chore: release (#137)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

.devcontainer/devcontainer.json

@@ -0,0 +1,35 @@
+// For format details, see https://aka.ms/devcontainer.json. For config options, see the
+// README at: https://github.com/devcontainers/templates/tree/main/src/rust
+{
+	"name": "Rust",
+	// Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile
+	"image": "mcr.microsoft.com/devcontainers/rust:1-1-bullseye",
+	"features": {
+		"ghcr.io/devcontainers/features/dotnet:2": {},
+		"ghcr.io/devcontainers/features/python:1": {}
+	}
+
+	// Use 'mounts' to make the cargo cache persistent in a Docker Volume.
+	// "mounts": [
+	// 	{
+	// 		"source": "devcontainer-cargo-cache-${devcontainerId}",
+	// 		"target": "/usr/local/cargo",
+	// 		"type": "volume"
+	// 	}
+	// ]
+
+	// Features to add to the dev container. More info: https://containers.dev/features.
+	// "features": {},
+
+	// Use 'forwardPorts' to make a list of ports inside the container available locally.
+	// "forwardPorts": [],
+
+	// Use 'postCreateCommand' to run commands after the container is created.
+	// "postCreateCommand": "rustc --version",
+
+	// Configure tool-specific properties.
+	// "customizations": {},
+
+	// Uncomment to connect as root instead. More info: https://aka.ms/dev-containers-non-root.
+	// "remoteUser": "root"
+}

.github/dependabot.yml

@@ -0,0 +1,11 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  - package-ecosystem: "cargo"
+    directory: "/" # Location of package manifests
+    schedule:
+      interval: "weekly"

.github/workflows/publish-python.yml

@@ -0,0 +1,114 @@
+# This file is autogenerated by maturin v1.4.0
+# To update, run
+#
+#    maturin generate-ci --manifest-path bindings/python/Cargo.toml github
+#
+name: publish-python
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  linux:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        target: [x86_64, x86, aarch64, armv7, s390x, ppc64le]
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-python@v4
+        with:
+          python-version: '3.10'
+      - name: Build wheels
+        uses: PyO3/maturin-action@v1
+        with:
+          target: ${{ matrix.target }}
+          args: --release --out dist --find-interpreter --manifest-path bindings/python/Cargo.toml
+          sccache: 'true'
+          manylinux: auto
+      - name: Upload wheels
+        uses: actions/upload-artifact@v3
+        with:
+          name: wheels
+          path: dist
+
+  windows:
+    runs-on: windows-latest
+    strategy:
+      matrix:
+        target: [x64, x86]
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-python@v4
+        with:
+          python-version: '3.10'
+          architecture: ${{ matrix.target }}
+      - name: Build wheels
+        uses: PyO3/maturin-action@v1
+        with:
+          target: ${{ matrix.target }}
+          args: --release --out dist --find-interpreter --manifest-path bindings/python/Cargo.toml
+          sccache: 'true'
+      - name: Upload wheels
+        uses: actions/upload-artifact@v3
+        with:
+          name: wheels
+          path: dist
+
+  macos:
+    runs-on: macos-latest
+    strategy:
+      matrix:
+        target: [x86_64, aarch64, universal2-apple-darwin]
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-python@v4
+        with:
+          python-version: '3.10'
+      - name: Build wheels
+        uses: PyO3/maturin-action@v1
+        with:
+          target: ${{ matrix.target }}
+          args: --release --out dist --find-interpreter --manifest-path bindings/python/Cargo.toml
+          sccache: 'true'
+      - name: Upload wheels
+        uses: actions/upload-artifact@v3
+        with:
+          name: wheels
+          path: dist
+
+  sdist:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Build sdist
+        uses: PyO3/maturin-action@v1
+        with:
+          command: sdist
+          args: --out dist --manifest-path bindings/python/Cargo.toml
+      - name: Upload sdist
+        uses: actions/upload-artifact@v3
+        with:
+          name: wheels
+          path: dist
+
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    # Commented out for initial release.
+    # if: "startsWith(github.ref, 'refs/tags/')"
+    needs: [linux, windows, macos, sdist]
+    steps:
+      - uses: actions/download-artifact@v3
+        with:
+          name: wheels
+      - name: Publish to PyPI
+        uses: PyO3/maturin-action@v1
+        env:
+          MATURIN_PYPI_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
+        with:
+          command: upload
+          args: --non-interactive --skip-existing *

.github/workflows/publish-wasm.yml

@@ -0,0 +1,32 @@
+name: publish-wasm
+
+permissions:
+  pull-requests: write
+  contents: write
+
+on: workflow_dispatch
+
+jobs:
+  publish-wasm:
+    name: publish
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      # Setup .npmrc file to publish to npm
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20.x'
+          registry-url: 'https://registry.npmjs.org'
+      - name: Install wasm-pack
+        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
+      - name: Build
+        run: wasm-pack build --target nodejs --release
+        working-directory: ./bindings/wasm
+      - name: Publish
+        run: wasm-pack publish --target nodejs
+        working-directory: ./bindings/wasm
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}

.github/workflows/release-plz.yml

@@ -4,10 +4,7 @@ permissions:
   pull-requests: write
   contents: write
 
-on:
-  push:
-    branches:
-      - main
+on: workflow_dispatch
 
 jobs:
   release-plz:
@@ -24,4 +21,4 @@ jobs:
         uses: MarcoIeni/release-plz-action@v0.5
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

.github/workflows/rust.yml

@@ -27,11 +27,21 @@ jobs:
     - name: Clippy
       run: cargo clippy --all-targets --no-deps -- -Dwarnings
     - name: Run tests
-      run: cargo test --verbose
+      run: cargo test -r --verbose
     - name: Build (MUSL)
       run: cargo build --verbose --all-targets --target x86_64-unknown-linux-musl
     - name: Run tests (MUSL)
-      run: cargo test --verbose --target x86_64-unknown-linux-musl
+      run: cargo test -r --verbose --target x86_64-unknown-linux-musl
+    - name: Run tests (ACI)
+      run: cargo test -r --test aci
     - name: Run tests (OPA Conformance)
       run: >-
-        cargo test --test opa -- $(tr '\n' ' ' < tests/opa.passing)
+        cargo test -r --test opa --features opa-testutil  -- $(tr '\n' ' ' < tests/opa.passing)
+
+    # - name: Install wasm-pack
+    #   run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
+
+    # - name: Run wasm binding tests
+    #   run: |
+    #     cd bindings/wasm
+    #     wasm-pack test --node -r

CHANGELOG.md

@@ -6,6 +6,136 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.0-alpha.3](https://github.com/microsoft/regorus/compare/regorus-v0.1.0-alpha.2...regorus-v0.1.0-alpha.3) - 2024-02-01
+
+### Fixed
+- fix bitwise.and and add tests ([#19](https://github.com/microsoft/regorus/pull/19))
+
+### Other
+- Document bindings ([#119](https://github.com/microsoft/regorus/pull/119))
+- Conform to OPA 0.61.0. ([#118](https://github.com/microsoft/regorus/pull/118))
+- Update publish-python.yml
+- Publish python packages ([#117](https://github.com/microsoft/regorus/pull/117))
+- Publish wasm ([#116](https://github.com/microsoft/regorus/pull/116))
+- Set working-directory for wasm-pack
+- Python bindings ([#115](https://github.com/microsoft/regorus/pull/115))
+- WASM binding ([#114](https://github.com/microsoft/regorus/pull/114))
+- release ([#112](https://github.com/microsoft/regorus/pull/112))
+- Improve crate documentation ([#111](https://github.com/microsoft/regorus/pull/111))
+- Try out manual trigger for release-plz ([#110](https://github.com/microsoft/regorus/pull/110))
+- - Document Location, Expression, QueryResult ([#109](https://github.com/microsoft/regorus/pull/109))
+- Update Cargo.toml ([#108](https://github.com/microsoft/regorus/pull/108))
+- Change version to `0.1.0-alpha.1` ([#107](https://github.com/microsoft/regorus/pull/107))
+- Add crate documentation ([#106](https://github.com/microsoft/regorus/pull/106))
+- Release preparation ([#105](https://github.com/microsoft/regorus/pull/105))
+- Update READEME.md with current status, grammar etc. ([#102](https://github.com/microsoft/regorus/pull/102))
+- Implement builtin `time.parse_duration_ns` method ([#100](https://github.com/microsoft/regorus/pull/100))
+- Implement import keyword ([#101](https://github.com/microsoft/regorus/pull/101))
+- OPA conformance: Pass refheads test suite ([#90](https://github.com/microsoft/regorus/pull/90))
+- OPA conformance: Ensure that `withkeyword` OPA tests pass ([#88](https://github.com/microsoft/regorus/pull/88))
+- Handle walk builtin as a loop expression ([#86](https://github.com/microsoft/regorus/pull/86))
+- Implement most of the builtin `time` module ([#82](https://github.com/microsoft/regorus/pull/82))
+- OPA Conformance
+- OPA conformance ([#81](https://github.com/microsoft/regorus/pull/81))
+- More OPA conformance ([#77](https://github.com/microsoft/regorus/pull/77))
+- OPA conformance ([#71](https://github.com/microsoft/regorus/pull/71))
+- Builtin UUID module ([#68](https://github.com/microsoft/regorus/pull/68))
+- Add tests for builtin `string::format_int` method ([#65](https://github.com/microsoft/regorus/pull/65))
+- More builtins and semantic improvements ([#66](https://github.com/microsoft/regorus/pull/66))
+- More OPA conformance; in-progress: ability to trace interpreter ([#63](https://github.com/microsoft/regorus/pull/63))
+- More OPA conformant semantics ([#62](https://github.com/microsoft/regorus/pull/62))
+- Updated readme. Added bundle support. ([#61](https://github.com/microsoft/regorus/pull/61))
+- crypto builtins ([#57](https://github.com/microsoft/regorus/pull/57))
+- Regex and Glob builtins ([#56](https://github.com/microsoft/regorus/pull/56))
+- Formalize concept of a Number ([#55](https://github.com/microsoft/regorus/pull/55))
+- Lock down ACI tests and more OPA test folders ([#54](https://github.com/microsoft/regorus/pull/54))
+- Fix scheduling regression ([#53](https://github.com/microsoft/regorus/pull/53))
+- add full api to engine ([#50](https://github.com/microsoft/regorus/pull/50))
+- Use Rc<str> instead of string. ([#52](https://github.com/microsoft/regorus/pull/52))
+- More library functions ([#51](https://github.com/microsoft/regorus/pull/51))
+- Added semver.is_valid and semver.compare ([#49](https://github.com/microsoft/regorus/pull/49))
+- OPA conformance tests ([#45](https://github.com/microsoft/regorus/pull/45))
+- Avoid dependency on `source lifetime. ([#43](https://github.com/microsoft/regorus/pull/43))
+- Allow with modifier for builtin and user functions ([#42](https://github.com/microsoft/regorus/pull/42))
+- Special cases of refs to data ([#41](https://github.com/microsoft/regorus/pull/41))
+- Fix scheduling statements that don't create bindings ([#40](https://github.com/microsoft/regorus/pull/40))
+- Ability to run the OPA testsuite ([#39](https://github.com/microsoft/regorus/pull/39))
+- Engine ([#38](https://github.com/microsoft/regorus/pull/38))
+- Use Ref for storing ast nodes in collections. ([#37](https://github.com/microsoft/regorus/pull/37))
+- all, any deprecated functions ([#35](https://github.com/microsoft/regorus/pull/35))
+- all, any deprecated functions ([#34](https://github.com/microsoft/regorus/pull/34))
+- Improvements ([#33](https://github.com/microsoft/regorus/pull/33))
+- Order query expression results ([#32](https://github.com/microsoft/regorus/pull/32))
+- Scheduling of statements in user queries ([#31](https://github.com/microsoft/regorus/pull/31))
+- eval, lex, parse commands ([#30](https://github.com/microsoft/regorus/pull/30))
+- eval_user_query for OPA style results ([#29](https://github.com/microsoft/regorus/pull/29))
+- Arity for builtins ([#28](https://github.com/microsoft/regorus/pull/28))
+- Handle chained _ ([#27](https://github.com/microsoft/regorus/pull/27))
+- Minimize PR 22  ([#26](https://github.com/microsoft/regorus/pull/26))
+- improve errors location ([#23](https://github.com/microsoft/regorus/pull/23))
+- Fix clippy warning ([#25](https://github.com/microsoft/regorus/pull/25))
+- negation of an undefined value should return true ([#21](https://github.com/microsoft/regorus/pull/21))
+- Ensure that scopes are cleaned up correctly upon error. ([#20](https://github.com/microsoft/regorus/pull/20))
+- support of or-functions ([#18](https://github.com/microsoft/regorus/pull/18))
+- Statement Scheduler Implementation
+- Remove unnecessary lifetime
+- json.filter, object.filter, object.get, object.keys, object.remove
+- :to_number builtin
+- :trace builtin
+- bitwise builtins
+- :print builtin
+- Partial sprintf implementation.
+- All string functions except sprintf. TODO: Add tests
+- More string functions without tests
+- More string functions
+- concat and contains
+- string concat (WIP)
+- Support build on non Linux platforms
+- Prepare for upstreaming
+- Test for multi-assign
+- Support dependencies between vars defined in same statement
+- Statement scheduler (WIP)
+- Print small-form table of files without 100% coverage.
+- Code tweaks to improve coverage
+- Tests for aggregates builtins
+- Tests for numbers builtins
+- Tests for arrays builtins
+- Tests for types functions
+- Destructuring of arrays and objects in some-in expressions
+- `some .. in` implementation
+- Fix key, value in membership and some-in
+- refactor
+- Arrays and Aggregates
+- Implement `every` statement ([#4](https://github.com/microsoft/regorus/pull/4))
+- Set loop index variable if not "_" ([#3](https://github.com/microsoft/regorus/pull/3))
+- Allow comprehensions in default value. ([#2](https://github.com/microsoft/regorus/pull/2))
+- Lock down numbers
+- mod function
+- Builtin functions for numbers (WIP)
+- Implement comparison operators. Formalize semantics.
+- Rework assign operations ([#6](https://github.com/microsoft/regorus/pull/6))
+- Locked down supported values in default rule.
+- Improvements to github workflow ([#4](https://github.com/microsoft/regorus/pull/4))
+- Update name to regorus
+- Update rust.yml
+- Add simple git action
+- Add missing config.toml
+- Update license to MIT
+- Code from github.com/anakrish/rego-rs
+- SUPPORT.md committed
+- SECURITY.md committed
+- README.md committed
+- LICENSE committed
+- CODE_OF_CONDUCT.md committed
+- Initial commit
+
+## [0.1.0-alpha.2](https://github.com/microsoft/regorus/compare/v0.1.0-alpha.1...v0.1.0-alpha.2) - 2024-01-19
+
+### Other
+- Improve crate documentation ([#111](https://github.com/microsoft/regorus/pull/111))
+- Try out manual trigger for release-plz ([#110](https://github.com/microsoft/regorus/pull/110))
+- - Document Location, Expression, QueryResult ([#109](https://github.com/microsoft/regorus/pull/109))
+
 ## [0.1.0-alpha.1](https://github.com/microsoft/regorus/releases/tag/v0.1.0-alpha.1) - 2024-01-15
 
 ### Fixed

Cargo.toml

@@ -1,7 +1,15 @@
+[workspace]
+
+members = [
+    "bindings/ffi",
+    "bindings/python",
+    "bindings/wasm"
+]
+
 [package]
 name = "regorus"
 description = "A fast, lightweight Rego (OPA policy language) interpreter"
-version = "0.1.0-alpha.1"
+version = "0.1.0"
 edition = "2021"
 license-file = "LICENSE"
 repository = "https://github.com/microsoft/regorus"
@@ -58,7 +66,7 @@ serde = {version = "1.0.150", features = ["derive", "rc"] }
 serde_json = {version = "1.0.89", features = ["arbitrary_precision"] }
 serde_yaml = {version = "0.9.16", optional = true }
 log = "0.4.17"
-env_logger="0.10.0"
+env_logger="0.11.1"
 lazy_static = "1.4.0"
 rand = "0.8.5"
 num = "0.4.1"

README.md

@@ -2,10 +2,26 @@
 
 **Regorus** is
 
-  - *Rego*-*Rus(t)*  - A fast, light-weight [Rego](https://www.openpolicyagent.org/docs/latest/policy-language/) interpreter written in Rust.
+  - *Rego*-*Rus(t)*  - A fast, light-weight [Rego](https://www.openpolicyagent.org/docs/latest/policy-language/)
+   interpreter written in Rust.
   - *Rigorous* - A rigorous enforcer of well-defined Rego semantics.
 
+Regorus is also
+  - *cross-platform* - Written in platform-agnostic Rust.
+  - *current* - We strive to keep Regorus up to date with latest OPA release. Regorus supports `import rego.v1`.
+  - *compliant* - Regorus is mostly compliant with the latest [OPA release v0.61.0](https://github.com/open-policy-agent/opa/releases/tag/v0.61.0). See [OPA Conformance](#opa-conformance) for details. Note that while we behaviorally produce the same results, we don't yet support all the builtins.
+  - *extensible* - Extend the Rego language by implementing custom stateful builtins in Rust.
+    See [add_extension](https://github.com/microsoft/regorus/blob/fc68bf9c8bea36427dae9401a7d1f6ada771f7ab/src/engine.rs#L352).
+    Support for extensibility using other languages coming soon.
+  - *polyglot* - In addition to Rust, Regorus can be used from *C*, *C++*, *C#*, *Golang*, *Javascript* and *Python*.
+    This is made possible by the excellent FFI tools available in the Rust ecosystem. See [bindings](#bindings) for information on how to use Regorus from different languages.
+
+    To try out a *Javascript(WASM)* compiled version of Regorus from your browser, visit [Regorus Playground](https://anakrish.github.io/regorus-playground/).
+
+
+
 Regorus is available as a library that can be easily integrated into your Rust projects.
+Here is an example of evaluating a simple Rego policy:
 
 ```rust
 use anyhow::Result;
@@ -21,11 +37,11 @@ fn main() -> Result<()> {
     // Filename to be associated with the policy.
     "hello.rego".to_string(),
 
-	// Rego policy that just sets a message.
-	r#"
-	   package test
-	   message = "Hello, World!"
-	"#.to_string()
+    // Rego policy that just sets a message.
+    r#"
+       package test
+       message = "Hello, World!"
+    "#.to_string()
   )?;
 
   // Evaluate the policy, fetch the message and print it.
@@ -36,12 +52,51 @@ fn main() -> Result<()> {
 }
 ```
 
-Regorus passes the [OPA v0.60.0 test-suite](https://www.openpolicyagent.org/docs/latest/ir/#test-suite) barring a few builtins.
-See [OPA Conformance](#opa-conformance) below.
+Regorus is designed with [Confidential Computing](https://confidentialcomputing.io/about/) in mind. In Confidential Computing environments,
+it is important to be able to control exactly what is being run. Regorus allows enabling and disabling various components using cargo
+features. By default all features are enabled.
+
+The default build of regorus example program is 6.4M:
+```bash
+$ cargo build -r --example regorus; strip target/release/examples/regorus; ls -lh target/release/examples/regorus
+-rwxr-xr-x  1 anand  staff   6.4M Jan 19 11:23 target/release/examples/regorus*
+```
+
+
+When all features except for `yaml` are disabled, the binary size drops down to 2.9M.
+```bash
+$ cargo build -r --example regorus --features "yaml" --no-default-features; strip target/release/examples/regorus; ls -lh target/release/examples/regorus
+-rwxr-xr-x  1 anand  staff   2.9M Jan 19 11:26 target/release/examples/regorus*
+```
+
+Regorus passes the [OPA v0.61.0 test-suite](https://www.openpolicyagent.org/docs/latest/ir/#test-suite) barring a few
+builtins. See [OPA Conformance](#opa-conformance) below.
+
+## Bindings
+
+Regorus can be used from a variety of languages:
+
+- *C*: C binding is generated using [cbindgen](https://github.com/mozilla/cbindgen).
+  [corrosion-rs](https://github.com/corrosion-rs/corrosion) can be used to seamlessly use Regorous
+   in your CMake based projects. See [bindings/c](https://github.com/microsoft/regorus/tree/main/bindings/c).
+- *C++*: C++ binding is generated using [cbindgen](https://github.com/mozilla/cbindgen).
+  [corrosion-rs](https://github.com/corrosion-rs/corrosion) can be used to seamlessly use Regorous
+   in your CMake based projects. See [bindings/cpp](https://github.com/microsoft/regorus/tree/main/bindings/cpp).
+- *C#*: C# binding is generated using [csbindgen](https://github.com/Cysharp/csbindgen). See [bindings/csharp](https://github.com/microsoft/regorus/tree/main/bindings/csharp) for an example of how to build and use Regorus in your C# projects.
+- *Golang*: The C bindings are exposed to Golang via [CGo](https://pkg.go.dev/cmd/cgo). See [bindings/go](https://github.com/microsoft/regorus/tree/main/bindings/go) for an example of how to build and use Regorus in your Go projects.
+- *Python*: Python bindings are generated using [pyo3](https://github.com/PyO3/pyo3). Wheels are created using [maturin](https://github.com/PyO3/maturin). See [bindings/python](https://github.com/microsoft/regorus/tree/main/bindings/python).
+- *Javascript*: Regorus is compiled to WASM using [wasmpack](https://github.com/rustwasm/wasm-pack).
+  See [bindings/wasm](https://github.com/microsoft/regorus/tree/main/bindings/wasm) for an example of using Regorus from nodejs.
+  To try out a *Javascript(WASM)* compiled version of Regorus from your browser, visit [Regorus Playground](https://anakrish.github.io/regorus-playground/).
+
+To avoid operational overhead, we currently don't publish these bindings to various repositories.
+It is straight-forward to build these bindings yourself.
+
 
 ## Getting Started
 
-[examples/regorus](https://github.com/microsoft/regorus/blob/main/examples/regorus.rs) is an example program that shows how to integrate Regorus into your project and evaluate Rego policies.
+[examples/regorus](https://github.com/microsoft/regorus/blob/main/examples/regorus.rs) is an example program that
+shows how to integrate Regorus into your project and evaluate Rego policies.
 
 To build and install it, do
 
@@ -94,7 +149,8 @@ This produces the following output
 }
 ```
 
-Next, evaluate a sample [policy](examples/example.rego) and [input](examples/input.json) (borrowed from [Rego tutorial](https://www.openpolicyagent.org/docs/latest/#2-try-opa-eval)):
+Next, evaluate a sample [policy](examples/example.rego) and [input](examples/input.json)
+(borrowed from [Rego tutorial](https://www.openpolicyagent.org/docs/latest/#2-try-opa-eval)):
 
 ```bash
 $ regorus eval -d examples/example.rego -i examples/input.json data.example
@@ -168,7 +224,7 @@ Benchmark 1: opa eval -b tests/aci -d tests/aci/data.json -i tests/aci/input.jso
 ```
 ## OPA Conformance
 
-Regorus has been verified to be compliant with [OPA v0.60.0](https://github.com/open-policy-agent/opa/releases/tag/v0.60.0)
+Regorus has been verified to be compliant with [OPA v0.61.0](https://github.com/open-policy-agent/opa/releases/tag/v0.61.0)
 using a [test driver](https://github.com/microsoft/regorus/blob/main/tests/opa.rs) that loads and runs the OPA testsuite using Regorus, and verifies that expected outputs
 are produced.
 
@@ -178,7 +234,8 @@ The test driver can be invoked by running:
 $ cargo test -r --test opa
 ```
 
-Currently, Regorus passes all the non-builtin specific tests. See [passing tests suites](https://github.com/microsoft/regorus/blob/main/tests/opa.passing).
+Currently, Regorus passes all the non-builtin specific tests.
+See [passing tests suites](https://github.com/microsoft/regorus/blob/main/tests/opa.passing).
 
 The following test suites don't pass fully due to mising builtins:
 - `cryptoparsersaprivatekeys`
@@ -212,14 +269,15 @@ The following test suites don't pass fully due to mising builtins:
 - `regometadatarule`
 - `regoparsemodule`
 - `rendertemplate`
-- `time`
 
 They are captured in the following [github issues](https://github.com/microsoft/regorus/issues?q=is%3Aopen+is%3Aissue+label%3Alib).
 
 
 ### Grammar
 
-The grammar used by Regorus to parse Rego policies is described in [grammar.md](https://github.com/microsoft/regorus/blob/main/docs/grammar.md) in both [W3C EBNF](https://www.w3.org/Notation.html) and [RailRoad Diagram](https://en.wikipedia.org/wiki/Syntax_diagram) formats.
+The grammar used by Regorus to parse Rego policies is described in [grammar.md](https://github.com/microsoft/regorus/blob/main/docs/grammar.md)
+in both [W3C EBNF](https://www.w3.org/Notation.html) and [RailRoad Diagram](https://en.wikipedia.org/wiki/Syntax_diagram) formats.
+
 
