:58:30 -07:00
97914d5596
Revert "chore: release v0.2.0 ( #257 )" ( #258 )
...
This reverts commit ffb79f1b30
2024-05-30 06:09:47 -07:00
ffb79f1b30
chore: release v0.2.0 ( #257 )
...
v0.2.0
Signed-off-by: Anand Krishnamoorthi <35780660+anakrish@users.noreply.github.com >
---------
Signed-off-by: Anand Krishnamoorthi <35780660+anakrish@users.noreply.github.com >
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2024-05-30 05:45:43 -07:00
d09c445add
Update bindings to include newer APIs ( #250 )
...
- c, cpp
- csharp
- ffi
- go
- Java
- Python
- WASM
`arc` feature is turned on for all bindings
Use pretty string instead of colored string.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2024-05-25 10:24:06 -07:00
9894f00829
Fix bindings and add CI tests ( #247 )
...
Also update version numbers of binding Rust projects to match Regorus
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2024-05-22 08:15:42 -07:00
22260ac46f
Bindings for C, C#, Golang ( #124 )
...
* FFI bindings
Generate C FFI as well as C# FFI
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
* Regorus C binding
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
* C# binding
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
* Golang binding
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
---------
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2024-02-04 19:50:44 -08:00
1ab27b253b
chore: release ( #121 )
...
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2024-02-01 16:16:33 -08:00
761d11ef48
Document bindings ( #119 )
...
* Instructions for WASM/JS binding
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
* Document Python, WASM/JS bindings
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
---------
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2024-02-01 13:47:27 -08:00
8ca863c661
Python bindings ( #115 )
...
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2024-01-28 14:39:59 -08:00
055bdd295f
WASM binding ( #114 )
...
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2024-01-27 22:14:29 -08:00
Anand Krishnamoorthi