 ## Contributing
 

bindings/c/CMakeLists.txt

@@ -0,0 +1,27 @@
+# Copyright (c) Microsoft
+# Licensed under the MIT License.
+
+cmake_minimum_required(VERSION 3.12 FATAL_ERROR)
+include(FetchContent)
+
+FetchContent_Declare(
+    Corrosion
+    GIT_REPOSITORY https://github.com/corrosion-rs/corrosion.git
+    GIT_TAG v0.4 # Optionally specify a commit hash, version tag or branch here
+)
+FetchContent_MakeAvailable(Corrosion)
+
+project("regorus-test")
+
+corrosion_import_crate(
+  # Path to <regorus-source-folder>/bindings/ffi/Cargo.toml
+  MANIFEST_PATH "../ffi/Cargo.toml"
+  # Always build regorus in Release mode.
+  PROFILE "release"
+  # Only build the "regorusc" crate.
+  CRATES "regorus-ffi")
+
+add_executable(regorus_test main.c)
+# Add path to <regorus-source-folder>/bindings/ffi
+target_include_directories(regorus_test PRIVATE "../ffi")
+target_link_libraries(regorus_test regorus-ffi)

bindings/c/main.c

@@ -0,0 +1,55 @@
+#include <stdio.h>
+#include "regorus.h"
+
+int main() {
+    // Create engine.
+    RegorusEngine* engine = regorus_engine_new();
+    RegorusResult r;
+
+    // Load policies.
+    r = regorus_engine_add_policy_from_file(engine, "../../../tests/aci/framework.rego");
+    if (r.status != RegorusStatusOk)
+	goto error;
+    regorus_result_drop(r);
+
+    r = regorus_engine_add_policy_from_file(engine, "../../../tests/aci/api.rego");
+    if (r.status != RegorusStatusOk)
+	goto error;
+    regorus_result_drop(r);
+    
+    r = regorus_engine_add_policy_from_file(engine, "../../../tests/aci/policy.rego");
+    if (r.status != RegorusStatusOk)
+	goto error;
+    regorus_result_drop(r);
+
+    // Add data
+    r = regorus_engine_add_data_from_json_file(engine, "../../../tests/aci/data.json");
+    if (r.status != RegorusStatusOk)
+	goto error;
+    regorus_result_drop(r);
+
+    // Set input
+    r = regorus_engine_set_input_from_json_file(engine, "../../../tests/aci/input.json");
+    if (r.status != RegorusStatusOk)
+	goto error;
+    regorus_result_drop(r);
+
+    // Eval query
+    r = regorus_engine_eval_query(engine, "data.framework.mount_overlay=x");
+    if (r.status != RegorusStatusOk)
+	goto error;
+
+    // Print output
+    printf("%s", r.output);
+    regorus_result_drop(r);
+    
+    
+    // Free the engine.
+    regorus_engine_drop(engine);
+
+    return 0;
+error:
+    printf("%s", r.error_message);
+	
+    return 1;
+}

bindings/cpp/CMakeLists.txt

@@ -0,0 +1,28 @@
+# Copyright (c) Microsoft
+# Licensed under the MIT License.
+
+cmake_minimum_required(VERSION 3.12 FATAL_ERROR)
+include(FetchContent)
+
+FetchContent_Declare(
+    Corrosion
+    GIT_REPOSITORY https://github.com/corrosion-rs/corrosion.git
+    GIT_TAG v0.4 # Optionally specify a commit hash, version tag or branch here
+)
+FetchContent_MakeAvailable(Corrosion)
+
+project("regorus-test")
+set(CMAKE_CXX_STANDARD 17)
+
+corrosion_import_crate(
+  # Path to <regorus-source-folder>/bindings/ffi/Cargo.toml
+  MANIFEST_PATH "../ffi/Cargo.toml"
+  # Always build regorus in Release mode.
+  PROFILE "release"
+  # Only build the "regorusc" crate.
+  CRATES "regorus-ffi")
+
+add_executable(regorus_test main.cpp)
+# Add path to <regorus-source-folder>/bindings/ffi
+target_include_directories(regorus_test PRIVATE "../ffi")
+target_link_libraries(regorus_test regorus-ffi)

bindings/cpp/main.cpp

@@ -0,0 +1,118 @@
+#include <iostream>
+#include "regorus.hpp"
+
+void example()
+{
+    // Create engine
+    regorus::Engine engine;
+
+    // Add policies.
+    engine.add_policy("objects.rego",R"(package objects
+
+rect := {`width`: 2, "height": 4}
+cube := {"width": 3, `height`: 4, "depth": 5}
+a := 42
+b := false
+c := null
+d := {"a": a, "x": [b, c]}
+index := 1
+shapes := [rect, cube]
+names := ["prod", `smoke1`, "dev"]
+sites := [{"name": "prod"}, {"name": names[index]}, {"name": "dev"}]
+e := {
+    a: "foo",
+    "three": c,
+    names[2]: b,
+    "four": d,
+}
+f := e["dev"])");
+
+    // Add data.
+    engine.add_data_json(R"({
+    "one": {
+        "bar": "Foo",
+        "baz": 5,
+        "be": true,
+        "bop": 23.4
+    },
+    "two": {
+        "bar": "Bar",
+        "baz": 12.3,
+        "be": false,
+        "bop": 42
+    }
+})");
+
+    engine.add_data_json(R"({
+    "three": {
+        "bar": "Baz",
+        "baz": 15,
+        "be": true,
+        "bop": 4.23
+    }
+})");
+
+    // Set input.
+    engine.set_input_json(R"({
+    "a": 10,
+    "b": "20",
+    "c": 30.0,
+    "d": true
+})");
+
+    // Eval query.
+    auto result = engine.eval_query("[data.one, input.b, data.objects.sites[1]] = x");
+    if (result) {
+	std::cout<<result.output()<<std::endl;
+    } else {
+	std::cerr<<result.error()<<std::endl;
+    }
+}
+
+int main() {
+
+    // Create engine.
+    regorus::Engine engine;
+
+
+    // Load policies.
+    const char* policies[] = {
+	"../../../tests/aci/framework.rego",
+	"../../../tests/aci/policy.rego",
+	"../../../tests/aci/api.rego",
+    };
+
+    // Add policies and data.
+    for (auto policy : policies) {
+	auto result = engine.add_policy_from_file(policy);
+	if (!result) {
+	    std::cerr<<result.error()<<std::endl;
+	    return -1;
+	}
+    }
+    {
+	auto result = engine.add_data_from_json_file("../../../tests/aci/data.json");
+	if (!result) {
+	    std::cerr<<result.error()<<std::endl;
+	    return -1;
+	}
+    }
+
+    // Set input and eval query.
+    {
+	auto result = engine.set_input_from_json_file("../../../tests/aci/input.json");
+	if (!result) {
+	    std::cerr<<result.error()<<std::endl;
+	    return -1;
+	}
+    }
+    auto result = engine.eval_query("data.framework.mount_overlay = x");
+    if (!result) {
+	std::cerr<<result.error()<<std::endl;
+	return -1;
+    }
+
+    std::cout<<result.output()<<std::endl;
+    
+    example();
+}

bindings/cpp/regorus.hpp

@@ -0,0 +1,101 @@
+#ifndef REGORUS_WRAPPER_HPP
+#define REGORUS_WRAPPER_HPP
+
+#include <memory>
+#include <variant>
+
+#include "regorus.ffi.hpp"
+
+namespace regorus {
+
+    class Result {
+    public:
+
+	operator bool() const { return result.status == RegorusStatus::RegorusStatusOk; }
+	bool operator !() const { return result.status != RegorusStatus::RegorusStatusOk; }
+
+	const char* output() const {
+	    if (*this && result.output) {
+		return result.output;
+	    } else {
+		return "";
+	    }
+	}
+	
+	const char* error() const {
+	    if (!*this && result.error_message) {
+		return result.error_message;
+	    } else {
+		return "";
+	    }
+	}
+
+	~Result() {
+	    regorus_result_drop(result);
+	}
+	
+    private:
+	friend class Engine;
+	RegorusResult result;
+
+	Result(RegorusResult r) : result(r) {}	
+    private:
+	Result(const Result&) = delete;
+	Result(Result&&) = delete;
+	Result& operator=(const Result&) = delete;
+
+    };
+    
+    class Engine {
+    public:
+	Engine() : Engine(regorus_engine_new()) {}
+
+	std::unique_ptr<Engine> clone() const {
+	    return std::unique_ptr<Engine>(new Engine(regorus_engine_clone(engine)));
+	}
+
+
+	Result add_policy(const char* path, const char* policy) {
+	    return Result(regorus_engine_add_policy(engine, path, policy));
+	}
+	
+	Result add_policy_from_file(const char* path) {
+	    return Result(regorus_engine_add_policy_from_file(engine, path));
+	}
+	
+	Result add_data_json(const char* data) {
+	    return Result(regorus_engine_add_data_json(engine, data));
+	}
+	
+	Result add_data_from_json_file(const char* path) {
+	    return Result(regorus_engine_add_data_from_json_file(engine, path));
+	}
+	
+	Result set_input_json(const char* input) {
+	    return Result(regorus_engine_set_input_json(engine, input));
+	}
+	
+	Result set_input_from_json_file(const char* path) {
+	    return Result(regorus_engine_set_input_from_json_file(engine, path));
+	}
+
+	Result eval_query(const char* query) {
+	    return Result(regorus_engine_eval_query(engine, query));
+	}
+	
+	~Engine() {
+	    regorus_engine_drop(engine);
+	}
+	    
+	
+    private:
+	RegorusEngine* engine;
+    private:
+	Engine(RegorusEngine* e) : engine(e) {}
+	Engine(const Engine&) = delete;
+	Engine(Engine&&) = delete;
+	Engine& operator=(const Engine&) = delete;
+    };
+}
+
+#endif // REGORUS_WRAPPER_HPP

bindings/csharp/Program.cs

@@ -0,0 +1,51 @@
+using System.Diagnostics;
+
+long nanosecPerTick = (1000L*1000L*1000L) / Stopwatch.Frequency;
+var w = new Stopwatch();
+
+
+// Force load of modules.
+{
+    var _e = new Regorus.Engine();
+    var _j = System.Text.Json.JsonDocument.Parse("{}");
+}
+
+w.Restart();
+
+var engine = new Regorus.Engine();
+
+w.Stop();
+var newEngineTicks = w.ElapsedTicks;
+
+
+w.Restart();
+
+// Load policies and data.
+engine.AddPolicyFromFile("../../tests/aci/framework.rego");
+engine.AddPolicyFromFile("../../tests/aci/api.rego");
+engine.AddPolicyFromFile("../../tests/aci/policy.rego");
+engine.AddDataFromJsonFile("../../tests/aci/data.json");
+
+
+w.Stop();
+var loadPoliciesTicks = w.ElapsedTicks;
+
+
+w.Restart();
+
+// Set input and eval query.
+engine.SetInputFromJsonFile("../../tests/aci/input.json");
+var results = engine.EvalQuery("data.framework.mount_overlay = x");
+var resultsDoc = System.Text.Json.JsonDocument.Parse(results);
+
+w.Stop();
+var evalTicks = w.ElapsedTicks;
+
+Console.WriteLine("{0}", results);
+
+
+Console.WriteLine("Engine creation took {0} msecs", (newEngineTicks*nanosecPerTick)/(1000.0*1000.0));
+Console.WriteLine("Load policies and data took {0} msecs", (loadPoliciesTicks*nanosecPerTick)/(1000.0*1000.0));
+Console.WriteLine("EvalQuery took {0} msecs", (evalTicks*nanosecPerTick)/(1000.0*1000.0));
+
+

bindings/csharp/Regorus.cs

@@ -0,0 +1,169 @@
+using System.Text;
+
+namespace Regorus
+{
+    public class Exception : System.Exception
+    {
+	public Exception(string? message) : base(message) {}
+    }
+
+    public class Engine : ICloneable
+    {
+	unsafe private RegorusFFI.RegorusEngine* E;
+	public Engine()
+	{
+	    unsafe
+	    {
+		E = RegorusFFI.API.regorus_engine_new();
+	    }
+	}
+
+	public object Clone()
+	{
+	    var clone = (Engine)this.MemberwiseClone();
+	    unsafe
+	    {
+		clone.E = RegorusFFI.API.regorus_engine_clone(E);
+	    }
+	    return clone;
+
+	}
+
+	public void AddPolicy(string path, string rego)
+	{
+	    var pathBytes = Encoding.UTF8.GetBytes(path);
+	    var regoBytes = Encoding.UTF8.GetBytes(rego);
+	    
+	    unsafe
+	    {
+		fixed (byte* pathPtr = pathBytes)
+		{
+		    fixed(byte* regoPtr = regoBytes)
+		    {
+			CheckAndDropResult(RegorusFFI.API.regorus_engine_add_policy(E, pathPtr, regoPtr));
+		    }
+		}		
+	    }
+	}
+
+	public void AddPolicyFromFile(string path)
+	{
+	    var pathBytes = Encoding.UTF8.GetBytes(path);
+	    
+	    unsafe
+	    {
+		fixed (byte* pathPtr = pathBytes)
+		{
+		    CheckAndDropResult(RegorusFFI.API.regorus_engine_add_policy_from_file(E, pathPtr));
+		}		
+	    }
+	}
+	
+	public void AddDataJson(string data)
+	{
+	    var dataBytes = Encoding.UTF8.GetBytes(data);
+	    
+	    unsafe
+	    {
+		fixed (byte* dataPtr = dataBytes)
+		{
+		    CheckAndDropResult(RegorusFFI.API.regorus_engine_add_data_json(E, dataPtr));
+
+		}		
+	    }
+	}
+	
+	public void AddDataFromJsonFile(string path)
+	{
+	    var pathBytes = Encoding.UTF8.GetBytes(path);
+	    
+	    unsafe
+	    {
+		fixed (byte* pathPtr = pathBytes)
+		{
+		    CheckAndDropResult(RegorusFFI.API.regorus_engine_add_data_from_json_file(E, pathPtr));
+
+		}		
+	    }
+	}
+	
+	public void SetInputJson(string input)
+	{
+	    var inputBytes = Encoding.UTF8.GetBytes(input);
+	    
+	    unsafe
+	    {
+		fixed (byte* inputPtr = inputBytes)
+		{
+		    CheckAndDropResult(RegorusFFI.API.regorus_engine_set_input_json(E, inputPtr));
+
+		}		
+	    }
+	}
+	
+	public void SetInputFromJsonFile(string path)
+	{
+	    var pathBytes = Encoding.UTF8.GetBytes(path);
+	    
+	    unsafe
+	    {
+		fixed (byte* pathPtr = pathBytes)
+		{
+		    CheckAndDropResult(RegorusFFI.API.regorus_engine_set_input_from_json_file(E, pathPtr));
+
+		}		
+	    }
+	}
+	
+	public string EvalQuery(string query)
+	{
+	    var queryBytes = Encoding.UTF8.GetBytes(query);
+
+	    var resultJson = "";
+	    unsafe
+	    {
+		fixed (byte* queryPtr = queryBytes)
+		{
+		    var result = RegorusFFI.API.regorus_engine_eval_query(E, queryPtr);
+		    if (result.status == RegorusFFI.RegorusStatus.RegorusStatusOk) {
+			if (result.output is not null) {
+			    resultJson = System.Runtime.InteropServices.Marshal.PtrToStringUTF8((IntPtr)result.output);
+			}
+			RegorusFFI.API.regorus_result_drop(result);
+		    } else {
+			CheckAndDropResult(result);
+		    }
+		    
+		}		
+	    }
+	    if (resultJson is not null) {
+		return resultJson;
+	    } else {
+		return "";
+	    }
+	}
+	
+	~Engine()
+	{
+	    unsafe
+	    {
+		RegorusFFI.API.regorus_engine_drop(E);
+	    }
+	}
+
+	
+	void CheckAndDropResult(RegorusFFI.RegorusResult result)
+	{
+	    if (result.status != RegorusFFI.RegorusStatus.RegorusStatusOk) {
+		unsafe {
+		    var message = System.Runtime.InteropServices.Marshal.PtrToStringUTF8((IntPtr)result.error_message);
+		    var ex = new Exception(message);
+		    RegorusFFI.API.regorus_result_drop(result);
+		    throw ex;
+		}
+	    }
+	    RegorusFFI.API.regorus_result_drop(result);		    
+	}
+
+    }
+}

bindings/csharp/regorus-test.csproj

@@ -0,0 +1,24 @@
+<Project Sdk="Microsoft.NET.Sdk"> 
+
+  <Target Name="BuildRegorusFFI">
+    <Exec Command="cargo build -r --manifest-path ../ffi/Cargo.toml" />
+    <Copy SourceFiles="../ffi/RegorusFFI.g.cs" DestinationFolder="." />
+    <ItemGroup>
+        <RegorusDylib Include="..\..\target\release\*regorus_ffi*" />
+    </ItemGroup>    
+    <Copy SourceFiles="@(RegorusDylib)" DestinationFolder="." />
+  </Target>
+
+
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <TargetFramework>net8.0</TargetFramework>
+    <RootNamespace>regorus_test</RootNamespace>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
+  </PropertyGroup>
+
+
+
+</Project>

bindings/ffi/CHANGELOG.md

@@ -0,0 +1,13 @@
+# Changelog
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/microsoft/regorus/releases/tag/regorus-ffi-v0.1.0) - 2024-02-08
+
+### Other
+- C++ binding ([#129](https://github.com/microsoft/regorus/pull/129))
+- Bindings for C, C#, Golang ([#124](https://github.com/microsoft/regorus/pull/124))

bindings/ffi/Cargo.toml

@@ -0,0 +1,17 @@
+[package]
+name = "regorus-ffi"
+version = "0.1.0"
+edition = "2021"
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+[lib]
+crate-type = ["cdylib"]
+
+[dependencies]
+anyhow = "1.0.79"
+regorus = { path  = "../.." }
+serde_json = "1.0.113"
+
+[build-dependencies]
+cbindgen = "0.26.0"
+csbindgen = "1.9.0"

bindings/ffi/RegorusFFI.g.cs

@@ -0,0 +1,88 @@
+// <auto-generated>
+// This code is generated by csbindgen.
+// DON'T CHANGE THIS DIRECTLY.
+// </auto-generated>
+#pragma warning disable CS8500
+#pragma warning disable CS8981
+using System;
+using System.Runtime.InteropServices;
+
+
+namespace RegorusFFI
+{
+    internal static unsafe partial class API
+    {
+        const string __DllName = "regorusc";
+
+
+
+        /// <summary>Drop a `RegorusResult`.  `output` and `error_message` strings are not valid after drop.</summary>
+        [DllImport(__DllName, EntryPoint = "regorus_result_drop", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        public static extern void regorus_result_drop(RegorusResult r);
+
+        /// <summary>Construct a new Engine  See https://docs.rs/regorus/latest/regorus/struct.Engine.html</summary>
+        [DllImport(__DllName, EntryPoint = "regorus_engine_new", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        public static extern RegorusEngine* regorus_engine_new();
+
+        /// <summary>Clone a [`RegorusEngine`]  To avoid having to parse same policy again, the engine can be cloned after policies and data have been added.</summary>
+        [DllImport(__DllName, EntryPoint = "regorus_engine_clone", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        public static extern RegorusEngine* regorus_engine_clone(RegorusEngine* engine);
+
+        [DllImport(__DllName, EntryPoint = "regorus_engine_drop", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        public static extern void regorus_engine_drop(RegorusEngine* engine);
+
+        /// <summary>Add a policy  The policy is parsed into AST. See https://docs.rs/regorus/latest/regorus/struct.Engine.html#method.add_policy  * `path`: A filename to be associated with the policy. * `rego`: Rego policy.</summary>
+        [DllImport(__DllName, EntryPoint = "regorus_engine_add_policy", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        public static extern RegorusResult regorus_engine_add_policy(RegorusEngine* engine, byte* path, byte* rego);
+
+        [DllImport(__DllName, EntryPoint = "regorus_engine_add_policy_from_file", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        public static extern RegorusResult regorus_engine_add_policy_from_file(RegorusEngine* engine, byte* path);
+
+        /// <summary>Add policy data.  See https://docs.rs/regorus/latest/regorus/struct.Engine.html#method.add_data * `data`: JSON encoded value to be used as policy data.</summary>
+        [DllImport(__DllName, EntryPoint = "regorus_engine_add_data_json", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        public static extern RegorusResult regorus_engine_add_data_json(RegorusEngine* engine, byte* data);
+
+        [DllImport(__DllName, EntryPoint = "regorus_engine_add_data_from_json_file", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        public static extern RegorusResult regorus_engine_add_data_from_json_file(RegorusEngine* engine, byte* path);
+
+        /// <summary>Clear policy data.  See https://docs.rs/regorus/0.1.0-alpha.2/regorus/struct.Engine.html#method.clear_data</summary>
+        [DllImport(__DllName, EntryPoint = "regorus_engine_clear_data", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        public static extern RegorusResult regorus_engine_clear_data(RegorusEngine* engine);
+
+        /// <summary>Set input.  See https://docs.rs/regorus/0.1.0-alpha.2/regorus/struct.Engine.html#method.set_input * `input`: JSON encoded value to be used as input to query.</summary>
+        [DllImport(__DllName, EntryPoint = "regorus_engine_set_input_json", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        public static extern RegorusResult regorus_engine_set_input_json(RegorusEngine* engine, byte* input);
+
+        [DllImport(__DllName, EntryPoint = "regorus_engine_set_input_from_json_file", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        public static extern RegorusResult regorus_engine_set_input_from_json_file(RegorusEngine* engine, byte* path);
+
+        /// <summary>Evaluate query.  See https://docs.rs/regorus/0.1.0-alpha.2/regorus/struct.Engine.html#method.eval_query * `query`: Rego expression to be evaluate.</summary>
+        [DllImport(__DllName, EntryPoint = "regorus_engine_eval_query", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        public static extern RegorusResult regorus_engine_eval_query(RegorusEngine* engine, byte* query);
+
+
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    internal unsafe partial struct RegorusResult
+    {
+        public RegorusStatus status;
+        public byte* output;
+        public byte* error_message;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    internal unsafe partial struct RegorusEngine
+    {
+    }
+
+
+    internal enum RegorusStatus : uint
+    {
+        RegorusStatusOk,
+        RegorusStatusError,
+    }
+
+
+}
+    

bindings/ffi/build.rs

@@ -0,0 +1,32 @@
+extern crate cbindgen;
+extern crate csbindgen;
+
+use std::env;
+
+fn main() {
+    let crate_dir = env::var("CARGO_MANIFEST_DIR").unwrap();
+
+    cbindgen::Builder::new()
+        .with_crate(&crate_dir)
+        .with_language(cbindgen::Language::C)
+        .with_include_guard("REGORUS_H")
+        .generate()
+        .expect("Unable to generate bindings")
+        .write_to_file("regorus.h");
+
+    cbindgen::Builder::new()
+        .with_crate(crate_dir)
+        .with_language(cbindgen::Language::Cxx)
+        .with_include_guard("REGORUS_FFI_HPP")
+        .generate()
+        .expect("Unable to generate bindings")
+        .write_to_file("regorus.ffi.hpp");
+
+    csbindgen::Builder::default()
+        .input_extern_file("src/lib.rs")
+        .csharp_dll_name("regorusc")
+        .csharp_class_name("API")
+        .csharp_namespace("RegorusFFI")
+        .generate_csharp_file("./RegorusFFI.g.cs")
+        .unwrap();
+}

bindings/ffi/cbindgen.toml

@@ -0,0 +1,158 @@
+# This is a template cbindgen.toml file with all of the default values.
+# Some values are commented out because their absence is the real default.
+#
+# See https://github.com/mozilla/cbindgen/blob/master/docs.md#cbindgentoml
+# for detailed documentation of every option here.
+
+
+
+language = "C++"
+
+
+
+############## Options for Wrapping the Contents of the Header #################
+
+# header = "/* Text to put at the beginning of the generated file. Probably a license. */"
+# trailer = "/* Text to put at the end of the generated file */"
+# include_guard = "my_bindings_h"
+# pragma_once = true
+# autogen_warning = "/* Warning, this file is autogenerated by cbindgen. Don't modify this manually. */"
+include_version = false
+# namespace = "my_namespace"
+namespaces = []
+using_namespaces = []
+sys_includes = []
+includes = []
+no_includes = false
+after_includes = ""
+
+
+
+
+############################ Code Style Options ################################
+
+braces = "SameLine"
+line_length = 100
+tab_width = 2
+documentation = true
+documentation_style = "auto"
+documentation_length = "full"
+line_endings = "LF" # also "CR", "CRLF", "Native"
+
+
+
+
+############################# Codegen Options ##################################
+
+style = "both"
+sort_by = "Name" # default for `fn.sort_by` and `const.sort_by`
+usize_is_size_t = true
+
+
+
+[defines]
+# "target_os = freebsd" = "DEFINE_FREEBSD"
+# "feature = serde" = "DEFINE_SERDE"
+
+
+
+[export]
+include = []
+exclude = []
+# prefix = "CAPI_"
+item_types = []
+renaming_overrides_prefixing = false
+
+
+
+[export.rename]
+
+
+
+[export.body]
+
+
+[export.mangle]
+
+
+[fn]
+rename_args = "None"
+# must_use = "MUST_USE_FUNC"
+# deprecated = "DEPRECATED_FUNC"
+# deprecated_with_note = "DEPRECATED_FUNC_WITH_NOTE"
+# no_return = "NO_RETURN"
+# prefix = "START_FUNC"
+# postfix = "END_FUNC"
+args = "auto"
+sort_by = "Name"
+
+
+
+
+[struct]
+rename_fields = "None"
+# must_use = "MUST_USE_STRUCT"
+# deprecated = "DEPRECATED_STRUCT"
+# deprecated_with_note = "DEPRECATED_STRUCT_WITH_NOTE"
+derive_constructor = false
+derive_eq = false
+derive_neq = false
+derive_lt = false
+derive_lte = false
+derive_gt = false
+derive_gte = false
+
+
+
+
+[enum]
+rename_variants = "None"
+# must_use = "MUST_USE_ENUM"
+# deprecated = "DEPRECATED_ENUM"
+# deprecated_with_note = "DEPRECATED_ENUM_WITH_NOTE"
+add_sentinel = false
+prefix_with_name = false
+derive_helper_methods = false
+derive_const_casts = false
+derive_mut_casts = false
+# cast_assert_name = "ASSERT"
+derive_tagged_enum_destructor = false
+derive_tagged_enum_copy_constructor = false
+enum_class = true
+private_default_tagged_enum_constructor = false
+
+
+
+
+[const]
+allow_static_const = true
+allow_constexpr = false
+sort_by = "Name"
+
+
+
+
+[macro_expansion]
+bitflags = false
+
+
+
+
+
+
+############## Options for How Your Rust library Should Be Parsed ##############
+
+[parse]
+parse_deps = false
+# include = []
+exclude = []
+clean = false
+extra_bindings = []
+
+
+
+[parse.expand]
+crates = []
+all_features = false
+default_features = true
+features = []

bindings/ffi/regorus.ffi.hpp

@@ -0,0 +1,95 @@
+#ifndef REGORUS_FFI_HPP
+#define REGORUS_FFI_HPP
+
+#include <cstdarg>
+#include <cstdint>
+#include <cstdlib>
+#include <ostream>
+#include <new>
+
+/// Status of a call on `RegorusEngine`.
+enum class RegorusStatus {
+  /// The operation was successful.
+  RegorusStatusOk,
+  /// The operation was unsuccessful.
+  RegorusStatusError,
+};
+
+/// Wrapper for `regorus::Engine`.
+struct RegorusEngine;
+
+/// Result of a call on `RegorusEngine`.
+///
+/// Must be freed using `regorus_result_drop`.
+struct RegorusResult {
+  /// Status
+  RegorusStatus status;
+  /// Output produced by the call.
+  /// Owned by Rust.
+  char *output;
+  /// Errors produced by the call.
+  /// Owned by Rust.
+  char *error_message;
+};
+
+extern "C" {
+
+/// Drop a `RegorusResult`.
+///
+/// `output` and `error_message` strings are not valid after drop.
+void regorus_result_drop(RegorusResult r);
+
+/// Construct a new Engine
+///
+/// See https://docs.rs/regorus/latest/regorus/struct.Engine.html
+RegorusEngine *regorus_engine_new();
+
+/// Clone a [`RegorusEngine`]
+///
+/// To avoid having to parse same policy again, the engine can be cloned
+/// after policies and data have been added.
+RegorusEngine *regorus_engine_clone(RegorusEngine *engine);
+
+void regorus_engine_drop(RegorusEngine *engine);
+
+/// Add a policy
+///
+/// The policy is parsed into AST.
+/// See https://docs.rs/regorus/latest/regorus/struct.Engine.html#method.add_policy
+///
+/// * `path`: A filename to be associated with the policy.
+/// * `rego`: Rego policy.
+RegorusResult regorus_engine_add_policy(RegorusEngine *engine, const char *path, const char *rego);
+
+RegorusResult regorus_engine_add_policy_from_file(RegorusEngine *engine, const char *path);
+
+/// Add policy data.
+///
+/// See https://docs.rs/regorus/latest/regorus/struct.Engine.html#method.add_data
+/// * `data`: JSON encoded value to be used as policy data.
+RegorusResult regorus_engine_add_data_json(RegorusEngine *engine, const char *data);
+
+RegorusResult regorus_engine_add_data_from_json_file(RegorusEngine *engine, const char *path);
+
+/// Clear policy data.
+///
+/// See https://docs.rs/regorus/0.1.0-alpha.2/regorus/struct.Engine.html#method.clear_data
+RegorusResult regorus_engine_clear_data(RegorusEngine *engine);
+
+/// Set input.
+///
+/// See https://docs.rs/regorus/0.1.0-alpha.2/regorus/struct.Engine.html#method.set_input
+/// * `input`: JSON encoded value to be used as input to query.
+RegorusResult regorus_engine_set_input_json(RegorusEngine *engine, const char *input);
+
+RegorusResult regorus_engine_set_input_from_json_file(RegorusEngine *engine, const char *path);
+
+/// Evaluate query.
+///
+/// See https://docs.rs/regorus/0.1.0-alpha.2/regorus/struct.Engine.html#method.eval_query
+/// * `query`: Rego expression to be evaluate.
+RegorusResult regorus_engine_eval_query(RegorusEngine *engine, const char *query);
+
+} // extern "C"
+
+#endif // REGORUS_FFI_HPP

bindings/ffi/regorus.h

@@ -0,0 +1,127 @@
+#ifndef REGORUS_H
+#define REGORUS_H
+
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdlib.h>
+
+/**
+ * Status of a call on `RegorusEngine`.
+ */
+typedef enum RegorusStatus {
+  /**
+   * The operation was successful.
+   */
+  RegorusStatusOk,
+  /**
+   * The operation was unsuccessful.
+   */
+  RegorusStatusError,
+} RegorusStatus;
+
+/**
+ * Wrapper for `regorus::Engine`.
+ */
+typedef struct RegorusEngine RegorusEngine;
+
+/**
+ * Result of a call on `RegorusEngine`.
+ *
+ * Must be freed using `regorus_result_drop`.
+ */
+typedef struct RegorusResult {
+  /**
+   * Status
+   */
+  enum RegorusStatus status;
+  /**
+   * Output produced by the call.
+   * Owned by Rust.
+   */
+  char *output;
+  /**
+   * Errors produced by the call.
+   * Owned by Rust.
+   */
+  char *error_message;
+} RegorusResult;
+
+/**
+ * Drop a `RegorusResult`.
+ *
+ * `output` and `error_message` strings are not valid after drop.
+ */
+void regorus_result_drop(struct RegorusResult r);
+
+/**
+ * Construct a new Engine
+ *
+ * See https://docs.rs/regorus/latest/regorus/struct.Engine.html
+ */
+struct RegorusEngine *regorus_engine_new(void);
+
+/**
+ * Clone a [`RegorusEngine`]
+ *
+ * To avoid having to parse same policy again, the engine can be cloned
+ * after policies and data have been added.
+ */
+struct RegorusEngine *regorus_engine_clone(struct RegorusEngine *engine);
+
+void regorus_engine_drop(struct RegorusEngine *engine);
+
+/**
+ * Add a policy
+ *
+ * The policy is parsed into AST.
+ * See https://docs.rs/regorus/latest/regorus/struct.Engine.html#method.add_policy
+ *
+ * * `path`: A filename to be associated with the policy.
+ * * `rego`: Rego policy.
+ */
+struct RegorusResult regorus_engine_add_policy(struct RegorusEngine *engine,
+                                               const char *path,
+                                               const char *rego);
+
+struct RegorusResult regorus_engine_add_policy_from_file(struct RegorusEngine *engine,
+                                                         const char *path);
+
+/**
+ * Add policy data.
+ *
+ * See https://docs.rs/regorus/latest/regorus/struct.Engine.html#method.add_data
+ * * `data`: JSON encoded value to be used as policy data.
+ */
+struct RegorusResult regorus_engine_add_data_json(struct RegorusEngine *engine, const char *data);
+
+struct RegorusResult regorus_engine_add_data_from_json_file(struct RegorusEngine *engine,
+                                                            const char *path);
+
+/**
+ * Clear policy data.
+ *
+ * See https://docs.rs/regorus/0.1.0-alpha.2/regorus/struct.Engine.html#method.clear_data
+ */
+struct RegorusResult regorus_engine_clear_data(struct RegorusEngine *engine);
+
+/**
+ * Set input.
+ *
+ * See https://docs.rs/regorus/0.1.0-alpha.2/regorus/struct.Engine.html#method.set_input
+ * * `input`: JSON encoded value to be used as input to query.
+ */
+struct RegorusResult regorus_engine_set_input_json(struct RegorusEngine *engine, const char *input);
+
+struct RegorusResult regorus_engine_set_input_from_json_file(struct RegorusEngine *engine,
+                                                             const char *path);
+
+/**
+ * Evaluate query.
+ *
+ * See https://docs.rs/regorus/0.1.0-alpha.2/regorus/struct.Engine.html#method.eval_query
+ * * `query`: Rego expression to be evaluate.
+ */
+struct RegorusResult regorus_engine_eval_query(struct RegorusEngine *engine, const char *query);
+
+#endif /* REGORUS_H */

bindings/ffi/src/lib.rs

@@ -0,0 +1,248 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+use anyhow::{anyhow, bail, Result};
+use std::ffi::{CStr, CString};
+use std::os::raw::c_char;
+
+/// Status of a call on `RegorusEngine`.
+#[repr(C)]
+pub enum RegorusStatus {
+    /// The operation was successful.
+    RegorusStatusOk,
+
+    /// The operation was unsuccessful.
+    RegorusStatusError,
+}
+
+/// Result of a call on `RegorusEngine`.
+///
+/// Must be freed using `regorus_result_drop`.
+#[repr(C)]
+pub struct RegorusResult {
+    /// Status
+    status: RegorusStatus,
+
+    /// Output produced by the call.
+    /// Owned by Rust.
+    output: *mut c_char,
+
+    /// Errors produced by the call.
+    /// Owned by Rust.
+    error_message: *mut c_char,
+}
+
+fn to_c_str(s: String) -> *mut c_char {
+    match CString::new(s) {
+        Ok(cs) => cs.into_raw(),
+        _ => to_c_str("binding error: failed to create c-style string".to_string()),
+    }
+}
+
+fn from_c_str(s: *const c_char) -> Result<String> {
+    if s.is_null() {
+        bail!("null pointer");
+    }
+    unsafe {
+        CStr::from_ptr(s)
+            .to_str()
+            .map_err(|_| anyhow!("`path`: invalid utf8"))
+            .map(|s| s.to_string())
+    }
+}
+
+fn to_ref<T>(t: &*mut T) -> Result<&mut T> {
+    unsafe { t.as_mut().ok_or_else(|| anyhow!("null pointer")) }
+}
+
+fn to_regorus_result(r: Result<()>) -> RegorusResult {
+    match r {
+        Ok(()) => RegorusResult {
+            status: RegorusStatus::RegorusStatusOk,
+            output: std::ptr::null_mut(),
+            error_message: std::ptr::null_mut(),
+        },
+        Err(e) => RegorusResult {
+            status: RegorusStatus::RegorusStatusError,
+            output: std::ptr::null_mut(),
+            error_message: to_c_str(format!("{e}")),
+        },
+    }
+}
+
+/// Wrapper for `regorus::Engine`.
+#[derive(Clone)]
+pub struct RegorusEngine {
+    engine: ::regorus::Engine,
+}
+
+/// Drop a `RegorusResult`.
+///
+/// `output` and `error_message` strings are not valid after drop.
+#[no_mangle]
+pub extern "C" fn regorus_result_drop(r: RegorusResult) {
+    if !r.error_message.is_null() {
+        unsafe {
+            let _ = CString::from_raw(r.error_message);
+        }
+    }
+}
+
+#[no_mangle]
+/// Construct a new Engine
+///
+/// See https://docs.rs/regorus/latest/regorus/struct.Engine.html
+pub extern "C" fn regorus_engine_new() -> *mut RegorusEngine {
+    let engine = ::regorus::Engine::new();
+    Box::into_raw(Box::new(RegorusEngine { engine }))
+}
+
+/// Clone a [`RegorusEngine`]
+///
+/// To avoid having to parse same policy again, the engine can be cloned
+/// after policies and data have been added.
+#[no_mangle]
+pub extern "C" fn regorus_engine_clone(engine: *mut RegorusEngine) -> *mut RegorusEngine {
+    unsafe {
+        if engine.is_null() {
+            return std::ptr::null_mut();
+        }
+        Box::into_raw(Box::new((*engine).clone()))
+    }
+}
+
+#[no_mangle]
+pub extern "C" fn regorus_engine_drop(engine: *mut RegorusEngine) {
+    if !engine.is_null() {
+        unsafe {
+            let _ = Box::from_raw(engine);
+        }
+    }
+}
+
+/// Add a policy
+///
+/// The policy is parsed into AST.
+/// See https://docs.rs/regorus/latest/regorus/struct.Engine.html#method.add_policy
+///
+/// * `path`: A filename to be associated with the policy.
+/// * `rego`: Rego policy.
+
+#[no_mangle]
+pub extern "C" fn regorus_engine_add_policy(
+    engine: *mut RegorusEngine,
+    path: *const c_char,
+    rego: *const c_char,
+) -> RegorusResult {
+    to_regorus_result(|| -> Result<()> {
+        to_ref(&engine)?
+            .engine
+            .add_policy(from_c_str(path)?, from_c_str(rego)?)
+    }())
+}
+
+#[no_mangle]
+pub extern "C" fn regorus_engine_add_policy_from_file(
+    engine: *mut RegorusEngine,
+    path: *const c_char,
+) -> RegorusResult {
+    to_regorus_result(|| -> Result<()> {
+        to_ref(&engine)?
+            .engine
+            .add_policy_from_file(from_c_str(path)?)
+    }())
+}
+
+/// Add policy data.
+///
+/// See https://docs.rs/regorus/latest/regorus/struct.Engine.html#method.add_data
+/// * `data`: JSON encoded value to be used as policy data.
+#[no_mangle]
+pub extern "C" fn regorus_engine_add_data_json(
+    engine: *mut RegorusEngine,
+    data: *const c_char,
+) -> RegorusResult {
+    to_regorus_result(|| -> Result<()> {
+        to_ref(&engine)?
+            .engine
+            .add_data(regorus::Value::from_json_str(&from_c_str(data)?)?)
+    }())
+}
+
+#[no_mangle]
+pub extern "C" fn regorus_engine_add_data_from_json_file(
+    engine: *mut RegorusEngine,
+    path: *const c_char,
+) -> RegorusResult {
+    to_regorus_result(|| -> Result<()> {
+        to_ref(&engine)?
+            .engine
+            .add_data(regorus::Value::from_json_file(&from_c_str(path)?)?)
+    }())
+}
+
+/// Clear policy data.
+///
+/// See https://docs.rs/regorus/0.1.0-alpha.2/regorus/struct.Engine.html#method.clear_data
+#[no_mangle]
+pub extern "C" fn regorus_engine_clear_data(engine: *mut RegorusEngine) -> RegorusResult {
+    to_regorus_result(|| -> Result<()> {
+        to_ref(&engine)?.engine.clear_data();
+        Ok(())
+    }())
+}
+
+/// Set input.
+///
+/// See https://docs.rs/regorus/0.1.0-alpha.2/regorus/struct.Engine.html#method.set_input
+/// * `input`: JSON encoded value to be used as input to query.
+#[no_mangle]
+pub extern "C" fn regorus_engine_set_input_json(
+    engine: *mut RegorusEngine,
+    input: *const c_char,
+) -> RegorusResult {
+    to_regorus_result(|| -> Result<()> {
+        to_ref(&engine)?
+            .engine
+            .set_input(regorus::Value::from_json_str(&from_c_str(input)?)?);
+        Ok(())
+    }())
+}
+
+#[no_mangle]
+pub extern "C" fn regorus_engine_set_input_from_json_file(
+    engine: *mut RegorusEngine,
+    path: *const c_char,
+) -> RegorusResult {
+    to_regorus_result(|| -> Result<()> {
+        to_ref(&engine)?
+            .engine
+            .set_input(regorus::Value::from_json_file(&from_c_str(path)?)?);
+        Ok(())
+    }())
+}
+
+/// Evaluate query.
+///
+/// See https://docs.rs/regorus/0.1.0-alpha.2/regorus/struct.Engine.html#method.eval_query
+/// * `query`: Rego expression to be evaluate.
+#[no_mangle]
+pub extern "C" fn regorus_engine_eval_query(
+    engine: *mut RegorusEngine,
+    query: *const c_char,
+) -> RegorusResult {
+    let output = || -> Result<String> {
+        let results = to_ref(&engine)?
+            .engine
+            .eval_query(from_c_str(query)?, false)?;
+        Ok(serde_json::to_string_pretty(&results)?)
+    }();
+    match output {
+        Ok(out) => RegorusResult {
+            status: RegorusStatus::RegorusStatusOk,
+            output: to_c_str(out),
+            error_message: std::ptr::null_mut(),
+        },
+        Err(e) => to_regorus_result(Err(e)),
+    }
+}

bindings/go/go.mod

@@ -0,0 +1,3 @@
+module regorus-test
+
+go 1.21.5

bindings/go/main.go

@@ -0,0 +1,58 @@
+package main
+
+import (
+	"fmt"
+	"os"
+	"regorus-test/pkg/regorus"
+	"time"
+)
+
+func main() {
+	var output string
+	var err error
+
+	t := time.Now();
+	
+	// Create new engine
+	engine := regorus.NewEngine()
+	defer engine.Close()
+	elapsed1 := time.Since(t)
+
+	t = time.Now()
+	// Add policies and data.
+	policies := []string{
+		"../../tests/aci/framework.rego",
+		"../../tests/aci/api.rego",
+		"../../tests/aci/policy.rego",
+	}
+	for _, policy := range policies {
+		if err := engine.AddPolicyFromFile(policy); err != nil {
+			fmt.Fprintf(os.Stderr, "error: %v\n", err)
+			os.Exit(1)
+		}
+	}
+	if err = engine.AddDataFromJsonFile("../../tests/aci/data.json"); err != nil {
+		fmt.Fprintf(os.Stderr, "error: %v\n", err)
+		os.Exit(1)
+	}
+	elapsed2 := time.Since(t)
+
+	t = time.Now()
+	// Set input and eval query.
+	if err = engine.SetInputFromJsonFile("../../tests/aci/input.json"); err != nil {
+		fmt.Fprintf(os.Stderr, "error: %v\n", err)
+		os.Exit(1)
+	}
+
+
+	if output, err = engine.EvalQuery("data.framework.mount_overlay = x"); err != nil {
+		fmt.Fprintf(os.Stderr, "error: %v\n", err)
+		os.Exit(1)
+	}
+	elapsed3 := time.Since(t)
+
+	fmt.Println("{%s}", output)
+	fmt.Printf("NewEngine took %v\n", elapsed1)
+	fmt.Printf("Add policies and data took %v\n", elapsed2)
+	fmt.Printf("Set input and eval query took %v\n", elapsed3)
+}

bindings/go/pkg/regorus/mod.go

@@ -0,0 +1,117 @@
+package regorus
+
+// #cgo LDFLAGS: -L ../../../../target/release -lregorus_ffi
+// #include "../../../ffi/regorus.h"
+import "C"
+import (
+	"fmt"
+	"unsafe"
+)
+
+type Engine struct {
+	e *C.RegorusEngine
+}
+
+func NewEngine() *Engine {
+	e := new(Engine)
+	e.e = C.regorus_engine_new()
+	return e
+}
+
+func (e *Engine) Close() {
+	C.regorus_engine_drop(e.e)
+}
+
+func (e *Engine) Clone() *Engine {
+	c := new(Engine)
+	c.e = C.regorus_engine_clone(e.e)
+	return c
+}
+
+func (e *Engine) AddPolicy(path string, rego string) error {
+	path_c := C.CString(path)
+	defer C.free(unsafe.Pointer(path_c))
+
+	rego_c := C.CString(rego)
+	defer C.free(unsafe.Pointer(rego_c))
+
+	result := C.regorus_engine_add_policy(e.e, path_c, rego_c)
+	defer C.regorus_result_drop(result)
+	if result.status != C.RegorusStatusOk {
+		return fmt.Errorf("%s", C.GoString(result.error_message))
+	}
+	return nil
+}
+
+func (e *Engine) AddPolicyFromFile(path string) error {
+	path_c := C.CString(path)
+	defer C.free(unsafe.Pointer(path_c))
+
+	result := C.regorus_engine_add_policy_from_file(e.e, path_c)
+	defer C.regorus_result_drop(result)
+	if result.status != C.RegorusStatusOk {
+		return fmt.Errorf("%s", C.GoString(result.error_message))
+	}
+	return nil
+}
+
+func (e *Engine) AddDataJson(data string) error {
+	data_c := C.CString(data)
+	defer C.free(unsafe.Pointer(data_c))
+
+	result := C.regorus_engine_add_data_json(e.e, data_c)
+	defer C.regorus_result_drop(result)
+	if result.status != C.RegorusStatusOk {
+		return fmt.Errorf("%s", C.GoString(result.error_message))
+	}
+	return nil
+}
+
+func (e *Engine) AddDataFromJsonFile(path string) error {
+	path_c := C.CString(path)
+	defer C.free(unsafe.Pointer(path_c))
+
+	result := C.regorus_engine_add_data_from_json_file(e.e, path_c)
+	defer C.regorus_result_drop(result)
+	if result.status != C.RegorusStatusOk {
+		return fmt.Errorf("%s", C.GoString(result.error_message))
+	}
+	return nil
+}
+
+func (e *Engine) SetInputJson(input string) error {
+	input_c := C.CString(input)
+	defer C.free(unsafe.Pointer(input_c))
+
+	result := C.regorus_engine_set_input_json(e.e, input_c)
+	defer C.regorus_result_drop(result)
+	if result.status != C.RegorusStatusOk {
+		return fmt.Errorf("%s", C.GoString(result.error_message))
+	}
+	return nil
+}
+
+func (e *Engine) SetInputFromJsonFile(path string) error {
+	path_c := C.CString(path)
+	defer C.free(unsafe.Pointer(path_c))
+
+	result := C.regorus_engine_set_input_from_json_file(e.e, path_c)
+	defer C.regorus_result_drop(result)
+	if result.status != C.RegorusStatusOk {
+		return fmt.Errorf("%s", C.GoString(result.error_message))
+	}
+	return nil
+}
+
+func (e *Engine) EvalQuery(query string) (string, error) {
+	query_c := C.CString(query)
+	defer C.free(unsafe.Pointer(query_c))
+
+	result := C.regorus_engine_eval_query(e.e, query_c)
+	defer C.regorus_result_drop(result)
+	if result.status != C.RegorusStatusOk {
+		return "", fmt.Errorf("%s", C.GoString(result.error_message))
+	}
+
+	return C.GoString(result.output), nil
+}

bindings/python/.python-version

@@ -0,0 +1 @@
+pyo3

bindings/python/CHANGELOG.md

@@ -0,0 +1,14 @@
+# Changelog
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/microsoft/regorus/releases/tag/regoruspy-v0.1.0) - 2024-02-01
+
+### Other
+- Document bindings ([#119](https://github.com/microsoft/regorus/pull/119))
+- Publish python packages ([#117](https://github.com/microsoft/regorus/pull/117))
+- Python bindings ([#115](https://github.com/microsoft/regorus/pull/115))

bindings/python/Cargo.toml

@@ -0,0 +1,20 @@
+[package]
+name = "regoruspy"
+version = "0.1.0"
+edition = "2021"
+repository = "https://github.com/microsoft/regorus/bindings/python"
+description = "Python bindings for Regorus - a fast, lightweight Rego interpreter written in Rust"
+keywords = ["interpreter", "opa", "policy-as-code", "rego"]
+
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+[lib]
+crate-type = ["cdylib"]
+
+[dependencies]
+anyhow = "1.0.79"
+ordered-float = "4.2.0"
+pyo3 = {version = "0.20.2", features = ["anyhow", "extension-module"] }
+regorus = { path  = "../.." }
+serde_json = "1.0.112"
+

bindings/python/README.md

@@ -0,0 +1,67 @@
+# regorus
+
+**Regorus** is
+
+  - *Rego*-*Rus(t)*  - A fast, light-weight [Rego](https://www.openpolicyagent.org/docs/latest/policy-language/)
+   interpreter written in Rust.
+  - *Rigorous* - A rigorous enforcer of well-defined Rego semantics.
+
+Regorus can be used in Python via `regorus` package. (It is not yet available in PyPI, but can be manually built.)
+
+See [Repository](https://github.com/microsoft/regorus).
+
+To build this binding, see [building](https://github.com/microsoft/regorus/bindings/python/building.md)
+
+## Usage
+```Python
+import regorus
+
+# Create engine
+engine = regorus.Engine()
+
+# Load policies
+engine.add_policy_from_file('../../tests/aci/framework.rego')
+engine.add_policy_from_file('../../tests/aci/api.rego')
+engine.add_policy_from_file('../../tests/aci/policy.rego')
+
+# Add policy data
+data = {
+  "metadata": {
+    "devices": {
+      "/run/layers/p0-layer0": "1b80f120dbd88e4355d6241b519c3e25290215c469516b49dece9cf07175a766",
+      "/run/layers/p0-layer1": "e769d7487cc314d3ee748a4440805317c19262c7acd2fdbdb0d47d2e4613a15c",
+      "/run/layers/p0-layer2": "eb36921e1f82af46dfe248ef8f1b3afb6a5230a64181d960d10237a08cd73c79",
+      "/run/layers/p0-layer3": "41d64cdeb347bf236b4c13b7403b633ff11f1cf94dbc7cf881a44d6da88c5156",
+      "/run/layers/p0-layer4": "4dedae42847c704da891a28c25d32201a1ae440bce2aecccfa8e6f03b97a6a6c",
+      "/run/layers/p0-layer5": "fe84c9d5bfddd07a2624d00333cf13c1a9c941f3a261f13ead44fc6a93bc0e7a"
+    }
+  }
+}
+engine.add_data(data)
+
+# Set input
+input = {
+  "containerID": "container0",
+  "layerPaths": [
+    "/run/layers/p0-layer0",
+    "/run/layers/p0-layer1",
+    "/run/layers/p0-layer2",
+    "/run/layers/p0-layer3",
+    "/run/layers/p0-layer4",
+    "/run/layers/p0-layer5"
+  ],
+  "target": "/run/gcs/c/container0/rootfs"
+}
+engine.set_input(input)
+
+# Eval query
+results = engine.eval_query('data.framework.mount_overlay=x')
+
+# Print results
+print(results['result'][0])
+
+# Eval query as json
+results_json = engine.eval_query_as_json('data.framework.mount_overlay=x')
+print(results_json)
+```
+

bindings/python/building.md

@@ -0,0 +1,22 @@
+- Install maturin
+  ```
+  pipx install maturin
+  ```
+  See [Maturin User Guide](https://www.maturin.rs)
+  
+- Build bindings for Python
+  ```
+  cd bindings/python
+  maturin build --release --target-dir wheels
+  ```
+  
+- Install python wheel
+  ```
+  pip3 install ../../target/wheels/regorus*.whl --force-reinstall
+  ```
+  
+- Run test script
+  ```
+  python3 test.py
+  ```
+  

bindings/python/pyproject.toml

@@ -0,0 +1,16 @@
+[build-system]
+requires = ["maturin>=1.4,<2.0"]
+build-backend = "maturin"
+
+[project]
+name = "regorus"
+requires-python = ">=3.8"
+classifiers = [
+    "Programming Language :: Rust",
+    "Programming Language :: Python :: Implementation :: CPython",
+    "Programming Language :: Python :: Implementation :: PyPy",
+]
+dynamic = ["version"]
+
+[tool.maturin]
+features = ["pyo3/extension-module"]

bindings/python/src/lib.rs

@@ -0,0 +1,301 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+use anyhow::{anyhow, Result};
+use pyo3::exceptions::PyTypeError;
+use pyo3::prelude::*;
+use pyo3::types::*;
+
+use std::collections::{BTreeMap, BTreeSet};
+
+use ::regorus::Value;
+
+/// Regorus engine.
+#[pyclass(unsendable)]
+pub struct Engine {
+    engine: ::regorus::Engine,
+}
+
+impl Default for Engine {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl Clone for Engine {
+    /// Clone a [`Engine`]
+    ///
+    /// To avoid having to parse same policy again, the engine can be cloned
+    /// after policies and data have been added.
+    fn clone(&self) -> Self {
+        Self {
+            engine: self.engine.clone(),
+        }
+    }
+}
+
+fn from<'source>(ob: &'source PyAny) -> Result<Value, PyErr> {
+    // dicts
+    Ok(if let Ok(dict) = ob.downcast::<PyDict>() {
+        let mut map = BTreeMap::new();
+        for (k, v) in dict {
+            map.insert(from(k)?, from(v)?);
+        }
+        map.into()
+    }
+    // set
+    else if let Ok(pset) = ob.downcast::<PySet>() {
+        let mut set = BTreeSet::new();
+        for v in pset {
+            set.insert(from(v)?);
+        }
+        set.into()
+    }
+    // frozen set
+    else if let Ok(pfset) = ob.downcast::<PyFrozenSet>() {
+        //
+        let mut set = BTreeSet::new();
+        for v in pfset {
+            set.insert(from(v)?);
+        }
+        set.into()
+    }
+    // lists and tuples
+    else if let Ok(plist) = ob.downcast::<PyList>() {
+        let mut array = Vec::new();
+        for v in plist {
+            array.push(from(v)?);
+        }
+        array.into()
+    } else if let Ok(ptuple) = ob.downcast::<PyTuple>() {
+        let mut array = Vec::new();
+        for v in ptuple {
+            array.push(from(v)?);
+        }
+        array.into()
+    }
+    // String
+    else if let Ok(s) = String::extract(ob) {
+        s.into()
+    }
+    // Numeric
+    else if let Ok(v) = i64::extract(ob) {
+        v.into()
+    } else if let Ok(v) = u64::extract(ob) {
+        v.into()
+    } else if let Ok(v) = f64::extract(ob) {
+        v.into()
+    }
+    // Boolean
+    else if let Ok(b) = bool::extract(ob) {
+        b.into()
+    }
+    // None
+    else if ob.downcast::<PyNone>().is_ok() {
+        Value::Null
+    }
+    // Anything that is a sequence
+    else if let Ok(pseq) = ob.downcast::<PySequence>() {
+        let mut array = Vec::new();
+        for i in 0..pseq.len()? {
+            array.push(from(pseq.get_item(i)?)?);
+        }
+        array.into()
+    }
+    // Anything that is a map
+    else if let Ok(pmap) = ob.downcast::<PyMapping>() {
+        let mut map = BTreeMap::new();
+        let keys = pmap.keys()?;
+        let values = pmap.values()?;
+        for i in 0..keys.len()? {
+            let key = keys.get_item(i)?;
+            let value = values.get_item(i)?;
+            map.insert(from(key)?, from(value)?);
+        }
+        map.into()
+    } else {
+        return Err(PyErr::new::<PyTypeError, _>(
+            "object cannot be converted to RegoValue",
+        ));
+    })
+}
+
+fn to(mut v: Value, py: Python<'_>) -> Result<PyObject> {
+    Ok(match v {
+        Value::Null => None::<u64>.to_object(py),
+
+        // TODO: Revisit this mapping
+        Value::Undefined => None::<u64>.to_object(py),
+
+        Value::Bool(b) => b.to_object(py),
+        Value::String(s) => s.to_object(py),
+
+        Value::Number(_) => {
+            if let Ok(f) = v.as_f64() {
+                f.to_object(py)
+            } else if let Ok(u) = v.as_u64() {
+                u.to_object(py)
+            } else {
+                v.as_i64()?.to_object(py)
+            }
+        }
+
+        Value::Array(_) => {
+            let list = PyList::empty(py);
+            for v in std::mem::replace(v.as_array_mut()?, Vec::new()) {
+                list.append(to(v, py)?)?;
+            }
+            list.into()
+        }
+
+        Value::Set(_) => {
+            let set = PySet::empty(py)?;
+            for v in std::mem::replace(v.as_set_mut()?, BTreeSet::new()) {
+                set.add(to(v, py)?)?;
+            }
+            set.into()
+        }
+
+        Value::Object(_) => {
+            let dict = PyDict::new(py);
+            for (k, v) in std::mem::replace(v.as_object_mut()?, BTreeMap::new()) {
+                dict.set_item(to(k, py)?, to(v, py)?)?;
+            }
+            dict.into()
+        }
+    })
+}
+
+#[pymethods]
+impl Engine {
+    /// Construct a new Engine
+    #[new]
+    pub fn new() -> Self {
+        Self {
+            engine: ::regorus::Engine::new(),
+        }
+    }
+
+    /// Add a policy
+    ///
+    /// The policy is parsed into AST.
+    ///
+    /// * `path`: A filename to be associated with the policy.
+    /// * `rego`: Rego policy.
+    pub fn add_policy(&mut self, path: String, rego: String) -> Result<()> {
+        self.engine.add_policy(path, rego)
+    }
+
+    /// Add a policy from given file.
+    ///
+    /// The policy is parsed into AST.
+    ///
+    /// * `path`: Path to the policy file.
+    pub fn add_policy_from_file(&mut self, path: String) -> Result<()> {
+        self.engine.add_policy_from_file(path)
+    }
+
+    /// Add policy data.
+    ///
+    /// * `data`: Rego value. A Rego value is a number, bool, string, None
+    ///           or a list/set/map whose items themselves are Rego values.
+    pub fn add_data(&mut self, data: &PyAny) -> Result<()> {
+        let data = from(data)?;
+        self.engine.add_data(data)
+    }
+
+    /// Add policy data.
+    ///
+    /// * `data`: JSON encoded value to be used as policy data.
+    pub fn add_data_json(&mut self, data: String) -> Result<()> {
+        let data = Value::from_json_str(&data)?;
+        self.engine.add_data(data)
+    }
+
+    /// Add policy data from file.
+    ///
+    /// * `path`: Path to JSON policy data.
+    pub fn add_data_from_json_file(&mut self, path: String) -> Result<()> {
+        let data = Value::from_json_file(&path)?;
+        self.engine.add_data(data)
+    }
+
+    /// Clear policy data.
+    pub fn clear_data(&mut self) -> Result<()> {
+        self.engine.clear_data();
+        Ok(())
+    }
+
+    /// Set input.
+    ///
+    /// * `input`: Rego value. A Rego value is a number, bool, string, None
+    ///            or a list/set/map whose items themselves are Rego values.
+    pub fn set_input(&mut self, input: &PyAny) -> Result<()> {
+        let input = from(input)?;
+        self.engine.set_input(input);
+        Ok(())
+    }
+
+    /// Set input.
+    ///
+    /// * `input`: JSON encoded value to be used as input to query.
+    pub fn set_input_json(&mut self, input: String) -> Result<()> {
+        let input = Value::from_json_str(&input)?;
+        self.engine.set_input(input);
+        Ok(())
+    }
+
+    /// Set input.
+    ///
+    /// * `path`: Path to JSON input data.
+    pub fn set_input_from_json_file(&mut self, path: String) -> Result<()> {
+        let input = Value::from_json_file(&path)?;
+        self.engine.set_input(input);
+        Ok(())
+    }
+
+    /// Evaluate query.
+    ///
+    /// * `query`: Rego expression to be evaluate.
+    pub fn eval_query(&mut self, query: String, py: Python<'_>) -> Result<PyObject> {
+        let results = self.engine.eval_query(query, false)?;
+
+        let rlist = PyList::empty(py);
+        for result in results.result.into_iter() {
+            let rdict = PyDict::new(py);
+
+            let elist = PyList::empty(py);
+            for expr in result.expressions.into_iter() {
+                let edict = PyDict::new(py);
+                edict.set_item("value".to_object(py), to(expr.value, py)?)?;
+                edict.set_item("text".to_object(py), expr.text.as_ref().to_object(py))?;
+
+                let ldict = PyDict::new(py);
+                ldict.set_item("row".to_object(py), expr.location.row.to_object(py))?;
+                ldict.set_item("col".to_object(py), expr.location.col.to_object(py))?;
+
+                edict.set_item("location".to_object(py), ldict)?;
+                elist.append(edict)?;
+            }
+
+            rdict.set_item("expressions".to_object(py), elist)?;
+            rdict.set_item("bindings".to_object(py), to(result.bindings, py)?)?;
+            rlist.append(rdict)?;
+        }
+        let dict = PyDict::new(py);
+        dict.set_item("result".to_object(py), rlist)?;
+        Ok(dict.into())
+    }
+
+    /// Evaluate query. Returns result as JSON.
+    ///
+    /// * `query`: Rego expression to be evaluate.
+    pub fn eval_query_as_json(&mut self, query: String) -> Result<String> {
+        let results = self.engine.eval_query(query, false)?;
+        serde_json::to_string_pretty(&results).map_err(|e| anyhow!("{e}"))
+    }
+}
+
+#[pymodule]
+pub fn regorus(_py: Python<'_>, m: &PyModule) -> PyResult<()> {
+    m.add_class::<crate::Engine>()
+}

bindings/python/test.py

@@ -0,0 +1,52 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+
+import regorus
+
+# Create engine
+engine = regorus.Engine()
+
+# Load policies
+engine.add_policy_from_file('../../tests/aci/framework.rego')
+engine.add_policy_from_file('../../tests/aci/api.rego')
+engine.add_policy_from_file('../../tests/aci/policy.rego')
+
+# Add policy data
+data = {
+  "metadata": {
+    "devices": {
+      "/run/layers/p0-layer0": "1b80f120dbd88e4355d6241b519c3e25290215c469516b49dece9cf07175a766",
+      "/run/layers/p0-layer1": "e769d7487cc314d3ee748a4440805317c19262c7acd2fdbdb0d47d2e4613a15c",
+      "/run/layers/p0-layer2": "eb36921e1f82af46dfe248ef8f1b3afb6a5230a64181d960d10237a08cd73c79",
+      "/run/layers/p0-layer3": "41d64cdeb347bf236b4c13b7403b633ff11f1cf94dbc7cf881a44d6da88c5156",
+      "/run/layers/p0-layer4": "4dedae42847c704da891a28c25d32201a1ae440bce2aecccfa8e6f03b97a6a6c",
+      "/run/layers/p0-layer5": "fe84c9d5bfddd07a2624d00333cf13c1a9c941f3a261f13ead44fc6a93bc0e7a"
+    }
+  }
+}
+engine.add_data(data)
+
+# Set input
+input = {
+  "containerID": "container0",
+  "layerPaths": [
+    "/run/layers/p0-layer0",
+    "/run/layers/p0-layer1",
+    "/run/layers/p0-layer2",
+    "/run/layers/p0-layer3",
+    "/run/layers/p0-layer4",
+    "/run/layers/p0-layer5"
+  ],
+  "target": "/run/gcs/c/container0/rootfs"
+}
+engine.set_input(input)
+
+# Eval query
+results = engine.eval_query('data.framework.mount_overlay=x')
+
+# Print results
+print(results['result'][0])
+
+# Eval query as json
+results_json = engine.eval_query_as_json('data.framework.mount_overlay=x')
+print(results_json)

bindings/wasm/CHANGELOG.md

@@ -0,0 +1,14 @@
+# Changelog
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/microsoft/regorus/releases/tag/regorusjs-v0.1.0) - 2024-02-01
+
+### Other
+- Document bindings ([#119](https://github.com/microsoft/regorus/pull/119))
+- Python bindings ([#115](https://github.com/microsoft/regorus/pull/115))
+- WASM binding ([#114](https://github.com/microsoft/regorus/pull/114))

bindings/wasm/Cargo.toml

@@ -0,0 +1,19 @@
+[package]
+name = "regorusjs"
+version = "0.1.0"
+edition = "2021"
+repository = "https://github.com/microsoft/regorus/bindings/wasm"
+description = "WASM bindings for Regorus - a fast, lightweight Rego interpreter written in Rust"
+keywords = ["interpreter", "opa", "policy-as-code", "rego"]
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+[lib]
+crate-type = ["cdylib"]
+
+[dependencies]
+regorus = { path  = "../.." }
+serde_json = "1.0.111"
+wasm-bindgen = "0.2.90"
+
+[dev-dependencies]
+wasm-bindgen-test = "0.3.40"

bindings/wasm/README.md

@@ -0,0 +1,81 @@
+# regorusjs
+
+**Regorus** is
+
+  - *Rego*-*Rus(t)*  - A fast, light-weight [Rego](https://www.openpolicyagent.org/docs/latest/policy-language/)
+   interpreter written in Rust.
+  - *Rigorous* - A rigorous enforcer of well-defined Rego semantics.
+
+`regorusjs` is Regorus compiled into WASM.
+
+See [Repository](https://github.com/microsoft/regorus).
+
+To build this binding, see [building](https://github.com/microsoft/regorus/bindings/wasm/building.md)
+
+
+
+## Usage
+
+```javascript
+
+var regorus = require('regorusjs')
+
+// Create an engine.
+var engine = new regorus.Engine();
+
+// Add Rego policy.
+engine.add_policy(
+    // Associate this file name with policy
+    'hello.rego',
+    
+    // Rego policy
+`
+  package test
+  
+  # Join messages
+  message = concat(", ", [input.message, data.message])
+`)
+
+// Set policy data
+engine.add_data_json(`
+ {
+    "message" : "World!"
+ }
+`)
+
+// Set policy input
+engine.set_input_json(`
+ {
+	"message" : "Hello"
+ }
+`)
+
+// Eval query
+results = engine.eval_query('data.test.message')
+
+// Display
+console.log(results)
+// {
+//   "result": [
+//     {
+//       "expressions": [
+//         {
+//           "value": "Hello, World!",
+//           "text": "data.test.message",
+//           "location": {
+//             "row": 1,
+//             "col": 1
+//           }
+//         }
+//       ]
+//     }
+//   ]
+// }
+
+// Convert results to object
+results = JSON.parse(results)
+
+// Process result
+console.log(results.result[0].expressions[0].value)
+// Hello, World!
+```

bindings/wasm/building.md

@@ -0,0 +1,34 @@
+
+- Install `wasm-pack`
+  ```
+  cargo install wasm-pack
+  ```
+
+- Build `regorusjs` for nodejs.
+  ```
+  cd bindings/wasm
+  wasm-pack build --target nodejs --release
+  ```
+
+- Install [nodejs](https://nodejs.org/en/download)
+
+- Run the test script
+  ```
+  $ node test.js
+  \\{
+  \\  "result": [
+  \\    {
+  \\      "expressions": [
+  \\        {
+  \\          "value": "Hello, World!",
+  \\          "text": "data.test.message",
+  \\          "location": {
+  \\            "row": 1,
+  \\            "col": 1
+  \\          }
+  \\        }
+  \\      ]
+  \\    }
+  \\   ]
+  \\}
+  ```

bindings/wasm/src/lib.rs

@@ -0,0 +1,146 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+use wasm_bindgen::prelude::*;
+
+#[wasm_bindgen]
+/// WASM wrapper for [`regorus::Engine`]
+pub struct Engine {
+    engine: regorus::Engine,
+}
+
+fn error_to_jsvalue<E: std::fmt::Display>(e: E) -> JsValue {
+    JsValue::from_str(&format!("{e}"))
+}
+
+impl Default for Engine {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl Clone for Engine {
+    /// Clone a [`Engine`]
+    ///
+    /// To avoid having to parse same policy again, the engine can be cloned
+    /// after policies and data have been added.
+    fn clone(&self) -> Self {
+        Self {
+            engine: self.engine.clone(),
+        }
+    }
+}
+
+#[wasm_bindgen]
+impl Engine {
+    #[wasm_bindgen(constructor)]
+    /// Construct a new Engine
+    ///
+    /// See https://docs.rs/regorus/latest/regorus/struct.Engine.html
+    pub fn new() -> Self {
+        Self {
+            engine: regorus::Engine::new(),
+        }
+    }
+
+    /// Add a policy
+    ///
+    /// The policy is parsed into AST.
+    /// See https://docs.rs/regorus/latest/regorus/struct.Engine.html#method.add_policy
+    ///
+    /// * `path`: A filename to be associated with the policy.
+    /// * `rego`: Rego policy.
+    pub fn add_policy(&mut self, path: String, rego: String) -> Result<(), JsValue> {
+        self.engine.add_policy(path, rego).map_err(error_to_jsvalue)
+    }
+
+    /// Add policy data.
+    ///
+    /// See https://docs.rs/regorus/latest/regorus/struct.Engine.html#method.add_data
+    /// * `data`: JSON encoded value to be used as policy data.
+    pub fn add_data_json(&mut self, data: String) -> Result<(), JsValue> {
+        let data = regorus::Value::from_json_str(&data).map_err(error_to_jsvalue)?;
+        self.engine.add_data(data).map_err(error_to_jsvalue)
+    }
+
+    /// Clear policy data.
+    ///
+    /// See https://docs.rs/regorus/0.1.0-alpha.2/regorus/struct.Engine.html#method.clear_data
+    pub fn clear_data(&mut self) -> Result<(), JsValue> {
+        self.engine.clear_data();
+        Ok(())
+    }
+
+    /// Set input.
+    ///
+    /// See https://docs.rs/regorus/0.1.0-alpha.2/regorus/struct.Engine.html#method.set_input
+    /// * `input`: JSON encoded value to be used as input to query.
+    pub fn set_input_json(&mut self, input: String) -> Result<(), JsValue> {
+        let input = regorus::Value::from_json_str(&input).map_err(error_to_jsvalue)?;
+        self.engine.set_input(input);
+        Ok(())
+    }
+
+    /// Evaluate query.
+    ///
+    /// See https://docs.rs/regorus/0.1.0-alpha.2/regorus/struct.Engine.html#method.eval_query
+    /// * `query`: Rego expression to be evaluate.
+    pub fn eval_query(&mut self, query: String) -> Result<String, JsValue> {
+        let results = self
+            .engine
+            .eval_query(query, false)
+            .map_err(error_to_jsvalue)?;
+        serde_json::to_string_pretty(&results).map_err(error_to_jsvalue)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use wasm_bindgen::prelude::*;
+    use wasm_bindgen_test::wasm_bindgen_test;
+
+    #[wasm_bindgen_test]
+    pub fn basic() -> Result<(), JsValue> {
+        let mut engine = crate::Engine::new();
+
+        // Exercise all APIs.
+        engine.add_data_json(
+            r#"
+        {
+           "foo" : "bar"
+        }
+        "#
+            .to_string(),
+        )?;
+
+        engine.set_input_json(
+            r#"
+        {
+           "message" : "Hello"
+        }
+        "#
+            .to_string(),
+        )?;
+
+        engine.add_policy(
+            "hello.rego".to_string(),
+            r#"
+            package test
+            message = input.message"#
+                .to_string(),
+        )?;
+
+        let results = engine.eval_query("data".to_string())?;
+        let r = regorus::Value::from_json_str(&results).map_err(crate::error_to_jsvalue)?;
+
+        let v = &r["result"][0]["expressions"][0]["value"];
+
+        // Ensure that input and policy were evaluated.
+        assert_eq!(v["test"]["message"], regorus::Value::from("Hello"));
+
+        // Test that data was set.
+        assert_eq!(v["foo"], regorus::Value::from("bar"));
+
+        Ok(())
+    }
+}

bindings/wasm/test.js

@@ -0,0 +1,47 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+var regorus = require('./pkg/regorusjs')
+
+// Create an engine.
+var engine = new regorus.Engine();
+
+// Add Rego policy.
+engine.add_policy(
+    // Associate this file name with policy
+    'hello.rego',
+    
+    // Rego policy
+`
+  package test
+  
+  # Join messages
+  message = concat(", ", [input.message, data.message])
+`)
+
+// Set policy data
+engine.add_data_json(`
+ {
+    "message" : "World!"
+ }
+`)
+
+// Set policy input
+engine.set_input_json(`
+ {
+	"message" : "Hello"
+ }
+`)
+
+// Eval query
+results = engine.eval_query('data.test.message')
+
+// Display
+console.log(results)
+
+// Convert results to object
+results = JSON.parse(results)
+
+// Process result
+console.log(results.result[0].expressions[0].value)
+

docs/builtins.md

@@ -0,0 +1,239 @@
+# Built-in Functions
+
+
+This page lists all the supported Rego built-in functions and the cargo feature that is needed to enable each builtin.
+
+Those builtins that are not need for a specific use of the Regorus crate can be excluded from the binary by not specifying
+the corresponding feature. This is useful in Confidential Computing scenarios where
+  - There needs to be control over what a policy execution can and cannot do.
+  - There needs to be control over exactly what goes into the [Trusted Computing Base](https://en.wikipedia.org/wiki/Trusted_computing_base).
+
+Currently many builtins are `baked-in`, i.e. there is no way to exclude them from the TCB.
+In future, each builtin will be associated with a feature (many builtins could be associated with the same feature).
+
+- [Comparison](https://www.openpolicyagent.org/docs/latest/policy-reference/#comparison)
+  | Builtin                                                                                          | Feature |
+  |--------------------------------------------------------------------------------------------------|---------|
+  | [x == y](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-comparison-equal) | _       |
+  | [x > y](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-comparison-gt)     | _       |
+  | [x >= y](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-comparison-gte)   | _       |
+  | [x < y](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-comparison-lt)     | _       |
+  | [x <= y](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-comparison-lte)   | _       |
+  | [x != y](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-comparison-neq)   | _       |
+
+- [Numbers](https://www.openpolicyagent.org/docs/latest/policy-reference/#numbers)
+  | Builtin                                                                                                               | Feature |
+  |-----------------------------------------------------------------------------------------------------------------------|---------|
+  | [abs](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-numbers-abs)                              | _       |
+  | [ceil](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-numbers-ceil)                            | _       |
+  | [x / y](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-numbers-div)                            | _       |
+  | [floor](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-numbers-floor)                          | _       |
+  | [x - y](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-numbers-minus)                          | _       |
+  | [x * y](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-numbers-mul)                            | _       |
+  | [numbers.range](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-numbers-numbersrange)           | _       |
+  | [numbers.range_step](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-numbers-numbersrange_step) | _       |
+  | [x + y](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-numbers-plus)                           | _       |
+  | [rand.intn](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-numbers-randintn)                   | _       |
+  | [x % y](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-numbers-rem)                            | _       |
+  | [round](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-numbers-round)                          | _       |
+
+
+- [Aggregates](https://www.openpolicyagent.org/docs/latest/policy-reference/#aggregates)
+  | Builtin                                                                                             | Feature |
+  |-----------------------------------------------------------------------------------------------------|---------|
+  | [count](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-aggregates-count)     | _       |
+  | [max](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-aggregates-max)         | _       |
+  | [min](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-aggregates-min)         | _       |
+  | [product](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-aggregates-product) | _       |
+  | [sort](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-aggregates-sort)       | _       |
+  | [sum](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-aggregates-sum)         | _       |
+
+- [Arrays](https://www.openpolicyagent.org/docs/latest/policy-reference/#arrays-2)
+  | Builtin                                                                                                   | Feature |
+  |-----------------------------------------------------------------------------------------------------------|---------|
+  | [array.concat](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-array-arrayconcat)   | _       |
+  | [array.reverse](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-array-arrayreverse) | _       |
+  | [array.slice](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-array-arrayslice)     | _       |
+
+- [Sets](https://www.openpolicyagent.org/docs/latest/policy-reference/#sets-2)
+  | Builtin                                                                                                 | Feature |
+  |---------------------------------------------------------------------------------------------------------|---------|
+  | [x & y](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-sets-and)                 | _       |
+  | [intersection](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-sets-intersection) | _       |
+  | [x - y](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-sets-minus)               | _       |
+  | [x \| y](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-sets-or)                 | _       |
+  | [union](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-sets-union)               | _       |
+
+- [Objects](https://www.openpolicyagent.org/docs/latest/policy-reference/#object)
+  | Builtin                                                                                                              | Feature      |
+  |----------------------------------------------------------------------------------------------------------------------|--------------|
+  | [json.filter](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-object-jsonfilter)               | _            |
+  | [json.match_schema](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-object-jsonmatch_schema)   | `jsonschema` |
+  | [json.remove](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-object-jsonremove)               | _            |
+  | [json.verify_schema](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-object-jsonverify_schema) | `jsonschema` |
+  | [object.filter](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-object-objectfilter)           | _            |
+  | [object.get](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-object-objectget)                 | _            |
+  | [object.keys](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-object-objectkeys)               | _            |
+  | [object.remove](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-object-objectremove)           | _            |
+  | [object.subset](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-object-objectsubset)           | _            |
+  | [object.union](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-object-objectunion)             | _            |
+  | [object.union_n](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-object-objectunion_n)         | _            |
+
+- [Strings](https://www.openpolicyagent.org/docs/latest/policy-reference/#strings)
+  | Builtin                                                                                                                           | Feature |
+  |-----------------------------------------------------------------------------------------------------------------------------------|---------|
+  | [concat](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-strings-concat)                                    | _       |
+  | [contains](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-strings-contains)                                | _       |
+  | [endswith](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-strings-endswith)                                | _       |
+  | [format_int](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-strings-format_int)                            | _       |
+  | [indexof](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-strings-indexof)                                  | _       |
+  | [indexof_n](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-strings-indexof_n)                              | _       |
+  | [lower](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-strings-lower)                                      | _       |
+  | [replace](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-strings-replace)                                  | _       |
+  | [split](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-strings-split)                                      | _       |
+  | [sprintf](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-strings-sprintf)                                  | _       |
+  | [startswith](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-strings-startswith)                            | _       |
+  | [strings.any_prefix_match](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-strings-stringsany_prefix_match) | _       |
+  | [strings.any_suffix_match](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-strings-stringsany_suffix_match) | _       |
+  | [strings.render_template](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-strings-stringsrender_template)   | _       |
+  | [strings.replace_n](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-strings-stringsreplace_n)               | _       |
+  | [strings.reverse](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-strings-stringsreverse)                   | _       |
+  | [substring](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-strings-substring)                              | _       |
+  | [trim](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-strings-trim)                                        | _       |
+  | [trim_left](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-strings-trim_left)                              | _       |
+  | [trim_prefix](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-strings-trim_prefix)                          | _       |
+  | [trim_right](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-strings-trim_right)                            | _       |
+  | [trim_space](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-strings-trim_space)                            | _       |
+  | [trim_suffix](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-strings-trim_suffix)                          | _       |
+  | [upper](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-strings-upper)                                      | _       |
+
+- [Regex](https://www.openpolicyagent.org/docs/latest/policy-reference/#regex)
+  | Builtin                                                                                                                                         | Feature |
+  |-------------------------------------------------------------------------------------------------------------------------------------------------|---------|
+  | [regex.find_all_string_submatch_n](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-regex-regexfind_all_string_submatch_n) | `regex` |
+  | [regex.find_n](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-regex-regexfind_n)                                         | `regex` |
+  | [regex.globs_match](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-regex-regexglobs_match)                               | `regex` |
+  | [regex.is_valid](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-regex-regexis_valid)                                     | `regex` |
+  | [regex.match](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-regex-regexmatch)                                           | `regex` |
+  | [regex.replace](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-regex-regexreplace)                                       | `regex` |
+  | [regex.split](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-regex-regexsplit)                                           | `regex` |
+  | [regex.template_match](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-regex-regextemplate_match)                         | `regex` |
+
+- [Glob](https://www.openpolicyagent.org/docs/latest/policy-reference/#regex)
+  | Builtin                                                                                                      | Feature |
+  |--------------------------------------------------------------------------------------------------------------|---------|
+  | [glob.match](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-glob-globmatch)           | `glob`  |
+  | [glob.quote_meta](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-glob-globquote_meta) | `glob`  |
+
+- [Bitwise](https://www.openpolicyagent.org/docs/latest/policy-reference/#regex)
+  | Builtin                                                                                              | Feature |
+  |------------------------------------------------------------------------------------------------------|---------|
+  | [bits.and](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-bits-bitsand)       | _       |
+  | [bits.lsh](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-bits-bitslsh)       | _       |
+  | [bits.negate](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-bits-bitsnegate) | _       |
+  | [bits.or](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-bits-bitsor)         | _       |
+  | [bits.rsh](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-bits-bitsrsh)       | _       |
+  | [bits.xor](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-bits-bitsxor)       | _       |
+
+- [Conversions](https://www.openpolicyagent.org/docs/latest/policy-reference/#conversions)
+  | Builtin | Feature |
+  |-------|---------|
+  [to_number](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-conversions-to_number) | _ |
+|
+- [Units](https://www.openpolicyagent.org/docs/latest/policy-reference/#units)
+  | Builtin                                                                                                           | Feature |
+  |-------------------------------------------------------------------------------------------------------------------|---------|
+  | [units.parse](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-units-unitsparse)             | _       |
+  | [units.parse_bytes](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-units-unitsparse_bytes) | _       |
+
+- [Types](https://www.openpolicyagent.org/docs/latest/policy-reference/#types)
+  | Builtin                                                                                              | Feature |
+  |------------------------------------------------------------------------------------------------------|---------|
+  | [is_array](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-types-is_array)     | _       |
+  | [is_boolean](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-types-is_boolean) | _       |
+  | [is_null](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-types-is_null)       | _       |
+  | [is_number](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-types-is_number)   | _       |
+  | [is_object](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-types-is_object)   | _       |
+  | [is_set](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-types-is_set)         | _       |
+  | [is_string](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-types-is_string)   | _       |
+  | [type_name](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-types-type_name)   | _       |
+  
+- [Encoding](https://www.openpolicyagent.org/docs/latest/policy-reference/#encoding)
+  | Builtin                                                                                                                          | Feature     |
+  |----------------------------------------------------------------------------------------------------------------------------------|-------------|
+  | [base64.is_valid](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-base64is_valid)                 | `base64`    |
+  | [base64url.decode](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-base64urldecode)               | `base64`    |
+  | [base64url.encode](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-base64urlencode)               | `base64url` |
+  | [base64url.encode_no_pad](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-base64urlencode_no_pad) | `base64url` |
+  | [hex.decode](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-hexdecode)                           | `hex`       |
+  | [hex.encode](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-hexencode)                           | `hex`       |
+  | [json.is_valid](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-jsonis_valid)                     | _           |
+  | [json.marshal](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-jsonmarshal)                       | _           |
+  | [json.unmarshal](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-jsonunmarshal)                   | _           |
+  | [urlquery.decode](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-urlquerydecode)                 | `urlquery`  |
+  | [urlquery.decode_object](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-urlquerydecode_object)   | `urlquery`  |
+  | [urlquery.encode](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-urlqueryencode)                 | `urlquery`  |
+  | [urlquery.encode_object](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-urlqueryencode_object)   | `urlquery`  |
+  | [yaml.is_valid](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-yamlis_valid)                     | `yaml`      |
+  | [yaml.marshal](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-yamlmarshal)                       | `yaml`      |
+  | [yaml.unmarshal](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-yamlunmarshal)                   | `yaml`            |
+
+- [Time](https://www.openpolicyagent.org/docs/latest/policy-reference/#time)
+   | Builtin                                                                                                                    | Feature |
+   |----------------------------------------------------------------------------------------------------------------------------|---------|
+   | ([time.add_date](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-time-timeadd_date)                  | `time`  |
+   | [time.add_date](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-time-timeadd_date)                   | `time`  |
+   | [time.clock](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-time-timeclock)                         | `time`  |
+   | [time.date](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-time-timedate)                           | `time`  |
+   | [time.diff](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-time-timediff)                           | `time`  |
+   | [time.format](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-time-timeformat)                       | `time`  |
+   | [time.now_ns](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-time-timenow_ns)                       | `time`  |
+   | [time.parse_duration_ns](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-time-timeparse_duration_ns) | `time`  |
+   | [time.parse_ns](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-time-timeparse_ns)                   | `time`  |
+   | [time.parse_rfc3339_ns](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-time-timeparse_rfc3339_ns)   | `time`  |
+   | [time.weekday](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-time-timeweekday)                     | `time`  |
+
+- [Cryptography](https://www.openpolicyagent.org/docs/latest/policy-reference/#crypto)
+   | Builtin                                                                                                             | Feature  |
+   |---------------------------------------------------------------------------------------------------------------------|----------|
+   | [crypto.hmac.equal](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-crypto-cryptohmacequal)   | `crypto` |
+   | [crypto.hmac.md5](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-crypto-cryptohmacmd5)       | `crypto` |
+   | [crypto.hmac.sha1](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-crypto-cryptohmacsha1)     | `crypto` |
+   | [crypto.hmac.sha256](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-crypto-cryptohmacsha256) | `crypto` |
+   | [crypto.hmac.sha512](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-crypto-cryptohmacsha512) | `crypto` |
+   | [crypto.md5](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-crypto-cryptomd5)                | `crypto` |
+   | [crypto.sha1](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-crypto-cryptosha1)              | `crypto` |
+   | [crypto.sha256](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-crypto-cryptosha256)          | `crypto` |
+
+- [Graphs](https://www.openpolicyagent.org/docs/latest/policy-reference/#graph)
+   | Builtin                                                                                                       | Feature |
+   |---------------------------------------------------------------------------------------------------------------|---------|
+   | [graph.reachable](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-graph-graphreachable) | `graph` |
+   | [walk](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-graph-walk)                      | `graph` |
+
+- [UUID](https://www.openpolicyagent.org/docs/latest/policy-reference/#uuid)
+   | Builtin                                                                                                | Feature |
+   |--------------------------------------------------------------------------------------------------------|---------|
+   | [uuid.parse](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-uuid-uuidparse)     | `uuid`  |
+   | [uuid.rfc4122](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-uuid-uuidrfc4122) | `uuid`  |
+
+- [Semantic Versions](https://www.openpolicyagent.org/docs/latest/policy-reference/#semver)
+   | Builtin                                                                                                        | Feature  |
+   |----------------------------------------------------------------------------------------------------------------|----------|
+   | [semver.compare](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-semver-semvercompare)   | `semver` |
+   | [semver.is_valid](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-semver-semveris_valid) | `semver` |
+
+- [OPA](https://www.openpolicyagent.org/docs/latest/policy-reference/#opa
+   | Builtin                                                                                             | Feature |
+   |-----------------------------------------------------------------------------------------------------|---------|
+   | [opa.runtime](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-opa-oparuntime) | _       |
+
+- [Debugging](https://www.openpolicyagent.org/docs/latest/policy-reference/#opa)
+   | Builtin                                                                         | Feature |
+   |---------------------------------------------------------------------------------|---------|
+   | [print(...)](https://www.openpolicyagent.org/docs/latest/policy-reference/#opa) | _       |
+
+- [Tracing](https://www.openpolicyagent.org/docs/latest/policy-reference/#tracing)
+   | Builtin                                                                                      | Feature |
+   |----------------------------------------------------------------------------------------------|---------|
+   | [trace](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-tracing-trace) | _       |

scripts/pre-push

@@ -16,5 +16,5 @@ if [ -f Cargo.toml ]; then
    fi
 
    # Ensure that OPA conformance tests don't regress.
-   cargo test -r --test opa -- $(tr '\n' ' ' < tests/opa.passing)
+   cargo test -r --features opa-testutil --test opa -- $(tr '\n' ' ' < tests/opa.passing)
 fi

scripts/yaml-test-eval

@@ -1,8 +0,0 @@
-#!/bin/bash
-# Copyright (c) Microsoft Corporation.
-# Licensed under the MIT License.
-
-set -e
-yaml=$(realpath -e $1)
-
-RUST_BACKTRACE=1 cargo test interpreter::one_yaml -- --include-ignored --nocapture "$yaml"

scripts/yaml-test-parse

@@ -1,8 +0,0 @@
-#!/bin/bash
-# Copyright (c) Microsoft Corporation.
-# Licensed under the MIT License.
-
-set -e
-yaml=$(realpath -e $1)
-
-RUST_BACKTRACE=1 cargo test parser::one_yaml -- --include-ignored --nocapture "$yaml"

snippets/2.rego

@@ -1,23 +0,0 @@
-Cpackage play
-
-a := {4}
-
-mydoc(x) := path {
-  path := "data.play.a"
-}
-
-x := [ y |
-  y := data.play.a | data.play.b with data.play.a as {5} with data.play.b as {6}
-]
-
-r := [ m | m := data.play.p with data.play.p as 5 + 6; true  ]
-
-
-allow {
-	input.x 
-    == 5 
-    
-    input.y == 5
-    input.y 
-    == 5
-}

src/ast.rs

@@ -353,6 +353,7 @@ pub struct Module {
     pub package: Package,
     pub imports: Vec<Import>,
     pub policy: Vec<Ref<Rule>>,
+    pub rego_v1: bool,
 }
 
 pub type ExprRef = Ref<Expr>;

src/builtins/debugging.rs

@@ -28,11 +28,14 @@ fn print(span: &Span, _params: &[Ref<Expr>], args: &[Value], _strict: bool) -> R
     let mut msg = String::default();
     for a in args {
         match a {
-            Value::Undefined => msg += "<undefined>",
-            _ => msg += format!("{a}").as_str(),
+            Value::Undefined => msg += " <undefined>",
+            Value::String(s) => msg += &format!(" {s}"),
+            _ => msg += &format!(" {a}"),
         };
     }
 
-    span.message("print", msg.as_str());
+    if !msg.is_empty() {
+        println!("{}", &msg[1..]);
+    }
     Ok(Value::Bool(true))
 }

src/builtins/encoding.rs

@@ -3,14 +3,16 @@
 
 use crate::ast::{Expr, Ref};
 use crate::builtins;
+#[allow(unused)]
 use crate::builtins::utils::{
     ensure_args_count, ensure_object, ensure_string, ensure_string_collection,
 };
 use crate::lexer::Span;
 use crate::value::Value;
 
-use std::collections::{BTreeMap, HashMap};
+use std::collections::HashMap;
 
+#[allow(unused)]
 use anyhow::{anyhow, bail, Context, Result};
 
 pub fn register(m: &mut HashMap<&'static str, builtins::BuiltinFcn>) {
@@ -41,11 +43,6 @@ pub fn register(m: &mut HashMap<&'static str, builtins::BuiltinFcn>) {
     m.insert("json.is_valid", (json_is_valid, 1));
     m.insert("json.marshal", (json_marshal, 1));
     m.insert("json.unmarshal", (json_unmarshal, 1));
-    #[cfg(feature = "jsonschema")]
-    {
-        m.insert("json.match_schema", (json_match_schema, 2));
-        m.insert("json.verify_schema", (json_verify_schema, 1));
-    }
 
     #[cfg(feature = "yaml")]
     {
@@ -240,7 +237,7 @@ fn urlquery_decode_object(
         Err(_) => bail!(params[0].span().error("not a valid url query")),
     };
 
-    let mut map = BTreeMap::new();
+    let mut map = std::collections::BTreeMap::new();
     for (k, v) in url.query_pairs() {
         let key = Value::String(k.clone().into());
         let value = Value::String(v.clone().into());
@@ -382,72 +379,3 @@ fn json_unmarshal(
     let json_str = ensure_string(name, &params[0], &args[0])?;
     Value::from_json_str(&json_str).with_context(|| span.error("could not deserialize json."))
 }
-
-#[cfg(feature = "jsonschema")]
-fn compile_json_schema(param: &Ref<Expr>, arg: &Value) -> Result<jsonschema::JSONSchema> {
-    let schema_str = match arg {
-        Value::String(schema_str) => schema_str.as_ref().to_string(),
-        _ => arg.to_json_str()?,
-    };
-
-    if let Ok(schema) = serde_json::from_str(&schema_str) {
-        match jsonschema::JSONSchema::compile(&schema) {
-            Ok(schema) => return Ok(schema),
-            Err(e) => bail!(e.to_string()),
-        }
-    }
-    bail!(param.span().error("not a valid json schema"))
-}
-
-#[cfg(feature = "jsonschema")]
-fn json_verify_schema(
-    span: &Span,
-    params: &[Ref<Expr>],
-    args: &[Value],
-    strict: bool,
-) -> Result<Value> {
-    let name = "json.verify_schema";
-    ensure_args_count(span, name, params, args, 1)?;
-
-    Ok(Value::from_array(
-        match compile_json_schema(&params[0], &args[0]) {
-            Ok(_) => [Value::Bool(true), Value::Null],
-            Err(e) if strict => bail!(params[0]
-                .span()
-                .error(format!("invalid schema: {e}").as_str())),
-            Err(e) => [Value::Bool(false), Value::String(e.to_string().into())],
-        }
-        .to_vec(),
-    ))
-}
-
-#[cfg(feature = "jsonschema")]
-fn json_match_schema(
-    span: &Span,
-    params: &[Ref<Expr>],
-    args: &[Value],
-    strict: bool,
-) -> Result<Value> {
-    let name = "json.match_schema";
-    ensure_args_count(span, name, params, args, 2)?;
-
-    // The following is expected to succeed.
-    let document: serde_json::Value = serde_json::from_str(&args[0].to_json_str()?)?;
-
-    Ok(Value::from_array(
-        match compile_json_schema(&params[1], &args[1]) {
-            Ok(schema) => match schema.validate(&document) {
-                Ok(_) => [Value::Bool(true), Value::Null],
-                Err(e) => [
-                    Value::Bool(false),
-                    Value::from_array(e.map(|e| Value::String(e.to_string().into())).collect()),
-                ],
-            },
-            Err(e) if strict => bail!(params[1]
-                .span()
-                .error(format!("invalid schema: {e}").as_str())),
-            Err(e) => [Value::Bool(false), Value::String(e.to_string().into())],
-        }
-        .to_vec(),
-    ))
-}

src/builtins/objects.rs

@@ -23,6 +23,12 @@ pub fn register(m: &mut HashMap<&'static str, builtins::BuiltinFcn>) {
     m.insert("object.subset", (subset, 2));
     m.insert("object.union", (object_union, 2));
     m.insert("object.union_n", (object_union_n, 1));
+
+    #[cfg(feature = "jsonschema")]
+    {
+        m.insert("json.match_schema", (json_match_schema, 2));
+        m.insert("json.verify_schema", (json_verify_schema, 1));
+    }
 }
 
 fn json_filter_impl(v: &Value, filter: &Value) -> Value {
@@ -382,3 +388,72 @@ fn object_union_n(
 
     Ok(u)
 }
+
+#[cfg(feature = "jsonschema")]
+fn compile_json_schema(param: &Ref<Expr>, arg: &Value) -> Result<jsonschema::JSONSchema> {
+    let schema_str = match arg {
+        Value::String(schema_str) => schema_str.as_ref().to_string(),
+        _ => arg.to_json_str()?,
+    };
+
+    if let Ok(schema) = serde_json::from_str(&schema_str) {
+        match jsonschema::JSONSchema::compile(&schema) {
+            Ok(schema) => return Ok(schema),
+            Err(e) => bail!(e.to_string()),
+        }
+    }
+    bail!(param.span().error("not a valid json schema"))
+}
+
+#[cfg(feature = "jsonschema")]
+fn json_verify_schema(
+    span: &Span,
+    params: &[Ref<Expr>],
+    args: &[Value],
+    strict: bool,
+) -> Result<Value> {
+    let name = "json.verify_schema";
+    ensure_args_count(span, name, params, args, 1)?;
+
+    Ok(Value::from_array(
+        match compile_json_schema(&params[0], &args[0]) {
+            Ok(_) => [Value::Bool(true), Value::Null],
+            Err(e) if strict => bail!(params[0]
+                .span()
+                .error(format!("invalid schema: {e}").as_str())),
+            Err(e) => [Value::Bool(false), Value::String(e.to_string().into())],
+        }
+        .to_vec(),
+    ))
+}
+
+#[cfg(feature = "jsonschema")]
+fn json_match_schema(
+    span: &Span,
+    params: &[Ref<Expr>],
+    args: &[Value],
+    strict: bool,
+) -> Result<Value> {
+    let name = "json.match_schema";
+    ensure_args_count(span, name, params, args, 2)?;
+
+    // The following is expected to succeed.
+    let document: serde_json::Value = serde_json::from_str(&args[0].to_json_str()?)?;
+
+    Ok(Value::from_array(
+        match compile_json_schema(&params[1], &args[1]) {
+            Ok(schema) => match schema.validate(&document) {
+                Ok(_) => [Value::Bool(true), Value::Null],
+                Err(e) => [
+                    Value::Bool(false),
+                    Value::from_array(e.map(|e| Value::String(e.to_string().into())).collect()),
+                ],
+            },
+            Err(e) if strict => bail!(params[1]
+                .span()
+                .error(format!("invalid schema: {e}").as_str())),
+            Err(e) => [Value::Bool(false), Value::String(e.to_string().into())],
+        }
+        .to_vec(),
+    ))
+}

src/builtins/time.rs

@@ -12,8 +12,8 @@ use std::collections::HashMap;
 use anyhow::{anyhow, bail, Result};
 
 use chrono::{
-    DateTime, Datelike, Days, FixedOffset, Local, Months, NaiveDateTime, SecondsFormat, TimeZone,
-    Timelike, Utc, Weekday,
+    DateTime, Datelike, Days, FixedOffset, Local, Months, SecondsFormat, TimeZone, Timelike, Utc,
+    Weekday,
 };
 use chrono_tz::Tz;
 
@@ -124,7 +124,7 @@ fn format(span: &Span, params: &[Ref<Expr>], args: &[Value], _strict: bool) -> R
     let (datetime, format) = parse_epoch(name, &params[0], &args[0])?;
 
     let result = match format {
-        Some(format) => datetime.format(&format).to_string(),
+        Some(format) => compat::format(datetime, layout_with_predefined_formats(&format)),
         None => datetime.to_rfc3339_opts(SecondsFormat::AutoSi, true),
     };
 
@@ -159,7 +159,7 @@ fn parse_ns(span: &Span, params: &[Ref<Expr>], args: &[Value], strict: bool) ->
     let layout = ensure_string(name, &params[0], &args[0])?;
     let value = ensure_string(name, &params[1], &args[1])?;
 
-    let datetime = NaiveDateTime::parse_from_str(&value, &layout)?;
+    let datetime = compat::parse(layout_with_predefined_formats(&layout), &value)?;
     safe_timestamp_nanos(span, strict, datetime.timestamp_nanos_opt())
 }
 
@@ -275,3 +275,21 @@ fn parse_epoch(
         "`{fcn}` expects `ns` to be a `number` or `array[number, string]`. Got `{val}` instead"
     )))
 }
+
+fn layout_with_predefined_formats(format: &str) -> &str {
+    match format {
+        "ANSIC" => "Mon Jan _2 15:04:05 2006",
+        "UnixDate" => "Mon Jan _2 15:04:05 MST 2006",
+        "RubyDate" => "Mon Jan 02 15:04:05 -0700 2006",
+        "RFC822" => "02 Jan 06 15:04 MST",
+        // RFC822 with numeric zone
+        "RFC822Z" => "02 Jan 06 15:04 -0700",
+        "RFC850" => "Monday, 02-Jan-06 15:04:05 MST",
+        "RFC1123" => "Mon, 02 Jan 2006 15:04:05 MST",
+        // RFC1123 with numeric zone
+        "RFC1123Z" => "Mon, 02 Jan 2006 15:04:05 -0700",
+        "RFC3339" => "2006-01-02T15:04:05Z07:00",
+        "RFC3339Nano" => "2006-01-02T15:04:05.999999999Z07:00",
+        other => other,
+    }
+}

src/builtins/time/compat.rs

@@ -33,8 +33,13 @@
 
 use std::error::Error;
 use std::fmt;
+use std::iter;
 
-use chrono::Duration;
+use chrono::TimeZone;
+use chrono::{
+    format::{self, Fixed, Parsed},
+    DateTime, Duration, FixedOffset, ParseResult,
+};
 
 const NANOSECOND: u64 = 1;
 const MICROSECOND: u64 = 1000 * NANOSECOND;
@@ -250,8 +255,340 @@ fn leading_fraction(s: &str) -> (u64, f64, &str) {
     (num, scale, &s[last_idx..])
 }
 
+#[derive(Debug, Clone, PartialEq, Eq)]
+enum GoTimeFormatItemsMode {
+    Parse,
+    Format,
+}
+
+#[derive(Debug, Clone)]
+struct GoTimeFormatItems<'a> {
+    reminder: &'a str,
+    queue: &'static [format::Item<'static>],
+    mode: GoTimeFormatItemsMode,
+}
+
+impl<'a> GoTimeFormatItems<'a> {
+    fn parse(reminder: &str) -> GoTimeFormatItems {
+        GoTimeFormatItems {
+            reminder,
+            queue: &[],
+            mode: GoTimeFormatItemsMode::Parse,
+        }
+    }
+
+    fn format(reminder: &str) -> GoTimeFormatItems {
+        GoTimeFormatItems {
+            reminder,
+            queue: &[],
+            mode: GoTimeFormatItemsMode::Format,
+        }
+    }
+}
+
+impl<'a> Iterator for GoTimeFormatItems<'a> {
+    type Item = format::Item<'a>;
+
+    fn next(&mut self) -> Option<Self::Item> {
+        use format::{Fixed::*, Item::*, Numeric, Pad};
+
+        macro_rules! token {
+            ($prefix:expr, $kind:expr $(, $queue:expr)*) => {
+                if self.reminder.starts_with($prefix) {
+                    self.reminder = &self.reminder[$prefix.len()..];
+                    self.queue = &[$($queue),*];
+                    return Some($kind);
+                }
+            };
+        }
+
+        fn is_fractional_seconds(val: &str) -> bool {
+            // first char is either '.' or ','
+            let mut chars = val.chars().skip(1);
+            let Some(repeating @ ('0' | '9')) = chars.next() else {
+                return false;
+            };
+            let next = chars.find(|c| c != &repeating);
+            !matches!(next, Some('0'..='9'))
+        }
+
+        if let Some((item, reminder)) = self.queue.split_first() {
+            self.queue = reminder;
+            return Some(item.clone());
+        }
+
+        match self.reminder.chars().next() {
+            // January, Jan
+            Some('J') => {
+                token!("January", Fixed(LongMonthName));
+                token!("Jan", Fixed(ShortMonthName));
+            }
+
+            // Monday, Mon, MST
+            Some('M') => {
+                token!("Monday", Fixed(LongWeekdayName));
+                token!("Mon", Fixed(ShortWeekdayName));
+                token!("MST", Fixed(TimezoneName));
+            }
+
+            // 01, 02, 03, 04, 05, 06, 002
+            Some('0') => {
+                token!("002", Numeric(Numeric::Ordinal, Pad::Zero));
+                token!("01", Numeric(Numeric::Month, Pad::Zero));
+                token!("02", Numeric(Numeric::Day, Pad::Zero));
+                token!("03", Numeric(Numeric::Hour12, Pad::Zero));
+                token!("04", Numeric(Numeric::Minute, Pad::Zero));
+
+                if self.reminder.starts_with("05") {
+                    self.reminder = &self.reminder[2..];
+                    if !self.reminder.starts_with('.') && self.mode == GoTimeFormatItemsMode::Parse
+                    {
+                        self.queue = &[Fixed(Nanosecond)];
+                    }
+                    return Some(Numeric(Numeric::Second, Pad::Zero));
+                }
+
+                token!("06", Numeric(Numeric::YearMod100, Pad::Zero));
+            }
+
+            // 15, 1
+            Some('1') => {
+                use Numeric::*;
+                token!("15", Numeric(Hour, Pad::Zero));
+                token!("1", Numeric(Month, Pad::None));
+            }
+
+            // 2006, 2
+            Some('2') => {
+                use Numeric::*;
+                token!("2006", Numeric(Year, Pad::Zero));
+                token!("2", Numeric(Day, Pad::None));
+            }
+            // _2, _2006, __2
+            Some('_') => {
+                use Numeric::*;
+                token!("_2006", Literal("_"), Numeric(Year, Pad::None));
+                token!("__2", Numeric(Ordinal, Pad::Space));
+                token!("_2", Numeric(Day, Pad::Space));
+            }
+
+            Some('3') => {
+                use Numeric::*;
+                token!("3", Numeric(Hour12, Pad::None));
+            }
+
+            Some('4') => {
+                use Numeric::*;
+                token!("4", Numeric(Minute, Pad::None));
+            }
+
+            Some('5') => {
+                token!("5", Numeric(Numeric::Second, Pad::None), Fixed(Nanosecond));
+            }
+
+            // PM
+            Some('P') => {
+                token!("PM", Fixed(UpperAmPm));
+            }
+
+            // pm
+            Some('p') => {
+                token!("pm", Fixed(LowerAmPm));
+            }
+
+            // -070000, -07:00:00, -0700, -07:00, -07
+            Some('-') => {
+                token!("-070000", Fixed(TimezoneOffsetDoubleColon));
+                token!("-07:00:00", Fixed(TimezoneOffsetDoubleColon));
+
+                token!("-0700", Fixed(TimezoneOffset));
+                token!("-07:00", Fixed(TimezoneOffsetColon));
+
+                token!("-07", Fixed(TimezoneOffsetTripleColon));
+
+                token!("-", Literal("-"));
+            }
+
+            // Z070000, Z07:00:00, Z0700, Z07:00, Z07
+            Some('Z') => {
+                // token!("Z070000", Fixed(TimezoneOffsetDoubleColonZ));
+                // token!("Z07:00:00", Fixed(TimezoneOffsetDoubleColonZ));
+
+                token!("Z0700", Fixed(TimezoneOffsetZ));
+                token!("Z07:00", Fixed(TimezoneOffsetColonZ));
+
+                // token!("Z07", Fixed(TimezoneOffsetTripleColonZ));
+            }
+
+            // ,000, or .000, or ,999, or .999 - repeated digits for fractional seconds.
+            Some('.' | ',') if is_fractional_seconds(self.reminder) => {
+                token!(".000000000", Fixed(Nanosecond9));
+                token!(".00000000", Fixed(Nanosecond));
+                token!(".0000000", Fixed(Nanosecond));
+                token!(".000000", Fixed(Nanosecond6));
+                token!(".00000", Fixed(Nanosecond));
+                token!(".0000", Fixed(Nanosecond));
+                token!(".000", Fixed(Nanosecond3));
+                token!(".00", Fixed(Nanosecond));
+                token!(".0", Fixed(Nanosecond));
+                token!(".999999999", Fixed(Nanosecond));
+                token!(".99999999", Fixed(Nanosecond));
+                token!(".9999999", Fixed(Nanosecond));
+                token!(".999999", Fixed(Nanosecond));
+                token!(".99999", Fixed(Nanosecond));
+                token!(".9999", Fixed(Nanosecond));
+                token!(".999", Fixed(Nanosecond));
+                token!(".99", Fixed(Nanosecond));
+                token!(".9", Fixed(Nanosecond));
+                token!(".", Literal("."));
+
+                token!(",000000000", Fixed(Nanosecond9));
+                token!(",00000000", Fixed(Nanosecond));
+                token!(",0000000", Fixed(Nanosecond));
+                token!(",000000", Fixed(Nanosecond6));
+                token!(",00000", Fixed(Nanosecond));
+                token!(",0000", Fixed(Nanosecond));
+                token!(",000", Fixed(Nanosecond3));
+                token!(",00", Fixed(Nanosecond));
+                token!(",0", Fixed(Nanosecond));
+                token!(",999999999", Fixed(Nanosecond9));
+                token!(",99999999", Fixed(Nanosecond));
+                token!(",9999999", Fixed(Nanosecond));
+                token!(",999999", Fixed(Nanosecond6));
+                token!(",99999", Fixed(Nanosecond));
+                token!(",9999", Fixed(Nanosecond));
+                token!(",999", Fixed(Nanosecond3));
+                token!(",99", Fixed(Nanosecond));
+                token!(",9", Fixed(Nanosecond));
+                token!(",", Literal(","));
+            }
+            Some(c) if c.is_whitespace() => {
+                let next_non_ws = self
+                    .reminder
+                    .find(|c: char| !c.is_whitespace())
+                    .unwrap_or(self.reminder.len());
+
+                let literal = &self.reminder[..next_non_ws];
+                token!(&literal, Space(literal));
+            }
+
+            Some(_) => {
+                let literal = &self.reminder[..1];
+                token!(&literal, Literal(literal));
+            }
+
+            None => {}
+        }
+
+        None
+    }
+}
+
+// Adapted from chrono's `scan::timezone_offset_2822`:
+// https://github.com/chronotope/chrono/blob/baa55d084784e4e88b5332efe8e96af794a52e8a/src/format/scan.rs#L285-L322
+fn parse_legacy_timezone(parsed: &mut Parsed, val: &str) -> ParseResult<()> {
+    let upto = val
+        .as_bytes()
+        .iter()
+        .position(|&c| !c.is_ascii_alphabetic())
+        .unwrap_or(val.len());
+    if upto == 0 {
+        return Ok(());
+    }
+
+    let name = &val.as_bytes()[..upto];
+    if name.eq_ignore_ascii_case(b"gmt") || name.eq_ignore_ascii_case(b"ut") {
+        parsed.set_offset(0)
+    } else if name.eq_ignore_ascii_case(b"edt") {
+        parsed.set_offset(-4 * 3600)
+    } else if name.eq_ignore_ascii_case(b"est") || name.eq_ignore_ascii_case(b"cdt") {
+        parsed.set_offset(-5 * 3600)
+    } else if name.eq_ignore_ascii_case(b"cst") || name.eq_ignore_ascii_case(b"mdt") {
+        parsed.set_offset(-6 * 3600)
+    } else if name.eq_ignore_ascii_case(b"mst") || name.eq_ignore_ascii_case(b"pdt") {
+        parsed.set_offset(-7 * 3600)
+    } else if name.eq_ignore_ascii_case(b"pst") {
+        parsed.set_offset(-8 * 3600)
+    } else {
+        Ok(())
+    }
+}
+
+// Parses a date in Go's time format like 'Mon Jan _2 15:04:05 2006'.
+pub fn parse(layout: &str, value: &str) -> ParseResult<DateTime<FixedOffset>> {
+    let mut items = GoTimeFormatItems::parse(layout);
+    let mut parsed = Parsed::new();
+    let remainder = format::parse_and_remainder(
+        &mut parsed,
+        value,
+        items
+            .by_ref()
+            .take_while(|i| !matches!(i, format::Item::Fixed(Fixed::TimezoneName))),
+    )?;
+
+    // The reason for splitting parsing procedure to two part is handling legacy
+    // time zone names like EDT, EST etc. They are supported by chrono but not
+    // exposed to us. As a workaround, we copied chrono's implementation to
+    // `parse_legacy_timezone` function and whenever we encounter a
+    // `Fixed::TimezoneName` we stop parsing with our regular parser,
+    // parse timezone with `parse_legacy_timezone` and then continue parsing.
+    if !remainder.is_empty() {
+        parse_legacy_timezone(&mut parsed, remainder)?;
+
+        format::parse(
+            &mut parsed,
+            remainder,
+            iter::once(format::Item::Fixed(Fixed::TimezoneName)).chain(items),
+        )?;
+    }
+
+    // Go's `time.Parse` allows missing years but chrono fails to parse them,
+    // we're setting year field to `0` if year field is missing.
+    if parsed.year.is_none()
+        && parsed.year_div_100.is_none()
+        && parsed.year_mod_100.is_none()
+        && parsed.isoyear.is_none()
+        && parsed.isoyear_div_100.is_none()
+        && parsed.isoyear_mod_100.is_none()
+        && parsed.timestamp.is_none()
+    {
+        parsed.set_year(0)?;
+    }
+
+    // Go's `time.Parse` allows missing time (hour, minute, second) but
+    // chrono fails to parse them, we're setting time to `0` if time is missing.
+    if parsed.hour_div_12.is_none()
+        && parsed.hour_mod_12.is_none()
+        && parsed.minute.is_none()
+        && parsed.second.is_none()
+    {
+        parsed.set_hour(0)?;
+        parsed.set_minute(0)?;
+        parsed.set_second(0)?;
+    }
+
+    if parsed.offset.is_some() {
+        parsed.to_datetime()
+    } else {
+        let naive = parsed.to_naive_datetime_with_offset(0)?;
+        Ok(naive.and_utc().fixed_offset())
+    }
+}
+
+// Formats a date in Go's time format like 'Mon Jan _2 15:04:05 2006'.
+pub fn format<Tz: TimeZone>(date: DateTime<Tz>, fmt: &str) -> String
+where
+    Tz::Offset: fmt::Display,
+{
+    date.format_with_items(GoTimeFormatItems::format(fmt))
+        .to_string()
+}
+
 #[cfg(test)]
 mod tests {
+    use chrono::{Datelike, Month, TimeZone, Timelike, Weekday};
+    use chrono_tz::PST8PDT;
+
     use super::*;
 
     #[test]
@@ -353,4 +690,640 @@ mod tests {
             assert_eq!(dur, expected_dur);
         }
     }
+
+    #[test]
+    fn parses_datetimes() {
+        // Test cases are copied from Go's `time.Parse` tests:
+        // https://github.com/golang/go/blob/e9b3ff15f40d6b258217b3467c662f816b078477/src/time/format_test.go#L266-L339
+
+        struct ParseTest {
+            name: String,
+            format: String,
+            value: String,
+            has_tz: bool,       // contains a time zone
+            has_wd: bool,       // contains a weekday
+            year_sign: i32,     // sign of year, -1 indicates the year is not present in the format
+            frac_digits: usize, // number of digits of fractional second
+        }
+
+        fn parse_test_case(
+            name: &str,
+            format: &str,
+            value: &str,
+            has_tz: bool,
+            has_wd: bool,
+            year_sign: i32,
+            frac_digits: usize,
+        ) -> ParseTest {
+            ParseTest {
+                name: name.to_string(),
+                format: format.to_string(),
+                value: value.to_string(),
+                has_tz,
+                has_wd,
+                year_sign,
+                frac_digits,
+            }
+        }
+
+        fn check_time(time: DateTime<FixedOffset>, test_case: &ParseTest) {
+            // The time should be Thu Feb  4 21:00:57 PST 2010
+            if test_case.year_sign >= 0 {
+                assert_eq!(test_case.year_sign * time.year(), 2010);
+            }
+            assert_eq!(time.month0(), Month::February as u32);
+            assert_eq!(time.day(), 4);
+            assert_eq!(time.hour(), 21);
+            assert_eq!(time.minute(), 0);
+            assert_eq!(time.second(), 57);
+
+            let nanosec = "012345678"[..test_case.frac_digits].to_string()
+                + &"000000000"[..9 - test_case.frac_digits];
+            assert_eq!(time.nanosecond(), nanosec.parse::<u32>().unwrap());
+
+            if test_case.has_tz {
+                assert_eq!(time.timezone().local_minus_utc(), -28800);
+            }
+
+            if test_case.has_wd {
+                assert_eq!(time.weekday(), Weekday::Thu);
+            }
+        }
+
+        let test_cases = vec![
+            parse_test_case(
+                "ANSIC",
+                ANSIC,
+                "Thu Feb  4 21:00:57 2010",
+                false,
+                true,
+                1,
+                0,
+            ),
+            parse_test_case(
+                "UnixDate",
+                UNIX_DATE,
+                "Thu Feb  4 21:00:57 PST 2010",
+                true,
+                true,
+                1,
+                0,
+            ),
+            parse_test_case(
+                "RubyDate",
+                RUBY_DATE,
+                "Thu Feb 04 21:00:57 -0800 2010",
+                true,
+                true,
+                1,
+                0,
+            ),
+            parse_test_case(
+                "RFC850",
+                RFC850,
+                "Thursday, 04-Feb-10 21:00:57 PST",
+                true,
+                true,
+                1,
+                0,
+            ),
+            parse_test_case(
+                "RFC1123",
+                RFC1123,
+                "Thu, 04 Feb 2010 21:00:57 PST",
+                true,
+                true,
+                1,
+                0,
+            ),
+            // parse_test_case(
+            //     "RFC1123",
+            //     RFC1123,
+            //     "Thu, 04 Feb 2010 22:00:57 PDT",
+            //     true,
+            //     true,
+            //     1,
+            //     0,
+            // ),
+            parse_test_case(
+                "RFC1123Z",
+                RFC1123Z,
+                "Thu, 04 Feb 2010 21:00:57 -0800",
+                true,
+                true,
+                1,
+                0,
+            ),
+            parse_test_case(
+                "RFC3339",
+                RFC3339,
+                "2010-02-04T21:00:57-08:00",
+                true,
+                false,
+                1,
+                0,
+            ),
+            // parse_test_case(
+            //     "custom: \"2006-01-02 15:04:05-07\"",
+            //     "2006-01-02 15:04:05-07",
+            //     "2010-02-04 21:00:57-08",
+            //     true,
+            //     false,
+            //     1,
+            //     0,
+            // ),
+            // Optional fractional seconds.
+            parse_test_case(
+                "ANSIC",
+                ANSIC,
+                "Thu Feb  4 21:00:57.0 2010",
+                false,
+                true,
+                1,
+                1,
+            ),
+            parse_test_case(
+                "UnixDate",
+                UNIX_DATE,
+                "Thu Feb  4 21:00:57.01 PST 2010",
+                true,
+                true,
+                1,
+                2,
+            ),
+            parse_test_case(
+                "RubyDate",
+                RUBY_DATE,
+                "Thu Feb 04 21:00:57.012 -0800 2010",
+                true,
+                true,
+                1,
+                3,
+            ),
+            parse_test_case(
+                "RFC850",
+                RFC850,
+                "Thursday, 04-Feb-10 21:00:57.0123 PST",
+                true,
+                true,
+                1,
+                4,
+            ),
+            parse_test_case(
+                "RFC1123",
+                RFC1123,
+                "Thu, 04 Feb 2010 21:00:57.01234 PST",
+                true,
+                true,
+                1,
+                5,
+            ),
+            parse_test_case(
+                "RFC1123Z",
+                RFC1123Z,
+                "Thu, 04 Feb 2010 21:00:57.01234 -0800",
+                true,
+                true,
+                1,
+                5,
+            ),
+            parse_test_case(
+                "RFC3339",
+                RFC3339,
+                "2010-02-04T21:00:57.012345678-08:00",
+                true,
+                false,
+                1,
+                9,
+            ),
+            parse_test_case(
+                "custom: \"2006-01-02 15:04:05\"",
+                "2006-01-02 15:04:05",
+                "2010-02-04 21:00:57.0",
+                false,
+                false,
+                1,
+                0,
+            ),
+            // Amount of white space should not matter.
+            parse_test_case("ANSIC", ANSIC, "Thu Feb 4 21:00:57 2010", false, true, 1, 0),
+            parse_test_case(
+                "ANSIC",
+                ANSIC,
+                "Thu      Feb     4     21:00:57     2010",
+                false,
+                true,
+                1,
+                0,
+            ),
+            // Case should not matter
+            parse_test_case("ANSIC", ANSIC, "THU FEB 4 21:00:57 2010", false, true, 1, 0),
+            parse_test_case("ANSIC", ANSIC, "thu feb 4 21:00:57 2010", false, true, 1, 0),
+            // Fractional seconds.
+            parse_test_case(
+                "millisecond:: dot separator",
+                "Mon Jan _2 15:04:05.000 2006",
+                "Thu Feb  4 21:00:57.012 2010",
+                false,
+                true,
+                1,
+                3,
+            ),
+            parse_test_case(
+                "microsecond:: dot separator",
+                "Mon Jan _2 15:04:05.000000 2006",
+                "Thu Feb  4 21:00:57.012345 2010",
+                false,
+                true,
+                1,
+                6,
+            ),
+            parse_test_case(
+                "nanosecond:: dot separator",
+                "Mon Jan _2 15:04:05.000000000 2006",
+                "Thu Feb  4 21:00:57.012345678 2010",
+                false,
+                true,
+                1,
+                9,
+            ),
+            parse_test_case(
+                "millisecond:: comma separator",
+                "Mon Jan _2 15:04:05,000 2006",
+                "Thu Feb  4 21:00:57.012 2010",
+                false,
+                true,
+                1,
+                3,
+            ),
+            parse_test_case(
+                "microsecond:: comma separator",
+                "Mon Jan _2 15:04:05,000000 2006",
+                "Thu Feb  4 21:00:57.012345 2010",
+                false,
+                true,
+                1,
+                6,
+            ),
+            parse_test_case(
+                "nanosecond:: comma separator",
+                "Mon Jan _2 15:04:05,000000000 2006",
+                "Thu Feb  4 21:00:57.012345678 2010",
+                false,
+                true,
+                1,
+                9,
+            ),
+            // Leading zeros in other places should not be taken as fractional seconds.
+            parse_test_case(
+                "zero1",
+                "2006.01.02.15.04.05.0",
+                "2010.02.04.21.00.57.0",
+                false,
+                false,
+                1,
+                1,
+            ),
+            parse_test_case(
+                "zero2",
+                "2006.01.02.15.04.05.00",
+                "2010.02.04.21.00.57.01",
+                false,
+                false,
+                1,
+                2,
+            ),
+            // Month and day names only match when not followed by a lower-case letter.
+            // parse_test_case(
+            //     "Janet",
+            //     "Hi Janet, the Month is January: Jan _2 15:04:05 2006",
+            //     "Hi Janet, the Month is February: Feb  4 21:00:57 2010",
+            //     false,
+            //     true,
+            //     1,
+            //     0,
+            // ),
+            // GMT with offset.
+            // parse_test_case(
+            //     "GMT-8",
+            //     UNIX_DATE,
+            //     "Fri Feb  5 05:00:57 GMT-8 2010",
+            //     true,
+            //     true,
+            //     1,
+            //     0,
+            // ),
+            // Accept any number of fractional second digits (including none) for .999...
+            // In Go 1, .999... was completely ignored in the format, meaning the first two
+            // cases would succeed, but the next four would not. Go 1.1 accepts all six.
+            // decimal "." separator.
+            parse_test_case(
+                "",
+                "2006-01-02 15:04:05.9999 -0700 MST",
+                "2010-02-04 21:00:57 -0800 PST",
+                true,
+                false,
+                1,
+                0,
+            ),
+            parse_test_case(
+                "",
+                "2006-01-02 15:04:05.999999999 -0700 MST",
+                "2010-02-04 21:00:57 -0800 PST",
+                true,
+                false,
+                1,
+                0,
+            ),
+            parse_test_case(
+                "",
+                "2006-01-02 15:04:05.9999 -0700 MST",
+                "2010-02-04 21:00:57.0123 -0800 PST",
+                true,
+                false,
+                1,
+                4,
+            ),
+            parse_test_case(
+                "",
+                "2006-01-02 15:04:05.999999999 -0700 MST",
+                "2010-02-04 21:00:57.0123 -0800 PST",
+                true,
+                false,
+                1,
+                4,
+            ),
+            parse_test_case(
+                "",
+                "2006-01-02 15:04:05.9999 -0700 MST",
+                "2010-02-04 21:00:57.012345678 -0800 PST",
+                true,
+                false,
+                1,
+                9,
+            ),
+            parse_test_case(
+                "",
+                "2006-01-02 15:04:05.999999999 -0700 MST",
+                "2010-02-04 21:00:57.012345678 -0800 PST",
+                true,
+                false,
+                1,
+                9,
+            ),
+            // comma "," separator.
+            parse_test_case(
+                "",
+                "2006-01-02 15:04:05,9999 -0700 MST",
+                "2010-02-04 21:00:57 -0800 PST",
+                true,
+                false,
+                1,
+                0,
+            ),
+            parse_test_case(
+                "",
+                "2006-01-02 15:04:05,999999999 -0700 MST",
+                "2010-02-04 21:00:57 -0800 PST",
+                true,
+                false,
+                1,
+                0,
+            ),
+            parse_test_case(
+                "",
+                "2006-01-02 15:04:05,9999 -0700 MST",
+                "2010-02-04 21:00:57.0123 -0800 PST",
+                true,
+                false,
+                1,
+                4,
+            ),
+            parse_test_case(
+                "",
+                "2006-01-02 15:04:05,999999999 -0700 MST",
+                "2010-02-04 21:00:57.0123 -0800 PST",
+                true,
+                false,
+                1,
+                4,
+            ),
+            parse_test_case(
+                "",
+                "2006-01-02 15:04:05,9999 -0700 MST",
+                "2010-02-04 21:00:57.012345678 -0800 PST",
+                true,
+                false,
+                1,
+                9,
+            ),
+            parse_test_case(
+                "",
+                "2006-01-02 15:04:05,999999999 -0700 MST",
+                "2010-02-04 21:00:57.012345678 -0800 PST",
+                true,
+                false,
+                1,
+                9,
+            ),
+            // issue 4502.
+            parse_test_case(
+                "",
+                STAMP_NANO,
+                "Feb  4 21:00:57.012345678",
+                false,
+                false,
+                -1,
+                9,
+            ),
+            parse_test_case(
+                "",
+                "Jan _2 15:04:05.999",
+                "Feb  4 21:00:57.012300000",
+                false,
+                false,
+                -1,
+                4,
+            ),
+            parse_test_case(
+                "",
+                "Jan _2 15:04:05.999",
+                "Feb  4 21:00:57.012345678",
+                false,
+                false,
+                -1,
+                9,
+            ),
+            parse_test_case(
+                "",
+                "Jan _2 15:04:05.999999999",
+                "Feb  4 21:00:57.0123",
+                false,
+                false,
+                -1,
+                4,
+            ),
+            parse_test_case(
+                "",
+                "Jan _2 15:04:05.999999999",
+                "Feb  4 21:00:57.012345678",
+                false,
+                false,
+                -1,
+                9,
+            ),
+            // Day of year.
+            parse_test_case(
+                "",
+                "2006-01-02 002 15:04:05",
+                "2010-02-04 035 21:00:57",
+                false,
+                false,
+                1,
+                0,
+            ),
+            parse_test_case(
+                "",
+                "2006-01 002 15:04:05",
+                "2010-02 035 21:00:57",
+                false,
+                false,
+                1,
+                0,
+            ),
+            parse_test_case(
+                "",
+                "2006-002 15:04:05",
+                "2010-035 21:00:57",
+                false,
+                false,
+                1,
+                0,
+            ),
+            parse_test_case(
+                "",
+                "200600201 15:04:05",
+                "201003502 21:00:57",
+                false,
+                false,
+                1,
+                0,
+            ),
+            // parse_test_case(
+            //     "",
+            //     "200600204 15:04:05",
+            //     "201003504 21:00:57",
+            //     false,
+            //     false,
+            //     1,
+            //     0,
+            // ),
+        ];
+
+        for tc in test_cases {
+            println!("Test case {}", tc.name);
+            let time = parse(&tc.format, &tc.value).unwrap();
+            check_time(time, &tc);
+        }
+    }
+
+    #[test]
+    fn formats_datetimes() {
+        // Test cases are copied from Go's `time.Format` tests:
+        // https://github.com/golang/go/blob/e9b3ff15f40d6b258217b3467c662f816b078477/src/time/format_test.go#L144-L176
+
+        struct FormatTest {
+            name: String,
+            format: String,
+            result: String,
+        }
+
+        fn format_test_case(name: &str, format: &str, result: &str) -> FormatTest {
+            FormatTest {
+                name: name.to_string(),
+                format: format.to_string(),
+                result: result.to_string(),
+            }
+        }
+
+        let test_cases = vec![
+            format_test_case("ANSIC", ANSIC, "Wed Feb  4 21:00:57 2009"),
+            format_test_case("UnixDate", UNIX_DATE, "Wed Feb  4 21:00:57 PST 2009"),
+            format_test_case("RubyDate", RUBY_DATE, "Wed Feb 04 21:00:57 -0800 2009"),
+            format_test_case("RFC822", RFC822, "04 Feb 09 21:00 PST"),
+            format_test_case("RFC850", RFC850, "Wednesday, 04-Feb-09 21:00:57 PST"),
+            format_test_case("RFC1123", RFC1123, "Wed, 04 Feb 2009 21:00:57 PST"),
+            format_test_case("RFC1123Z", RFC1123Z, "Wed, 04 Feb 2009 21:00:57 -0800"),
+            format_test_case("RFC3339", RFC3339, "2009-02-04T21:00:57-08:00"),
+            // format_test_case(
+            //     "RFC3339Nano",
+            //     RFC3339_NANO,
+            //     "2009-02-04T21:00:57.0123456-08:00",
+            // ),
+            format_test_case("Kitchen", KITCHEN, "9:00PM"),
+            format_test_case("am/pm", "3pm", "9pm"),
+            format_test_case("AM/PM", "3PM", "9PM"),
+            format_test_case("two-digit year", "06 01 02", "09 02 04"),
+            // Three-letter months and days must not be followed by lower-case letter.
+            // format_test_case(
+            //     "Janet",
+            //     "Hi Janet, the Month is January",
+            //     "Hi Janet, the Month is February",
+            // ),
+            // Time stamps, Fractional seconds.
+            format_test_case("Stamp", STAMP, "Feb  4 21:00:57"),
+            format_test_case("StampMilli", STAMP_MILLI, "Feb  4 21:00:57.012"),
+            format_test_case("StampMicro", STAMP_MICRO, "Feb  4 21:00:57.012345"),
+            format_test_case("StampNano", STAMP_NANO, "Feb  4 21:00:57.012345600"),
+            format_test_case("DateTime", DATE_TIME, "2009-02-04 21:00:57"),
+            format_test_case("DateOnly", DATE_ONLY, "2009-02-04"),
+            format_test_case("TimeOnly", TIME_ONLY, "21:00:57"),
+            format_test_case("YearDay", "Jan  2 002 __2 2", "Feb  4 035  35 4"),
+            // format_test_case("Year", "2006 6 06 _6 __6 ___6", "2009 6 09 _6 __6 ___6"),
+            // format_test_case("Month", "Jan January 1 01 _1", "Feb February 2 02 _2"),
+            format_test_case("DayOfMonth", "2 02 _2 __2", "4 04  4  35"),
+            format_test_case("DayOfWeek", "Mon Monday", "Wed Wednesday"),
+            // format_test_case("Hour", "15 3 03 _3", "21 9 09 _9"),
+            // format_test_case("Minute", "4 04 _4", "0 00 _0"),
+            // format_test_case("Second", "5 05 _5", "57 57 _57"),
+        ];
+
+        // The numeric time represents Thu Feb  4 21:00:57.012345600 PST 2009
+        let time = PST8PDT.timestamp_nanos(1233810057012345600);
+
+        for tc in test_cases {
+            println!("Test case {}", tc.name);
+            let result = format(time, &tc.format);
+            assert_eq!(result, tc.result);
+        }
+    }
+
+    #[test]
+    fn parses_date_only() {
+        let time = parse("2006-01-02", "2020-02-02").unwrap();
+        assert_eq!(time.year(), 2020);
+        assert_eq!(time.month(), 2);
+        assert_eq!(time.day(), 2);
+    }
+
+    const _LAYOUT: &str = "01/02 03:04:05PM '06 -0700"; // The reference time, in numerical order.
+    const ANSIC: &str = "Mon Jan _2 15:04:05 2006";
+    const UNIX_DATE: &str = "Mon Jan _2 15:04:05 MST 2006";
+    const RUBY_DATE: &str = "Mon Jan 02 15:04:05 -0700 2006";
+    const RFC822: &str = "02 Jan 06 15:04 MST";
+    const _RFC822Z: &str = "02 Jan 06 15:04 -0700"; // RFC822 with numeric zone
+    const RFC850: &str = "Monday, 02-Jan-06 15:04:05 MST";
+    const RFC1123: &str = "Mon, 02 Jan 2006 15:04:05 MST";
+    const RFC1123Z: &str = "Mon, 02 Jan 2006 15:04:05 -0700"; // RFC1123 with numeric zone
+    const RFC3339: &str = "2006-01-02T15:04:05Z07:00";
+    const _RFC3339_NANO: &str = "2006-01-02T15:04:05.999999999Z07:00";
+    const KITCHEN: &str = "3:04PM";
+    // Handy time stamps.
+    const STAMP: &str = "Jan _2 15:04:05";
+    const STAMP_MILLI: &str = "Jan _2 15:04:05.000";
+    const STAMP_MICRO: &str = "Jan _2 15:04:05.000000";
+    const STAMP_NANO: &str = "Jan _2 15:04:05.000000000";
+    const DATE_TIME: &str = "2006-01-02 15:04:05";
+    const DATE_ONLY: &str = "2006-01-02";
+    const TIME_ONLY: &str = "15:04:05";
 }

src/builtins/time/diff.rs

@@ -2,7 +2,7 @@
 // Licensed under the MIT and Apache 2.0 License.
 
 use anyhow::{anyhow, Result};
-use chrono::{DateTime, Datelike, FixedOffset, TimeZone, Timelike, Utc};
+use chrono::{DateTime, Datelike, FixedOffset, NaiveDate, Timelike};
 
 // Adapted from the official Go implementation:
 // https://github.com/open-policy-agent/opa/blob/eb17a716b97720a27c6569395ba7c4b7409aae87/topdown/time.go#L179-L243
@@ -12,7 +12,6 @@ pub fn diff_between_datetimes(
 ) -> Result<(i32, i32, i32, i32, i32, i32)> {
     // The following implementation of this function is taken
     // from https://github.com/icza/gox licensed under Apache 2.0.
-    // The only modification made is to variable names.
     //
     // For details, see https://stackoverflow.com/a/36531443/1705598
     //
@@ -50,12 +49,9 @@ pub fn diff_between_datetimes(
         day -= 1;
     }
     if day < 0 {
-        // Days in month:
-        let t = Utc
-            .with_ymd_and_hms(datetime1.year(), datetime1.month(), 32, 0, 0, 0)
-            .single()
+        let days_in_month = days_in_month(datetime1.year(), datetime1.month())
             .ok_or(anyhow!("Could not convert `ns1` to datetime"))?;
-        day += 32 - t.day() as i32;
+        day += days_in_month as i32;
         month -= 1;
     }
     if month < 0 {
@@ -67,3 +63,21 @@ pub fn diff_between_datetimes(
 
     Ok((year, month, day, hour, min, sec))
 }
+
+fn days_in_month(year: i32, month: u32) -> Option<i64> {
+    Some(
+        NaiveDate::from_ymd_opt(
+            match month {
+                12 => year + 1,
+                _ => year,
+            },
+            match month {
+                12 => 1,
+                _ => month + 1,
+            },
+            1,
+        )?
+        .signed_duration_since(NaiveDate::from_ymd_opt(year, month, 1)?)
+        .num_days(),
+    )
+}

src/engine.rs

@@ -8,12 +8,15 @@ use crate::parser::*;
 use crate::scheduler::*;
 use crate::utils::gather_functions;
 use crate::value::*;
+use crate::{Extension, QueryResults};
 
 use std::convert::AsRef;
 use std::path::Path;
 
-use anyhow::Result;
+use anyhow::{bail, Result};
 
+/// The Rego evaluation engine.
+///
 #[derive(Clone)]
 pub struct Engine {
     modules: Vec<Ref<Module>>,
@@ -21,6 +24,7 @@ pub struct Engine {
     prepared: bool,
 }
 
+/// Create a default engine.
 impl Default for Engine {
     fn default() -> Self {
         Self::new()
@@ -28,6 +32,7 @@ impl Default for Engine {
 }
 
 impl Engine {
+    /// Create an instance of [Engine].
     pub fn new() -> Self {
         Self {
             modules: vec![],
@@ -36,6 +41,29 @@ impl Engine {
         }
     }
 
+    /// Add a policy.
+    ///
+    /// The policy file will be parsed and converted to AST representation.
+    /// Multiple policy files may be added to the engine.
+    ///
+    /// * `path`: A filename to be associated with the policy.
+    /// * `rego`: The rego policy code.
+    ///
+    /// ```
+    /// # use regorus::*;
+    /// # fn main() -> anyhow::Result<()> {
+    /// let mut engine = Engine::new();
+    ///
+    /// engine.add_policy(
+    ///    "test.rego".to_string(),
+    ///    r#"
+    ///    package test
+    ///    allow = input.user == "root"
+    ///    "#.to_string())?;
+    /// # Ok(())
+    /// # }
+    /// ```
+    ///
     pub fn add_policy(&mut self, path: String, rego: String) -> Result<()> {
         let source = Source::new(path, rego);
         let mut parser = Parser::new(&source)?;
@@ -45,6 +73,22 @@ impl Engine {
         Ok(())
     }
 
+    /// Add a policy from a given file.
+    ///
+    /// The policy file will be parsed and converted to AST representation.
+    /// Multiple policy files may be added to the engine.
+    ///
+    /// * `path`: Path to the policy file (.rego).
+    ///
+    /// ```
+    /// # use regorus::*;
+    /// # fn main() -> anyhow::Result<()> {
+    /// let mut engine = Engine::new();
+    ///
+    /// engine.add_policy_from_file("tests/aci/framework.rego")?;
+    /// # Ok(())
+    /// # }
+    /// ```
     pub fn add_policy_from_file<P: AsRef<Path>>(&mut self, path: P) -> Result<()> {
         let source = Source::from_file(path)?;
         let mut parser = Parser::new(&source)?;
@@ -53,28 +97,166 @@ impl Engine {
         Ok(())
     }
 
+    /// Set the input document.
+    ///
+    /// * `input`: Input documented. Typically this [Value] is constructed from JSON or YAML.
+    ///
+    /// ```
+    /// # use regorus::*;
+    /// # fn main() -> anyhow::Result<()> {
+    /// let mut engine = Engine::new();
+    ///
+    /// let input = Value::from_json_str(r#"
+    /// {
+    ///   "role" : "admin",
+    ///   "action": "delete"
+    /// }"#)?;
+    ///
+    /// engine.set_input(input);
+    /// # Ok(())
+    /// # }
+    /// ```
     pub fn set_input(&mut self, input: Value) {
         self.interpreter.set_input(input);
     }
 
+    /// Clear the data document.
+    ///
+    /// The data document will be reset to an empty object.
+    ///
+    /// ```
+    /// # use regorus::*;
+    /// # fn main() -> anyhow::Result<()> {
+    /// let mut engine = Engine::new();
+    ///
+    /// engine.clear_data();
+    ///
+    /// // Evaluate data.
+    /// let results = engine.eval_query("data".to_string(), false)?;
+    ///
+    /// // Assert that it is empty object.
+    /// assert_eq!(results.result.len(), 1);
+    /// assert_eq!(results.result[0].expressions.len(), 1);
+    /// assert_eq!(results.result[0].expressions[0].value, Value::new_object());
+    /// # Ok(())
+    /// # }
+    /// ```
     pub fn clear_data(&mut self) {
         self.interpreter.set_data(Value::new_object());
         self.prepared = false;
     }
 
+    /// Add data document.
+    ///
+    /// The specified data document is merged into existing data document.
+    ///
+    /// ```
+    /// # use regorus::*;
+    /// # fn main() -> anyhow::Result<()> {
+    /// let mut engine = Engine::new();
+    ///
+    /// // Only objects can be added.
+    /// assert!(engine.add_data(Value::from_json_str("[]")?).is_err());
+    ///
+    /// // Merge { "x" : 1, "y" : {} }
+    /// assert!(engine.add_data(Value::from_json_str(r#"{ "x" : 1, "y" : {}}"#)?).is_ok());
+    ///
+    /// // Merge { "z" : 2 }
+    /// assert!(engine.add_data(Value::from_json_str(r#"{ "z" : 2 }"#)?).is_ok());
+    ///
+    /// // Merge { "z" : 3 }. Conflict error.
+    /// assert!(engine.add_data(Value::from_json_str(r#"{ "z" : 3 }"#)?).is_err());
+    ///
+    /// assert_eq!(
+    ///   engine.eval_query("data".to_string(), false)?.result[0].expressions[0].value,
+    ///   Value::from_json_str(r#"{ "x": 1, "y": {}, "z": 2}"#)?
+    /// );
+    /// # Ok(())
+    /// # }
+    /// ```
     pub fn add_data(&mut self, data: Value) -> Result<()> {
+        if data.as_object().is_err() {
+            bail!("data must be object");
+        }
         self.prepared = false;
         self.interpreter.get_data_mut().merge(data)
     }
 
-    pub fn get_modules(&mut self) -> &Vec<Ref<Module>> {
-        &self.modules
-    }
-
+    /// Set whether builtins should raise errors strictly or not.
+    ///
+    /// Regorus differs from OPA in that by default builtins will
+    /// raise errors instead of returning Undefined.
+    ///
+    /// ----
+    /// **_NOTE:_** Currently not all builtins honor this flag and will always strictly raise errors.
+    /// ----
     pub fn set_strict_builtin_errors(&mut self, b: bool) {
         self.interpreter.set_strict_builtin_errors(b)
     }
 
+    #[doc(hidden)]
+    pub fn get_modules(&mut self) -> &Vec<Ref<Module>> {
+        &self.modules
+    }
+
+    /// Evaluate a Rego query.
+    ///
+    /// ```
+    /// # use regorus::*;
+    /// # fn main() -> anyhow::Result<()> {
+    /// let mut engine = Engine::new();
+    ///
+    /// // Add policies
+    /// engine.add_policy_from_file("tests/aci/framework.rego")?;
+    /// engine.add_policy_from_file("tests/aci/api.rego")?;
+    /// engine.add_policy_from_file("tests/aci/policy.rego")?;
+    ///
+    /// // Add data document (if any).
+    /// // If multiple data documents can be added, they will be merged together.
+    /// engine.add_data(Value::from_json_file("tests/aci/data.json")?)?;
+    ///
+    /// // At this point the policies and data have been loaded.
+    /// // Either the same engine can be used to make multiple queries or the engine
+    /// // can be cloned to avoid having the reload the policies and data.
+    /// let _clone = engine.clone();
+    ///
+    /// // Evaluate a query.
+    /// // Load input and make query.
+    /// engine.set_input(Value::new_object());
+    /// let results = engine.eval_query("data.framework.mount_overlay.allowed".to_string(), false)?;
+    /// assert!(results.result.is_empty());
+    ///
+    /// // Evaluate query with different inputs.
+    /// engine.set_input(Value::from_json_file("tests/aci/input.json")?);
+    /// let results = engine.eval_query("data.framework.mount_overlay.allowed".to_string(), false)?;
+    /// assert_eq!(results.result[0].expressions[0].value, Value::from(true));
+    /// # Ok(())
+    /// # }
+    pub fn eval_query(&mut self, query: String, enable_tracing: bool) -> Result<QueryResults> {
+        self.eval_modules(enable_tracing)?;
+
+        let query_module = {
+            let source = Source::new(
+                "<query_module.rego>".to_owned(),
+                "package __internal_query_module".to_owned(),
+            );
+            Ref::new(Parser::new(&source)?.parse()?)
+        };
+
+        // Parse the query.
+        let query_source = Source::new("<query.rego>".to_string(), query);
+        let mut parser = Parser::new(&query_source)?;
+        let query_node = parser.parse_user_query()?;
+        let query_schedule = Analyzer::new().analyze_query_snippet(&self.modules, &query_node)?;
+        self.interpreter.eval_user_query(
+            &query_module,
+            &query_node,
+            &query_schedule,
+            enable_tracing,
+        )
+    }
+
+    #[doc(hidden)]
     fn prepare_for_eval(&mut self, enable_tracing: bool) -> Result<()> {
         self.interpreter.set_traces(enable_tracing);
 
@@ -107,6 +289,7 @@ impl Engine {
         Ok(())
     }
 
+    #[doc(hidden)]
     pub fn eval_rule(
         &mut self,
         module: &Ref<Module>,
@@ -121,6 +304,7 @@ impl Engine {
         Ok(self.interpreter.get_data_mut().clone())
     }
 
+    #[doc(hidden)]
     pub fn eval_modules(&mut self, enable_tracing: bool) -> Result<Value> {
         self.prepare_for_eval(enable_tracing)?;
         self.interpreter.clean_internal_evaluation_state();
@@ -165,29 +349,91 @@ impl Engine {
         Ok(self.interpreter.get_data_mut().clone())
     }
 
-    pub fn eval_query(&mut self, query: String, enable_tracing: bool) -> Result<QueryResults> {
-        self.eval_modules(false)?;
-
-        let query_module = {
-            let source = Source::new(
-                "<query_module.rego>".to_owned(),
-                "package __internal_query_module".to_owned(),
-            );
-            Ref::new(Parser::new(&source)?.parse()?)
-        };
-
-        // Parse the query.
-        let query_source = Source::new("<query.rego>".to_string(), query);
-        let mut parser = Parser::new(&query_source)?;
-        let query_node = parser.parse_user_query()?;
-        let query_schedule = Analyzer::new().analyze_query_snippet(&self.modules, &query_node)?;
-
-        let results = self.interpreter.eval_user_query(
-            &query_module,
-            &query_node,
-            &query_schedule,
-            enable_tracing,
-        )?;
-        Ok(results)
+    /// Add a custom builtin (extension).
+    ///
+    /// * `path`: The fully qualified path of the builtin.
+    /// * `nargs`: The number of arguments the builtin takes.
+    /// * `extension`: The [`Extension`] instance.
+    ///
+    /// ```rust
+    /// # use regorus::*;
+    /// # use anyhow::{bail, Result};
+    /// # fn main() -> Result<()> {
+    /// let mut engine = Engine::new();
+    ///
+    /// // Policy uses `do_magic` custom builtin.
+    /// engine.add_policy(
+    ///    "test.rego".to_string(),
+    ///    r#"package test
+    ///       x = do_magic(1)
+    ///    "#.to_string(),
+    /// )?;
+    ///
+    /// // Evaluating fails since `do_magic` is not defined.
+    /// assert!(engine.eval_query("data.test.x".to_string(), false).is_err());
+    ///
+    /// // Add extension to implement `do_magic`. The extension can be stateful.
+    /// let mut magic = 8;
+    /// engine.add_extension("do_magic".to_string(), 1 , Box::new(move | mut params: Vec<Value> | {
+    ///   // params is mut and therefore individual values can be removed from it and modified.
+    ///   // The number of parameters (1) has already been validated.
+    ///
+    ///   match &params[0].as_i64() {
+    ///      Ok(i) => {
+    ///         // Compute value
+    ///         let v = *i + magic;
+    ///         // Update extension state.
+    ///         magic += 1;
+    ///         Ok(Value::from(v))
+    ///      }
+    ///      // Extensions can raise errors. Regorus will add location information to
+    ///      // the error.
+    ///      _ => bail!("do_magic expects i64 value")
+    ///   }
+    /// }))?;
+    ///
+    /// // Evaluation will now succeed.
+    /// let r = engine.eval_query("data.test.x".to_string(), false)?;
+    /// assert_eq!(r.result[0].expressions[0].value.as_i64()?, 9);
+    ///
+    /// // Cloning the engine will also clone the extension.
+    /// let mut engine1 = engine.clone();
+    ///
+    /// // Evaluating again will return a different value since the extension is stateful.
+    /// let r = engine.eval_query("data.test.x".to_string(), false)?;
+    /// assert_eq!(r.result[0].expressions[0].value.as_i64()?, 10);
+    ///
+    /// // The second engine has a clone of the extension.
+    /// let r = engine1.eval_query("data.test.x".to_string(), false)?;
+    /// assert_eq!(r.result[0].expressions[0].value.as_i64()?, 10);
+    ///
+    /// // Once added, the extension cannot be replaced or removed.
+    /// assert!(engine.add_extension("do_magic".to_string(), 1, Box::new(|_:Vec<Value>| {
+    ///   Ok(Value::Undefined)
+    /// })).is_err());
+    ///
+    /// // Extensions don't support out-parameter syntax.
+    /// engine.add_policy(
+    ///   "policy.rego".to_string(),
+    ///   r#"package invalid
+    ///      x = y {
+    ///       # y = do_magic(2)
+    ///       do_magic(2, y)  # y is supplied as an out parameter.
+    ///     }
+    ///    "#.to_string()
+    /// )?;
+    ///
+    /// // Evaluation fails since y is not defined.
+    /// assert!(engine.eval_query("data.invalid.y".to_string(), false).is_err());
+    /// # Ok(())
+    /// # }
+    /// ```
+    pub fn add_extension(
+        &mut self,
+        path: String,
+        nargs: u8,
+        extension: Box<dyn Extension>,
+    ) -> Result<()> {
+        self.interpreter.add_extension(path, nargs, extension)
     }
 }

src/interpreter.rs

@@ -9,10 +9,10 @@ use crate::parser::Parser;
 use crate::scheduler::*;
 use crate::utils::*;
 use crate::value::*;
+use crate::{Expression, Extension, Location, QueryResult, QueryResults};
 
 use anyhow::{anyhow, bail, Result};
 use log::info;
-use serde::Serialize;
 use std::collections::btree_map::Entry as BTreeMapEntry;
 use std::collections::{hash_map::Entry, BTreeMap, BTreeSet, HashMap};
 use std::ops::Bound::*;
@@ -65,6 +65,7 @@ pub struct Interpreter {
     allow_deprecated: bool,
     strict_builtin_errors: bool,
     imports: BTreeMap<String, Ref<Expr>>,
+    extensions: HashMap<String, (u8, Box<dyn Extension>)>,
 }
 
 impl Default for Interpreter {
@@ -73,42 +74,6 @@ impl Default for Interpreter {
     }
 }
 
-#[derive(Debug, Clone, Serialize)]
-pub struct Location {
-    pub row: u16,
-    pub col: u16,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct Expression {
-    pub value: Value,
-    pub text: Rc<str>,
-    pub location: Location,
-}
-
-#[derive(Debug, Clone, Serialize)]
-pub struct QueryResult {
-    // Expressions is shown first to match OPA.
-    pub expressions: Vec<Expression>,
-    #[serde(skip_serializing_if = "Value::is_empty_object")]
-    pub bindings: Value,
-}
-
-impl Default for QueryResult {
-    fn default() -> Self {
-        Self {
-            bindings: Value::new_object(),
-            expressions: vec![],
-        }
-    }
-}
-
-#[derive(Debug, Clone, Default, Serialize)]
-pub struct QueryResults {
-    #[serde(skip_serializing_if = "Vec::is_empty")]
-    pub result: Vec<QueryResult>,
-}
-
 #[derive(Debug, Clone)]
 struct Context {
     key_expr: Option<ExprRef>,
@@ -211,6 +176,7 @@ impl Interpreter {
             allow_deprecated: true,
             strict_builtin_errors: true,
             imports: BTreeMap::default(),
+            extensions: HashMap::new(),
         }
     }
 
@@ -271,6 +237,7 @@ impl Interpreter {
         self.loop_var_values.clear();
         self.scopes = vec![Scope::new()];
         self.contexts = vec![];
+        self.rule_values.clear();
     }
 
     fn current_module(&self) -> Result<Ref<Module>> {
@@ -383,7 +350,7 @@ impl Interpreter {
                             && get_root_var(refr)?.text() == "data"
                         {
                             let index = index.to_string();
-                            v = obj[&index].clone();
+                            v = obj[index].clone();
                         }
                         return Ok(Self::get_value_chained(v, &path[..]));
                     }
@@ -1346,6 +1313,13 @@ impl Interpreter {
         r
     }
 
+    fn clear_scope(scope: &mut Scope) {
+        // Set each value to undefined. This is equivalent to removing the key.
+        for (_, v) in scope.iter_mut() {
+            *v = Value::Undefined;
+        }
+    }
+
     fn eval_stmts_in_loop(&mut self, stmts: &[&LiteralStmt], loops: &[LoopExpr]) -> Result<bool> {
         if loops.is_empty() {
             if !stmts.is_empty() {
@@ -1409,9 +1383,8 @@ impl Interpreter {
                 }
             }
 
-            // Save the current scope and restore it after evaluating the statements so
-            // that the effects of the current loop iteration are cleared.
-            let scope_saved = self.current_scope()?.clone();
+            // Create a new scope.
+            self.scopes.push(Scope::default());
 
             let query_result = self.get_current_context()?.result.clone();
             match loop_expr_value {
@@ -1437,12 +1410,13 @@ impl Interpreter {
                             result = self.eval_stmts_in_loop(stmts, &loops[1..])? || result;
                         }
 
-                        self.loop_var_values.remove(&loop_expr.expr());
-                        *self.current_scope_mut()? = scope_saved.clone();
+                        Self::clear_scope(self.current_scope_mut()?);
                         if let Some(ctx) = self.contexts.last_mut() {
                             ctx.result = query_result.clone();
                         }
                     }
+
+                    self.loop_var_values.remove(&loop_expr.expr());
                 }
                 Value::Set(items) => {
                     for v in items.iter() {
@@ -1460,12 +1434,12 @@ impl Interpreter {
                             result = self.eval_stmts_in_loop(stmts, &loops[1..])? || result;
                         }
 
-                        self.loop_var_values.remove(&loop_expr.expr());
-                        *self.current_scope_mut()? = scope_saved.clone();
+                        Self::clear_scope(self.current_scope_mut()?);
                         if let Some(ctx) = self.contexts.last_mut() {
                             ctx.result = query_result.clone();
                         }
                     }
+                    self.loop_var_values.remove(&loop_expr.expr());
                 }
                 Value::Object(obj) => {
                     for (k, v) in obj.iter() {
@@ -1481,12 +1455,13 @@ impl Interpreter {
                         if exec {
                             result = self.eval_stmts_in_loop(stmts, &loops[1..])? || result;
                         }
-                        self.loop_var_values.remove(&loop_expr.expr());
-                        *self.current_scope_mut()? = scope_saved.clone();
+
+                        Self::clear_scope(self.current_scope_mut()?);
                         if let Some(ctx) = self.contexts.last_mut() {
                             ctx.result = query_result.clone();
                         }
                     }
+                    self.loop_var_values.remove(&loop_expr.expr());
                 }
                 Value::Undefined => {
                     result = false;
@@ -1497,6 +1472,8 @@ impl Interpreter {
                 }
             }
 
+            self.scopes.pop();
+
             // Return true if at least on iteration returned true
             Ok(result)
         }
@@ -1728,7 +1705,7 @@ impl Interpreter {
                 if result
                     .expressions
                     .iter()
-                    .all(|v| v.value != Value::Undefined)
+                    .all(|v| v.value != Value::Undefined && v.value != Value::Bool(false))
                     && !result.expressions.is_empty()
                 {
                     ctx.results.result.push(result);
@@ -1847,7 +1824,7 @@ impl Interpreter {
                 if result
                     .expressions
                     .iter()
-                    .all(|v| v.value != Value::Undefined)
+                    .all(|v| v.value != Value::Undefined && v.value != Value::Bool(false))
                     && !result.expressions.is_empty()
                 {
                     ctx.results.result.push(result);
@@ -2023,14 +2000,14 @@ impl Interpreter {
         }
     }
 
-    fn lookup_function_by_name(&self, path: &str) -> Option<&Vec<Ref<Rule>>> {
+    fn lookup_function_by_name(&self, path: &str) -> Option<(&Vec<Ref<Rule>>, &Ref<Module>)> {
         let mut path = path.to_owned();
         if !path.starts_with("data.") {
             path = self.current_module_path.clone() + "." + &path;
         }
 
         match self.functions.get(&path) {
-            Some((f, _)) => Some(f),
+            Some((f, _, m)) => Some((f, m)),
             _ => None,
         }
     }
@@ -2063,10 +2040,12 @@ impl Interpreter {
 
         // Handle trace function.
         // TODO: with modifier.
-        if let (Some(traces), Value::String(msg)) = (&mut self.traces, &v) {
-            traces.push(msg.clone());
-            return Ok(Value::Bool(true));
-        };
+        if name == "trace" {
+            if let (Some(traces), Value::String(msg)) = (&mut self.traces, &v) {
+                traces.push(msg.clone());
+                return Ok(Value::Bool(true));
+            }
+        }
 
         if let Some(name) = cache {
             self.builtins_cache.insert((name, args), v.clone());
@@ -2081,7 +2060,8 @@ impl Interpreter {
 
         #[cfg(feature = "deprecated")]
         if let Some(builtin) = builtins::DEPRECATED.get(path) {
-            if !self.allow_deprecated {
+            let allow = self.allow_deprecated && !self.current_module()?.rego_v1;
+            if !allow {
                 bail!(span.error(format!("{path} is deprecated").as_str()))
             }
             return Ok(Some(builtin));
@@ -2123,6 +2103,7 @@ impl Interpreter {
         }
 
         let orig_fcn_path = fcn_path;
+
         let mut with_functions_saved = None;
         let fcn_path = match self.with_functions.get(&orig_fcn_path) {
             Some(FunctionModifier::Function(p)) => {
@@ -2143,9 +2124,10 @@ impl Interpreter {
             _ => orig_fcn_path.clone(),
         };
 
-        let empty = vec![];
-        let fcns_rules = match self.lookup_function_by_name(&fcn_path) {
-            Some(r) => r,
+        let mut extension = None;
+        let empty: Vec<Ref<Rule>> = vec![];
+        let (fcns_rules, fcn_module) = match self.lookup_function_by_name(&fcn_path) {
+            Some((fcns, m)) => (fcns, Some(m.clone())),
             _ => {
                 if self.default_rules.get(&fcn_path).is_some()
                     || self
@@ -2154,10 +2136,15 @@ impl Interpreter {
                         .is_some()
                 {
                     // process default functions later.
-                    &empty
+                    (&empty, self.module.clone())
+                }
+                // Look up extension.
+                else if let Some(ext) = self.extensions.get_mut(&fcn_path) {
+                    extension = Some(ext);
+                    (&empty, None)
                 }
                 // Look up builtin function.
-                else if let Ok(Some(builtin)) = self.lookup_builtin(span, &fcn_path) {
+                else if let Some(builtin) = self.lookup_builtin(span, &fcn_path)? {
                     let r = self.eval_builtin_call(span, &fcn_path.clone(), *builtin, params);
                     if let Some(with_functions) = with_functions_saved {
                         self.with_functions = with_functions;
@@ -2175,6 +2162,21 @@ impl Interpreter {
             return Ok(Value::Undefined);
         }
 
+        if let Some((nargs, ext)) = extension {
+            if param_values.len() != *nargs as usize {
+                bail!(span.error("incorrect number of parameters supplied to extension"));
+            }
+            let r = ext(param_values);
+            // Restore with_functions.
+            if let Some(with_functions) = with_functions_saved {
+                self.with_functions = with_functions;
+            }
+            match r {
+                Ok(v) => return Ok(v),
+                Err(e) => bail!(span.error(&format!("{e}"))),
+            }
+        }
+
         let fcns = fcns_rules.clone();
 
         let mut results: Vec<Value> = Vec::new();
@@ -2236,6 +2238,7 @@ impl Interpreter {
                 ..Context::default()
             };
 
+            let prev_module = self.set_current_module(fcn_module.clone())?;
             let value = match self.eval_rule_bodies(ctx, span, bodies) {
                 Ok(v) => v,
                 Err(e) => {
@@ -2245,6 +2248,7 @@ impl Interpreter {
                     continue;
                 }
             };
+            self.set_current_module(prev_module)?;
 
             let result = match &value {
                 Value::Set(s) if s.len() == 1 => s.iter().next().unwrap().clone(),
@@ -2410,6 +2414,14 @@ impl Interpreter {
                         self.eval_rule(&module, rule)?;
                     }
                 }
+
+                let prev_module = self.set_current_module(Some(module.clone()))?;
+                for rule in &module.policy {
+                    if !self.processed.contains(rule) {
+                        self.eval_default_rule(rule)?;
+                    }
+                }
+                self.set_current_module(prev_module)?;
             }
         }
         Ok(())
@@ -3028,43 +3040,7 @@ impl Interpreter {
         Ok(())
     }
 
-    pub fn eval_rule(&mut self, module: &Ref<Module>, rule: &Ref<Rule>) -> Result<()> {
-        // Skip reprocessing rule
-        if self.processed.contains(rule) {
-            return Ok(());
-        }
-
-        // Skip default rules
-        if let Rule::Default { .. } = rule.as_ref() {
-            return Ok(());
-        }
-
-        self.active_rules.push(rule.clone());
-        if self.active_rules.iter().filter(|&r| r == rule).count() == 2 {
-            let mut msg = String::default();
-            for r in &self.active_rules {
-                let refr = Self::get_rule_refr(r);
-                let span = refr.span();
-                msg += span
-                    .source
-                    .message(span.line, span.col, "depends on", "")
-                    .as_str();
-            }
-            msg += "cyclic evaluation";
-            let refr = Self::get_rule_refr(rule);
-            let span = refr.span();
-            return Err(span.source.error(
-                span.line,
-                span.col,
-                format!("recursion detected when evaluating rule:{msg}").as_str(),
-            ));
-        }
-
-        // Back up local variables of current function and empty
-        // the local variables of callee function.
-        let scopes = std::mem::take(&mut self.scopes);
-        let prev_module = self.set_current_module(Some(module.clone()))?;
-
+    fn eval_rule_impl(&mut self, module: &Ref<Module>, rule: &Ref<Rule>) -> Result<()> {
         match rule.as_ref() {
             Rule::Spec {
                 span,
@@ -3145,10 +3121,53 @@ impl Interpreter {
             }
             _ => bail!("internal error: unexpected"),
         }
+        Ok(())
+    }
+
+    pub fn eval_rule(&mut self, module: &Ref<Module>, rule: &Ref<Rule>) -> Result<()> {
+        // Skip reprocessing rule
+        if self.processed.contains(rule) {
+            return Ok(());
+        }
+
+        // Skip default rules
+        if let Rule::Default { .. } = rule.as_ref() {
+            return Ok(());
+        }
+
+        self.active_rules.push(rule.clone());
+        if self.active_rules.iter().filter(|&r| r == rule).count() == 2 {
+            let mut msg = String::default();
+            for r in &self.active_rules {
+                let refr = Self::get_rule_refr(r);
+                let span = refr.span();
+                msg += span
+                    .source
+                    .message(span.line, span.col, "depends on", "")
+                    .as_str();
+            }
+            msg += "cyclic evaluation";
+            self.active_rules.pop();
+            let refr = Self::get_rule_refr(rule);
+            let span = refr.span();
+            return Err(span.source.error(
+                span.line,
+                span.col,
+                format!("recursion detected when evaluating rule:{msg}").as_str(),
+            ));
+        }
+
+        // Back up local variables of current function and empty
+        // the local variables of callee function.
+        let scopes = std::mem::take(&mut self.scopes);
+        let prev_module = self.set_current_module(Some(module.clone()))?;
+
+        let res = self.eval_rule_impl(module, rule);
+
         self.set_current_module(prev_module)?;
         self.scopes = scopes;
         match self.active_rules.pop() {
-            Some(ref r) if r == rule => Ok(()),
+            Some(ref r) if r == rule => res,
             _ => bail!("internal error: current rule not active"),
         }
     }
@@ -3222,7 +3241,7 @@ impl Interpreter {
         self.set_current_module(prev_module)?;
 
         if let Some(r) = results.result.last() {
-            if r.bindings.is_empty_object()
+            if matches!(&r.bindings, Value::Object(obj) if obj.is_empty())
                 && r.expressions.iter().any(|e| e.value == Value::Bool(false))
             {
                 results = QueryResults::default();
@@ -3421,4 +3440,18 @@ impl Interpreter {
         }
         Ok(())
     }
+
+    pub fn add_extension(
+        &mut self,
+        path: String,
+        nargs: u8,
+        extension: Box<dyn Extension>,
+    ) -> Result<()> {
+        if let std::collections::hash_map::Entry::Vacant(v) = self.extensions.entry(path) {
+            v.insert((nargs, extension));
+            Ok(())
+        } else {
+            bail!("extension already added");
+        }
+    }
 }

src/lib.rs

@@ -4,6 +4,8 @@
 // Use README.md as crate documentation.
 #![doc = include_str!(concat!(env!("CARGO_MANIFEST_DIR"), "/README.md"))]
 
+use serde::Serialize;
+
 mod ast;
 mod builtins;
 mod engine;
@@ -16,10 +18,281 @@ mod utils;
 mod value;
 
 pub use engine::Engine;
-pub use interpreter::{QueryResult, QueryResults};
 pub use value::Value;
 
+/// Location of an [`Expression`] in a Rego query.
+///
+/// ```
+/// # use regorus::Engine;
+/// # fn main() -> anyhow::Result<()> {
+/// // Create engine and evaluate "  \n  1 + 2".
+/// let results = Engine::new().eval_query("  \n  1 + 2".to_string(), false)?;
+///
+/// // Fetch the location for the expression.
+/// let loc = &results.result[0].expressions[0].location;
+///
+/// assert_eq!(loc.row, 2);
+/// assert_eq!(loc.col, 3);
+/// # Ok(())
+/// # }
+/// ````
+/// See also [`QueryResult`].
+#[derive(Debug, Clone, Serialize)]
+pub struct Location {
+    /// Line number. Starts at 1.
+    pub row: u16,
+    /// Column number. Starts at 1.
+    pub col: u16,
+}
+
+/// An expression in a Rego query.
+///
+/// ```
+/// # use regorus::*;
+/// # fn main() -> anyhow::Result<()> {
+/// // Create engine and evaluate "1 + 2".
+/// let results = Engine::new().eval_query("1 + 2".to_string(), false)?;
+///
+/// // Fetch the expression from results.
+/// let expr = &results.result[0].expressions[0];
+///
+/// assert_eq!(expr.value, Value::from(3u64));
+/// assert_eq!(expr.text.as_ref(), "1 + 2");
+/// # Ok(())
+/// # }
+/// ```
+/// See also [`QueryResult`].
+#[derive(Debug, Clone, Serialize)]
+pub struct Expression {
+    /// Computed value of the expression.
+    pub value: Value,
+
+    /// The Rego expression.
+    pub text: std::rc::Rc<str>,
+
+    /// Location of the expression in the query string.
+    pub location: Location,
+}
+
+/// Result of evaluating a Rego query.
+///
+/// A query containing single expression.
+/// ```
+/// # use regorus::*;
+/// # fn main() -> anyhow::Result<()> {
+/// // Create engine and evaluate "1 + 2".
+/// let results = Engine::new().eval_query("1 + 2".to_string(), false)?;
+///
+/// // Fetch the first (sole) result.
+/// let result = &results.result[0];
+///
+/// assert_eq!(result.expressions[0].value, Value::from(3u64));
+/// assert_eq!(result.expressions[0].text.as_ref(), "1 + 2");
+/// # Ok(())
+/// # }
+/// ```
+///
+/// A query containing multiple expressions.
+/// ```
+/// # use regorus::*;
+/// # fn main() -> anyhow::Result<()> {
+/// // Create engine and evaluate "1 + 2; 3.5 * 4".
+/// let results = Engine::new().eval_query("1 + 2; 3.55 * 4".to_string(), false)?;
+///
+/// // Fetch the first (sole) result.
+/// let result = &results.result[0];
+///
+/// // First expression.
+/// assert_eq!(result.expressions[0].value, Value::from(3u64));
+/// assert_eq!(result.expressions[0].text.as_ref(), "1 + 2");
+///
+/// // Second expression.
+/// assert_eq!(result.expressions[1].value, Value::from(14.2));
+/// assert_eq!(result.expressions[1].text.as_ref(), "3.55 * 4");
+/// # Ok(())
+/// # }
+/// ```
+///
+/// Expressions that create bindings (i.e. associate names to values) evaluate to
+/// either true or false. The value of bindings are available in the `bindings` field.
+/// ```
+/// # use regorus::*;
+/// # fn main() -> anyhow::Result<()> {
+/// // Create engine and evaluate "x = 1; y = x > 0".
+/// let results = Engine::new().eval_query("x = 1; y = x > 0".to_string(), false)?;
+///
+/// // Fetch the first (sole) result.
+/// let result = &results.result[0];
+///
+/// // First expression is true.
+/// assert_eq!(result.expressions[0].value, Value::from(true));
+/// assert_eq!(result.expressions[0].text.as_ref(), "x = 1");
+///
+/// // Second expression is true.
+/// assert_eq!(result.expressions[1].value, Value::from(true));
+/// assert_eq!(result.expressions[1].text.as_ref(), "y = x > 0");
+///
+/// // bindings contains the value for each named expession.
+/// assert_eq!(result.bindings[&Value::from("x")], Value::from(1u64));
+/// assert_eq!(result.bindings[&Value::from("y")], Value::from(true));
+/// # Ok(())
+/// # }
+/// ```
+///
+/// If any expression evaluates to false, then no results are produced.
+/// ```
+/// # use regorus::*;
+/// # fn main() -> anyhow::Result<()> {
+/// // Create engine and evaluate "true; true; false".
+/// let results = Engine::new().eval_query("true; true; false".to_string(), false)?;
+///
+/// assert!(results.result.is_empty());
+/// # Ok(())
+/// # }
+/// ```
+#[derive(Debug, Clone, Serialize)]
+pub struct QueryResult {
+    /// Expressions in the query.
+    ///
+    /// Each statement in the query is treated as a separte expression.
+    ///
+    pub expressions: Vec<Expression>,
+
+    /// Bindings created in the query.
+    #[serde(skip_serializing_if = "Value::is_empty_object")]
+    pub bindings: Value,
+}
+
+impl Default for QueryResult {
+    fn default() -> Self {
+        Self {
+            bindings: Value::new_object(),
+            expressions: vec![],
+        }
+    }
+}
+
+/// Results of evaluating a Rego query.
+///
+/// Generates the same `json` representation as `opa eval`.
+///
+/// Queries typically produce a single result.
+/// ```
+/// # use regorus::*;
+/// # fn main() -> anyhow::Result<()> {
+/// // Create engine and evaluate "true; true; false".
+/// let results = Engine::new().eval_query("1 + 1".to_string(), false)?;
+///
+/// assert!(results.result.len() == 1);
+/// assert_eq!(results.result[0].expressions[0].value, Value::from(2u64));
+/// assert_eq!(results.result[0].expressions[0].text.as_ref(), "1 + 1");
+/// # Ok(())
+/// # }
+/// ```
+///
+/// If any expression evaluates to false, then no results are produced.
+/// ```
+/// # use regorus::*;
+/// # fn main() -> anyhow::Result<()> {
+/// // Create engine and evaluate "true; true; false".
+/// let results = Engine::new().eval_query("true; true; false".to_string(), false)?;
+///
+/// assert!(results.result.is_empty());
+/// # Ok(())
+/// # }
+/// ```
+///
+/// Queries containing loops produce multiple results.
+/// ```
+/// # use regorus::*;
+/// # fn main() -> anyhow::Result<()> {
+/// let results = Engine::new().eval_query("x = [1, 2, 3][_]".to_string(), false)?;
+///
+/// // Three results are produced, one of each value of x.
+/// assert_eq!(results.result.len(), 3);
+///
+/// // Assert expressions and bindings of results.
+/// assert_eq!(results.result[0].expressions[0].value, Value::Bool(true));
+/// assert_eq!(results.result[0].expressions[0].text.as_ref(), "x = [1, 2, 3][_]");
+/// assert_eq!(results.result[0].bindings[&Value::from("x")], Value::from(1u64));
+///
+/// assert_eq!(results.result[1].expressions[0].value, Value::Bool(true));
+/// assert_eq!(results.result[1].expressions[0].text.as_ref(), "x = [1, 2, 3][_]");
+/// assert_eq!(results.result[1].bindings[&Value::from("x")], Value::from(2u64));
+///
+/// assert_eq!(results.result[2].expressions[0].value, Value::Bool(true));
+/// assert_eq!(results.result[2].expressions[0].text.as_ref(), "x = [1, 2, 3][_]");
+/// assert_eq!(results.result[2].bindings[&Value::from("x")], Value::from(3u64));
+/// # Ok(())
+/// # }
+/// ```
+///
+/// Loop iterations that evaluate to false or undefined don't produce results.
+/// ```
+/// # use regorus::*;
+/// # fn main() -> anyhow::Result<()> {
+/// let results = Engine::new().eval_query("x = [1, 2, 3][_]; x >= 2".to_string(), false)?;
+///
+/// // Two results are produced, one for x = 2 and another for x = 3.
+/// assert_eq!(results.result.len(), 2);
+///
+/// // Assert expressions and bindings of results.
+/// assert_eq!(results.result[0].expressions[0].value, Value::Bool(true));
+/// assert_eq!(results.result[0].expressions[0].text.as_ref(), "x = [1, 2, 3][_]");
+/// assert_eq!(results.result[0].expressions[0].value, Value::Bool(true));
+/// assert_eq!(results.result[0].expressions[1].text.as_ref(), "x >= 2");
+/// assert_eq!(results.result[0].bindings[&Value::from("x")], Value::from(2u64));
+///
+/// assert_eq!(results.result[1].expressions[0].value, Value::Bool(true));
+/// assert_eq!(results.result[1].expressions[0].text.as_ref(), "x = [1, 2, 3][_]");
+/// assert_eq!(results.result[1].expressions[0].value, Value::Bool(true));
+/// assert_eq!(results.result[1].expressions[1].text.as_ref(), "x >= 2");
+/// assert_eq!(results.result[1].bindings[&Value::from("x")], Value::from(3u64));
+/// # Ok(())
+/// # }
+/// ```
+///
+/// See [QueryResult] for examples of different kinds of results.
+#[derive(Debug, Clone, Default, Serialize)]
+pub struct QueryResults {
+    /// Collection of results of evaluting a query.
+    #[serde(skip_serializing_if = "Vec::is_empty")]
+    pub result: Vec<QueryResult>,
+}
+
+/// A user defined builtin function implementation.
+///
+/// It is not necessary to implement this trait directly.
+pub trait Extension: FnMut(Vec<Value>) -> anyhow::Result<Value> {
+    /// Fn, FnMut etc are not sized and cannot be cloned in their boxed form.
+    /// clone_box exists to overcome that.
+    fn clone_box<'a>(&self) -> Box<dyn 'a + Extension>
+    where
+        Self: 'a;
+}
+
+/// Automatically make matching closures a valid [`Extension`].
+impl<F> Extension for F
+where
+    F: FnMut(Vec<Value>) -> anyhow::Result<Value> + Clone,
+{
+    fn clone_box<'a>(&self) -> Box<dyn 'a + Extension>
+    where
+        Self: 'a,
+    {
+        Box::new(self.clone())
+    }
+}
+
+/// Implement clone for a boxed extension using [`Extension::clone_box`].
+impl<'a> Clone for Box<dyn 'a + Extension> {
+    fn clone(&self) -> Self {
+        (**self).clone_box()
+    }
+}
+
 /// Items in `unstable` are likely to change.
+#[doc(hidden)]
 pub mod unstable {
     pub use crate::ast::*;
     pub use crate::lexer::*;

src/number.rs

@@ -132,6 +132,26 @@ impl From<f64> for Number {
 }
 
 impl Number {
+    pub fn as_u128(&self) -> Option<u128> {
+        match self {
+            Big(b) if b.is_integer() => match u128::try_from(&b.d) {
+                Ok(v) => Some(v),
+                _ => None,
+            },
+            _ => None,
+        }
+    }
+
+    pub fn as_i128(&self) -> Option<i128> {
+        match self {
+            Big(b) if b.is_integer() => match i128::try_from(&b.d) {
+                Ok(v) => Some(v),
+                _ => None,
+            },
+            _ => None,
+        }
+    }
+
     pub fn as_u64(&self) -> Option<u64> {
         match self {
             Big(b) if b.is_integer() => match u64::try_from(&b.d) {

src/parser.rs

@@ -15,6 +15,7 @@ pub struct Parser<'source> {
     line: u16,
     end: u16,
     future_keywords: BTreeMap<String, Span>,
+    rego_v1: bool,
 }
 
 const FUTURE_KEYWORDS: [&str; 4] = ["contains", "every", "if", "in"];
@@ -30,6 +31,7 @@ impl<'source> Parser<'source> {
             line: 0,
             end: 0,
             future_keywords: BTreeMap::new(),
+            rego_v1: false,
         })
     }
 
@@ -76,19 +78,19 @@ impl<'source> Parser<'source> {
 
     pub fn set_future_keyword(&mut self, kw: &str, span: &Span) -> Result<()> {
         match &self.future_keywords.get(kw) {
-            Some(s) if false => Err(self.source.error(
+            Some(s) if self.rego_v1 => Err(self.source.error(
                 span.line,
                 span.col,
                 format!(
                     "this import shadows previous import of `{kw}` defined at:{}",
-                    self.source
-                        .message(s.line, s.col, "", "this import is shadowed.")
+                    s.message("", "this import is shadowed.")
                 )
                 .as_str(),
             )),
             _ => {
                 self.future_keywords.insert(kw.to_string(), span.clone());
-                if kw == "every" {
+                if kw == "every" && !self.rego_v1 {
+                    //rego.v1 explicitly adds each keyword.
                     self.future_keywords.insert("in".to_string(), span.clone());
                 }
                 Ok(())
@@ -782,6 +784,17 @@ impl<'source> Parser<'source> {
         span.start = start;
         let op = match self.token_text() {
             "=" => AssignOp::Eq,
+            ":=" if self.rego_v1 => {
+                if let Expr::Var(v) = &expr {
+                    if v.text() == "input" {
+                        bail!(span.error("input cannot be shadowed"));
+                    }
+                    if v.text() == "data" {
+                        bail!(span.error("data cannot be shadowed"));
+                    }
+                }
+                AssignOp::ColEq
+            }
             ":=" => AssignOp::ColEq,
             _ => {
                 *self = state;
@@ -974,6 +987,7 @@ impl<'source> Parser<'source> {
         let stmt = match self.parse_literal_stmt() {
             Ok(stmt) => stmt,
             Err(e) if is_definite_query => return Err(e),
+            Err(e) if matches!(self.token_text(), "=" | ":=") => return Err(e),
             Err(_) => {
                 // There was error parsing the first literal
                 // Restore the state and return.
@@ -1117,7 +1131,16 @@ impl<'source> Parser<'source> {
         let span = self.tok.1.clone();
 
         let mut term = if self.tok.0 == TokenKind::Ident {
-            Expr::Var(self.parse_var()?)
+            let v = self.parse_var()?;
+            if self.rego_v1 {
+                if v.text() == "input" {
+                    bail!(span.error("input cannot be shadowed"));
+                }
+                if v.text() == "data" {
+                    bail!(span.error("data cannot be shadowed"));
+                }
+            }
+            Expr::Var(v)
         } else {
             return Err(self.source.error(
                 span.line,
@@ -1311,6 +1334,9 @@ impl<'source> Parser<'source> {
                 false
             }
             "{" => {
+                if self.rego_v1 {
+                    bail!(span.error("`if` keyword is required before rule body"));
+                }
                 self.next_token()?;
                 let query = Ref::new(self.parse_query(span.clone(), "}")?);
                 span.end = self.end;
@@ -1378,6 +1404,9 @@ impl<'source> Parser<'source> {
                     });
                 }
                 "{" => {
+                    if self.rego_v1 {
+                        bail!(span.error("`if` keyword is required before rule body"));
+                    }
                     self.next_token()?;
                     let query = Ref::new(self.parse_query(span.clone(), "}")?);
                     span.end = self.end;
@@ -1463,6 +1492,25 @@ impl<'source> Parser<'source> {
         let head = self.parse_rule_head()?;
         let bodies = self.parse_rule_bodies()?;
         span.end = self.end;
+
+        if self.rego_v1 && bodies.is_empty() {
+            match &head {
+                RuleHead::Compr { assign, .. } | RuleHead::Func { assign, .. }
+                    if assign.is_none() =>
+                {
+                    bail!(span.error("rule must have a body or assignment"));
+                }
+                RuleHead::Set { refr, key, .. } if key.is_none() => {
+                    if Self::get_path_ref_components(refr)?.len() == 2 {
+                        bail!(span.error("`contains` keyword is required for partial set rules"));
+                    } else {
+                        bail!(span.error("rule must have a body or assignment"));
+                    }
+                }
+                _ => (),
+            }
+        }
+
         Ok(Rule::Spec { span, head, bodies })
     }
 
@@ -1526,15 +1574,25 @@ impl<'source> Parser<'source> {
             let refr = Ref::new(self.parse_path_ref()?);
 
             let comps = Self::get_path_ref_components(&refr)?;
-            if !matches!(comps[0].text(), "data" | "future" | "input") {
+            span.end = self.end;
+            if !matches!(comps[0].text(), "data" | "future" | "input" | "rego") {
                 return Err(self.source.error(
                     comps[0].line,
                     comps[0].col,
-                    "import path must begin with one of: {data, future, input}",
+                    "import path must begin with one of: {data, future, input, rego}",
                 ));
             }
 
-            let is_future_kw = self.handle_import_future_keywords(&comps)?;
+            let is_future_kw =
+                if comps.len() == 2 && comps[0].text() == "rego" && comps[1].text() == "v1" {
+                    self.rego_v1 = true;
+                    for kw in FUTURE_KEYWORDS {
+                        self.set_future_keyword(kw, &span)?;
+                    }
+                    true
+                } else {
+                    self.handle_import_future_keywords(&comps)?
+                };
 
             let var = if self.token_text() == "as" {
                 if is_future_kw {
@@ -1588,6 +1646,7 @@ impl<'source> Parser<'source> {
             package,
             imports,
             policy,
+            rego_v1: self.rego_v1,
         })
     }
 

src/scheduler.rs

@@ -3,7 +3,6 @@
 
 use crate::ast::Expr::*;
 use crate::ast::*;
-use crate::builtins;
 use crate::lexer::*;
 use crate::utils::*;
 
@@ -629,6 +628,7 @@ impl Analyzer {
         let mut used_vars = vec![];
         let mut comprs = vec![];
         let full_expr = expr;
+        std::convert::identity(&full_expr);
         traverse(expr, &mut |e| match e.as_ref() {
             Var(v) if !matches!(v.text(), "_" | "input" | "data") => {
                 let name = v.source_str();
@@ -645,15 +645,18 @@ impl Analyzer {
                         first_use.entry(name).or_insert(v.clone());
                     }
                 } else if !scope.inputs.contains(&name) {
-                    match get_path_string(full_expr, None) {
-                        Ok(path)
-                            if builtins::BUILTINS.contains_key(path.as_str())
-                                || builtins::deprecated::DEPRECATED.contains_key(path.as_str()) => {
+                    #[cfg(feature = "deprecated")]
+                    {
+                        if let Ok(path) = get_path_string(full_expr, None) {
+                            if crate::builtins::BUILTINS.contains_key(path.as_str())
+                                || crate::builtins::deprecated::DEPRECATED
+                                    .contains_key(path.as_str())
+                            {
+                                return Ok(false);
+                            }
                         }
-                        _ => bail!(v.error(
-                            format!("use of undefined variable `{name}` is unsafe").as_str()
-                        )),
                     }
+                    bail!(v.error(format!("use of undefined variable `{name}` is unsafe").as_str()));
                 }
                 Ok(false)
             }

src/tests/interpreter/mod.rs

@@ -84,7 +84,6 @@ fn match_values(computed: &Value, expected: &Value) -> Result<()> {
 
 pub fn check_output(computed_results: &[Value], expected_results: &[Value]) -> Result<()> {
     if computed_results.len() != expected_results.len() {
-        dbg!((&computed_results, &expected_results));
         bail!(
             "the number of computed results ({}) and expected results ({}) is not equal",
             computed_results.len(),

src/utils.rs

@@ -109,7 +109,7 @@ pub fn get_path_string(refr: &Expr, document: Option<&str>) -> Result<String> {
     Ok(comps.join("."))
 }
 
-pub type FunctionTable = BTreeMap<String, (Vec<Ref<Rule>>, u8)>;
+pub type FunctionTable = BTreeMap<String, (Vec<Ref<Rule>>, u8, Ref<Module>)>;
 
 fn get_extra_arg_impl(
     expr: &Expr,
@@ -118,11 +118,11 @@ fn get_extra_arg_impl(
 ) -> Result<Option<Ref<Expr>>> {
     if let Expr::Call { fcn, params, .. } = expr {
         let full_path = get_path_string(fcn, module)?;
-        let n_args = if let Some((_, n_args)) = functions.get(&full_path) {
+        let n_args = if let Some((_, n_args, _)) = functions.get(&full_path) {
             *n_args
         } else {
             let path = get_path_string(fcn, None)?;
-            if let Some((_, n_args)) = functions.get(&path) {
+            if let Some((_, n_args, _)) = functions.get(&path) {
                 *n_args
             } else if let Some((_, n_args)) = BUILTINS.get(path.as_str()) {
                 *n_args
@@ -169,7 +169,7 @@ pub fn gather_functions(modules: &[Ref<Module>]) -> Result<FunctionTable> {
             {
                 let full_path = get_path_string(refr, Some(module_path.as_str()))?;
 
-                if let Some((functions, arity)) = table.get_mut(&full_path) {
+                if let Some((functions, arity, _)) = table.get_mut(&full_path) {
                     if args.len() as u8 != *arity {
                         bail!(span.error(
                             format!("{full_path} was previously defined with {arity} arguments.")
@@ -178,7 +178,10 @@ pub fn gather_functions(modules: &[Ref<Module>]) -> Result<FunctionTable> {
                     }
                     functions.push(rule.clone());
                 } else {
-                    table.insert(full_path, (vec![rule.clone()], args.len() as u8));
+                    table.insert(
+                        full_path,
+                        (vec![rule.clone()], args.len() as u8, module.clone()),
+                    );
                 }
             }
         }

tests/aci/main.rs

@@ -45,7 +45,7 @@ fn eval_test_case(dir: &Path, case: &TestCase) -> Result<Value> {
 
     let mut values = vec![];
     for qr in query_results.result {
-        values.push(if !qr.bindings.is_empty_object() {
+        values.push(if !qr.bindings.as_object()?.is_empty() {
             qr.bindings.clone()
         } else if let Some(v) = qr.expressions.last() {
             v.value.clone()
@@ -53,7 +53,7 @@ fn eval_test_case(dir: &Path, case: &TestCase) -> Result<Value> {
             Value::Undefined
         });
     }
-    let result = Value::from_array(values);
+    let result = Value::from(values);
     // Make result json compatible. (E.g: avoid sets).
     Value::from_json_str(&result.to_string())
 }

tests/engine/mod.rs

@@ -0,0 +1,103 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+use anyhow::{bail, Result};
+use regorus::*;
+
+#[test]
+fn extension() -> Result<()> {
+    fn repeat(mut params: Vec<Value>) -> Result<Value> {
+        match params.remove(0) {
+            Value::String(s) => {
+                let s = s.as_ref().to_owned();
+                Ok(Value::from(s.clone() + &s))
+            }
+            _ => bail!("param must be string"),
+        }
+    }
+    let mut engine = Engine::new();
+    engine.add_policy(
+        "test.rego".to_string(),
+        r#"package test
+               x = repeat("hello")
+             "#
+        .to_string(),
+    )?;
+
+    // Raises error since repeat is not defined.
+    assert!(engine.eval_query("data.test.x".to_string(), false).is_err());
+
+    // Register extension.
+    engine.add_extension("repeat".to_string(), 1, Box::new(repeat))?;
+
+    // Adding extension twice is error.
+    assert!(engine
+        .add_extension(
+            "repeat".to_string(),
+            1,
+            Box::new(|_| { Ok(Value::Undefined) })
+        )
+        .is_err());
+
+    let r = engine.eval_query("data.test.x".to_string(), false)?;
+    assert_eq!(
+        r.result[0].expressions[0].value.as_string()?.as_ref(),
+        "hellohello"
+    );
+
+    Ok(())
+}
+
+#[test]
+fn extension_with_state() -> Result<()> {
+    #[derive(Clone)]
+    struct Gen {
+        n: i64,
+    }
+
+    let mut engine = Engine::new();
+    engine.add_policy(
+        "test.rego".to_string(),
+        r#"package test
+               x = gen()
+        "#
+        .to_string(),
+    )?;
+
+    let mut g = Box::new(Gen { n: 5 });
+    engine.add_extension(
+        "gen".to_string(),
+        0,
+        Box::new(move |_: Vec<Value>| {
+            let v = Value::from(g.n);
+            g.n += 1;
+            Ok(v)
+        }),
+    )?;
+
+    // First eval.
+    let r = engine.eval_query("data.test.x".to_string(), false)?;
+    assert_eq!(r.result[0].expressions[0].value.as_i64()?, 5);
+
+    // Second eval will produce a new value since for each query, the
+    // internal evaluation state of the interpreter is cleared.
+    // This might change in the future.
+    let r = engine.eval_query("data.test.x".to_string(), false)?;
+    assert_eq!(r.result[0].expressions[0].value.as_i64()?, 6);
+
+    // Clone the engine.
+    // This should also clone the stateful extension.
+    let mut engine1 = engine.clone();
+
+    // Both the engines should produce the same value.
+    let r = engine.eval_query("data.test.x".to_string(), false)?;
+    let r1 = engine1.eval_query("data.test.x".to_string(), false)?;
+    assert_eq!(
+        r.result[0].expressions[0].value,
+        r1.result[0].expressions[0].value
+    );
+
+    assert_eq!(r.result[0].expressions[0].value.as_i64()?, 7);
+
+    Ok(())
+}

tests/interpreter/cases/builtins/time/diff.yaml

@@ -53,6 +53,23 @@ cases:
         - 58
         - 45
 
+  - note: leap-year
+    data: {}
+    modules:
+      - |
+        package test
+
+        a := time.diff(time.parse_ns("2006-01-02", "2020-02-02"), time.parse_ns("2006-01-02", "2020-03-01"))
+    query: data.test
+    want_result:
+      a: 
+        - 0
+        - 0
+        - 28
+        - 0
+        - 0
+        - 0
+
   - note: invalid-type
     data: {}
     modules:

tests/interpreter/cases/builtins/time/format.yaml

@@ -34,8 +34,8 @@ cases:
       - |
         package test
 
-        a := time.format([1703444325734390000, "UTC", "%Y-%m-%dT%H:%M:%S"])
-        b := time.format([1257894000000000000, "", "%d/%m/%Y %H:%M"])
+        a := time.format([1703444325734390000, "UTC", "2006-01-02T15:04:05"])
+        b := time.format([1257894000000000000, "", "02/01/2006 15:04"])
     query: data.test
     want_result:
       a: "2023-12-24T18:58:45"

tests/interpreter/cases/builtins/time/parse_ns.yaml

@@ -8,11 +8,11 @@ cases:
       - |
         package test
 
-        a := time.parse_ns("%Y-%m-%dT%H:%M:%S", "2006-01-02T15:04:05")
-        b := time.parse_ns("%Y-%m-%d %H:%M:%S", "2015-09-05 23:56:04")
+        a := time.parse_ns("2006-01-02T15:04:05", "2016-05-10T19:06:42")
+        b := time.parse_ns("2006-01-02 15:04:05", "2015-09-05 23:56:04")
     query: data.test
     want_result:
-      a: 1136214245000000000
+      a: 1462907202000000000
       b: 1441497364000000000
 
   - note: format-and-parse-back
@@ -22,8 +22,8 @@ cases:
         package test
         
         a := res {
-          date := time.format([1703444325734390000, "UTC", "%Y-%m-%dT%H:%M:%S%.f"])
-          res := time.parse_ns("%Y-%m-%dT%H:%M:%S%.f", date)
+          date := time.format([1703444325734390000, "UTC", "2006-01-02T15:04:05.999999999"])
+          res := time.parse_ns("2006-01-02T15:04:05.999999999", date)
         }
     query: data.test
     want_result:
@@ -35,6 +35,6 @@ cases:
       - |
         package test
 
-        a := time.parse_ns("%Y-%m-%dT%H:%M:%S%.f", 1703444325734390000)
+        a := time.parse_ns("2006-01-02T15:04:05.999999999", 1703444325734390000)
     query: data.test
     error: '`time.parse_ns` expects string argument. Got `1703444325734390000` instead'

tests/interpreter/cases/rego.v1/tests.yaml

@@ -0,0 +1,481 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+cases:
+  - note: conflict future after rego.v1
+    data: {}
+    modules:
+      - |
+        package test
+
+        import rego.v1
+        import future.keywords.in
+
+    query: data
+    error: "this import shadows previous import"
+
+  - note: conflict rego after future
+    data: {}
+    modules:
+      - |
+        package test
+
+        import future.keywords.in
+        import rego.v1
+
+    query: data
+    error: "this import shadows previous import"
+
+  - note: conflict rego after rego
+    data: {}
+    modules:
+      - |
+        package test
+
+        import rego.v1
+        import rego.v1
+
+    query: data
+    error: "this import shadows previous import"
+
+  - note: allowed future after future
+    data: {}
+    modules:
+      - |
+        package test
+
+        import future.keywords
+        import future.keywords
+
+    query: data.test
+    want_result: {}
+
+  - note: if-required-before-body
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+        allow {
+          1 > 2
+        }
+    query: data
+    error: "`if` keyword is required before rule body"
+
+  - note: ok-if-before-body
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+        allow if {
+          1 < 2
+        }
+    query: data.test
+    want_result:
+        allow: true
+
+  - note: if-required-before-else-body
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+        allow if {
+          1 > 2
+        } else = 5 {
+          1 < 2
+        }
+    query: data
+    error: "`if` keyword is required before rule body"
+
+  - note: ok-if-before-else-body
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+        allow if {
+          1 > 2
+        } else = 5 if {
+          1 < 2
+        }
+    query: data.test
+    want_result:
+      allow: 5
+
+  # cases from https://www.openpolicyagent.org/docs/latest/opa-1/#backwards-compatibility-in-opa-v10
+  - note: invalid1
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+        p { true }
+    query: data
+    error: "`if` keyword is required before rule body"
+
+  - note: invalid2
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+        p.a { true }
+    query: data
+    error: "`if` keyword is required before rule body"
+
+  - note: invalid3
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+        p.a.b { true }
+    query: data
+    error: "`if` keyword is required before rule body"
+
+  - note: valid1
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+        p if true
+    query: data.test
+    want_result:
+      p: true
+
+  - note: valid2
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+        p.a if true
+    query: data.test
+    want_result:
+      p:
+        a: true
+
+  - note: valid3
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+        p.a.b if true
+    query: data.test
+    want_result:
+      p:
+        a:
+          b: true
+
+  - note: valid4
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+        p contains "a"
+    query: data.test
+    want_result:
+      p:
+        set!: ["a"]
+
+  - note: valid5
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+        p := 1
+    query: data.test
+    want_result:
+      p: 1
+
+  - note: valid6
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+        p.a := 1
+    query: data.test
+    want_result:
+      p:
+        a: 1
+
+  - note: valid6
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+        p.a.b := 1
+    query: data.test
+    want_result:
+      p:
+        a:
+          b: 1
+
+  - note: invalid11
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+        p
+    query: data.test
+    error: rule must have a body
+
+  - note: invalid12
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+        p.a
+    query: data.test
+    error: "`contains` keyword is required for partial set rules"
+
+  - note: invalid13
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+        p.a.b
+    query: data.test
+    error: rule must have a body
+
+  - note: invalid21
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+        p { true }
+    query: data.test
+    error: "`if` keyword is required before rule body"
+
+  - note: valid21
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+        p if { true }
+    query: data.test
+    want_result:
+      p: true
+
+  - note: invalid22
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+        p.a
+    query: data.test
+    error: "`contains` keyword is required for partial set rules"
+
+  - note: valid22
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+        p contains "a"
+    query: data.test
+    want_result:
+      p:
+        set!: ["a"]
+
+  - note: invalid23
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+        p.a { true }
+    query: data.test
+    error: "`if` keyword is required before rule body"
+
+  - note: valid22
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+        p contains "a" if { true }
+    query: data.test
+    want_result:
+      p:
+        set!: ["a"]
+
+  - note: invalid24
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+        p.a.b
+    query: data.test
+    error: "rule must have a body or assignment"
+
+  - note: valid22
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+        p.a.b := true
+    query: data.test
+    want_result:
+      p:
+        a:
+          b: true
+
+  - note: invalid25
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+        p.a.b { true }
+    query: data.test
+    error: "`if` keyword is required before rule body"
+
+  - note: valid22
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+        p.a.b if { true }
+    query: data.test
+    want_result:
+      p:
+        a:
+          b: true
+
+  - note: data-shadowed-by-rule
+    data: {}
+    modules:
+      - |
+        package test
+        data = 1
+    query: data.test
+    want_result:
+      data: 1
+
+  - note: invalid-data-shadowed-by-rule
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+        data = 1
+    query: data.test
+    error: data cannot be shadowed
+
+  - note: input-shadowed-by-rule
+    data: {}
+    modules:
+      - |
+        package test
+        input = 1
+    query: data.test
+    want_result:
+      input: 1
+
+  - note: invalid-input-shadowed-by-rule
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+        input = 1
+    query: data.test
+    error: input cannot be shadowed
+
+  - note: input-shadowed-by-local-var
+    data: {}
+    modules:
+      - |
+        package test
+        x {
+          input := 1
+          input > 0
+        }
+        y {
+           # This evaluates to false
+           input = 1
+           input > 0
+        }
+    query: data.test
+    want_result:
+      x: true
+
+  - note: invalid-input-shadowed-by-local-var
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+        x if {
+          input := 1
+          input > 0
+        }
+    query: data.test
+    error: input cannot be shadowed
+
+  - note: data-shadowed-by-local-var
+    data: {}
+    modules:
+      - |
+        package test
+        x {
+          data := 1
+          data > 0
+        }
+    query: data.test
+    want_result:
+      x: true
+
+  - note: invalid-data-shadowed-by-local-var
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+        x if {
+          data := 1
+          data > 0
+        }
+    query: data.test
+    error: data cannot be shadowed
+
+  - note: deprecated-function
+    data: {}
+    modules:
+      - |
+        package test
+        x {
+          cast_array([1])
+        }
+    query: data.test
+    want_result:
+      x: true
+      
+  - note: invalid-deprecated-function
+    data: {}
+    modules:
+      - |
+        package test
+        import rego.v1
+        x if {
+          cast_array([1])
+        }
+    query: data.test
+    error: is deprecated

tests/mod.rs

@@ -1,6 +1,7 @@
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT License.
 
+mod engine;
 mod lexer;
 mod parser;
 mod value;

tests/opa.passing

@@ -95,6 +95,7 @@ subset
 toarray
 topdowndynamicdispatch
 toset
+time
 trim
 trimleft
 trimprefix

tests/opa.rs

@@ -13,7 +13,7 @@ use serde::{Deserialize, Serialize};
 use walkdir::WalkDir;
 
 const OPA_REPO: &str = "https://github.com/open-policy-agent/opa";
-const OPA_BRANCH: &str = "v0.60.0";
+const OPA_BRANCH: &str = "v0.61.0";
 
 #[derive(Serialize, Deserialize, PartialEq, Debug)]
 #[serde(deny_unknown_fields)]
@@ -84,7 +84,7 @@ fn eval_test_case(case: &TestCase) -> Result<Value> {
 
     let mut values = vec![];
     for qr in query_results.result {
-        values.push(if !qr.bindings.is_empty_object() {
+        values.push(if !qr.bindings.as_object()?.is_empty() {
             if case.sort_bindings == Some(true) {
                 let mut v = qr.bindings.clone();
                 let bindings = v.as_object_mut()?;
@@ -105,15 +105,15 @@ fn eval_test_case(case: &TestCase) -> Result<Value> {
         });
     }
 
-    let result = Value::from_array(values);
+    let result = Value::from(values);
     // Make result json compatible. (E.g: avoid sets).
     Value::from_json_str(&result.to_string())
 }
 
 fn json_schema_tests_check(actual: &Value, expected: &Value) -> bool {
     // Fetch `x` binding.
-    let actual = &actual[0][&Value::String("x".into())];
-    let expected = &expected[0][&Value::String("x".into())];
+    let actual = &actual[0]["x"];
+    let expected = &expected[0]["x"];
 
     match (actual, expected) {
         (Value::Array(actual), Value::Array(expected))

tests/parser/cases/import/import.yaml

@@ -224,13 +224,13 @@ cases:
     rego: |
       package test
       import foo
-    error: "import path must begin with one of: {data, future, input}"
+    error: "import path must begin with one of: {data, future, input, rego}"
 
   - note: invalid-beginning-1
     rego: |
       package test
       import foo.bar
-    error: "import path must begin with one of: {data, future, input}"
+    error: "import path must begin with one of: {data, future, input, rego}"
 
   - note: missing-field-1
     rego: |

tests/value/mod.rs

@@ -15,7 +15,7 @@ fn non_string_key() -> Result<()> {
     obj.as_object_mut()?
         .insert(Value::from(std::f64::consts::PI), Value::Null);
     obj.as_object_mut()?.insert(
-        Value::from_array(vec![
+        Value::from(vec![
             Value::Bool(true),
             Value::Null,
             Value::from(std::f64::consts::PI),
@@ -115,14 +115,14 @@ fn value_as_index() -> Result<()> {
 fn string_as_index() -> Result<()> {
     let obj = Value::from_json_str(r#"{ "a" : 5, "b" : 6 }"#)?;
     assert_eq!(&obj["a"], &Value::from(5.0));
-    assert_eq!(&obj[&"b".to_owned()], &Value::from(6.0));
+    assert_eq!(&obj["b".to_owned()], &Value::from(6.0));
     Ok(())
 }
 
 #[test]
 fn usize_as_index() -> Result<()> {
-    assert_eq!(&Value::from_json_str("[1, 2, 3]")?[0], &Value::from(1.0));
-    assert_eq!(&Value::from_json_str("[1, 2, 3]")?[5], &Value::Undefined);
+    assert_eq!(&Value::from_json_str("[1, 2, 3]")?[0u64], &Value::from(1.0));
+    assert_eq!(&Value::from_json_str("[1, 2, 3]")?[5u64], &Value::Undefined);
     Ok(())
 }
 
@@ -135,9 +135,6 @@ fn api() -> Result<()> {
     assert_eq!(v["a"], Value::from(3.145));
     assert_eq!(v.as_object()?.len(), 1);
 
-    // Null
-    assert!(Value::Null.is_null());
-
     let v = Value::new_set();
     assert_eq!(v.as_set()?.len(), 0);