chore: release (#226)

* chore: release

.cargo/config.toml

@@ -1,14 +0,0 @@
-[build]
-#target = "x86_64-unknown-linux-musl"
-
-# Flags to enable code-coverage for all builds.
-# These can be removed later.
-#rustflags = ["-Cinstrument-coverage"]
-incremental = true
-
-[env]
-# Name of coverage instrumentation log file.
-LLVM_PROFILE_FILE="target/cargo-test-%p-%m.profraw"
-
-[target.x86_64-unknown-linux-gnu]
-rustflags = ["-Cinstrument-coverage"]

.devcontainer/devcontainer.json

@@ -0,0 +1,35 @@
+// For format details, see https://aka.ms/devcontainer.json. For config options, see the
+// README at: https://github.com/devcontainers/templates/tree/main/src/rust
+{
+	"name": "Rust",
+	// Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile
+	"image": "mcr.microsoft.com/devcontainers/rust:1-1-bullseye",
+	"features": {
+		"ghcr.io/devcontainers/features/dotnet:2": {},
+		"ghcr.io/devcontainers/features/python:1": {}
+	}
+
+	// Use 'mounts' to make the cargo cache persistent in a Docker Volume.
+	// "mounts": [
+	// 	{
+	// 		"source": "devcontainer-cargo-cache-${devcontainerId}",
+	// 		"target": "/usr/local/cargo",
+	// 		"type": "volume"
+	// 	}
+	// ]
+
+	// Features to add to the dev container. More info: https://containers.dev/features.
+	// "features": {},
+
+	// Use 'forwardPorts' to make a list of ports inside the container available locally.
+	// "forwardPorts": [],
+
+	// Use 'postCreateCommand' to run commands after the container is created.
+	// "postCreateCommand": "rustc --version",
+
+	// Configure tool-specific properties.
+	// "customizations": {},
+
+	// Uncomment to connect as root instead. More info: https://aka.ms/dev-containers-non-root.
+	// "remoteUser": "root"
+}

.github/dependabot.yml

@@ -0,0 +1,11 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  - package-ecosystem: "cargo"
+    directory: "/" # Location of package manifests
+    schedule:
+      interval: "weekly"

.github/workflows/pr.yml

@@ -0,0 +1,48 @@
+name: Rust
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  build:
+
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v3
+    - name: Add musl target
+      run: rustup target add x86_64-unknown-linux-musl
+    - name: Install musl-gcc
+      run: sudo apt update && sudo apt install -y musl-tools
+    - name: Format Check
+      run: cargo fmt --check
+    - name: Build
+      run: cargo build -r --verbose
+    - name: Doc Tests
+      run: cargo test -r --doc
+    - name: Run tests
+      run: cargo test -r --verbose
+    - name: Run tests (ACI)
+      run: cargo test -r --test aci
+    - name: Run tests (KATA)
+      run: cargo test -r --test kata
+    - name: Run tests (OPA Conformance)
+      run: >-
+        cargo test -r --test opa --features opa-testutil,serde_json/arbitrary_precision  -- $(tr '\n' ' ' < tests/opa.passing)
+    - name: Build (MUSL)
+      run: cargo build --verbose --all-targets --target x86_64-unknown-linux-musl
+    - name: Run tests (MUSL)
+      run: cargo test -r --verbose --target x86_64-unknown-linux-musl
+    - name: Run tests (MUSL ACI)
+      run: cargo test -r --test aci --target x86_64-unknown-linux-musl
+    - name: Run tests (KATA ACI)
+      run: cargo test -r --test kata --target x86_64-unknown-linux-musl
+    - name: Run tests (MUSL OPA Conformance)
+      run: >-
+        cargo test -r --test opa --features opa-testutil,serde_json/arbitrary_precision --target x86_64-unknown-linux-musl  -- $(tr '\n' ' ' < tests/opa.passing)

.github/workflows/publish-java.yml

@@ -0,0 +1,89 @@
+name: publish-java
+
+on: workflow_dispatch
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build for ${{ matrix.target }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        include:
+          - target: x86_64-unknown-linux-gnu
+            os: ubuntu-latest
+            extension: so
+            build_cmd: zigbuild
+            glibc: "2.17"
+          - target: aarch64-unknown-linux-gnu
+            os: ubuntu-latest
+            extension: so
+            build_cmd: zigbuild
+            glibc: "2.17"
+          - target: x86_64-apple-darwin
+            os: macos-latest
+            extension: dylib
+          - target: aarch64-apple-darwin
+            os: macos-latest
+            extension: dylib
+          - target: x86_64-pc-windows-msvc
+            os: windows-latest
+            extension: dll
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-java@v4
+        with:
+          java-version: 8
+          distribution: "corretto"
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+      - if: ${{ matrix.build_cmd == 'zigbuild' }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - if: ${{ matrix.build_cmd == 'zigbuild' }}
+        run: pip install cargo-zigbuild
+      - run: cargo ${{ matrix.build_cmd || 'build' }} --release --target ${{ matrix.target }}${{ matrix.glibc && format('.{0}', matrix.glibc) || '' }} --manifest-path ./bindings/java/Cargo.toml
+      - run: mkdir -p native/${{ matrix.target }}
+      - run: mv target/${{ matrix.target }}/release/*.${{ matrix.extension }} ./native/${{ matrix.target }}/
+      - uses: actions/upload-artifact@v4
+        with:
+          name: native-libraries-${{ matrix.target }}
+          path: native/
+
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    needs: build
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-java@v4
+        with:
+          java-version: 8
+          distribution: "corretto"
+          server-id: ossrh
+          server-username: MAVEN_USERNAME
+          server-password: MAVEN_PASSWORD
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: native-libraries-*
+          merge-multiple: true
+          path: ./bindings/java/native/
+      - run: mvn package
+        working-directory: ./bindings/java
+      - uses: actions/upload-artifact@v4
+        with:
+          name: built-jars
+          path: ./bindings/java/target/regorus-java-*.jar
+      - run: mvn deploy
+        working-directory: ./bindings/java
+        env:
+          MAVEN_USERNAME: ${{ secrets.OSSRH_USERNAME }}
+          MAVEN_PASSWORD: ${{ secrets.OSSRH_TOKEN }}

.github/workflows/publish-python.yml

@@ -0,0 +1,114 @@
+# This file is autogenerated by maturin v1.4.0
+# To update, run
+#
+#    maturin generate-ci --manifest-path bindings/python/Cargo.toml github
+#
+name: publish-python
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  linux:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        target: [x86_64, x86, aarch64, armv7, s390x, ppc64le]
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-python@v4
+        with:
+          python-version: '3.10'
+      - name: Build wheels
+        uses: PyO3/maturin-action@v1
+        with:
+          target: ${{ matrix.target }}
+          args: --release --out dist --find-interpreter --manifest-path bindings/python/Cargo.toml
+          sccache: 'true'
+          manylinux: auto
+      - name: Upload wheels
+        uses: actions/upload-artifact@v3
+        with:
+          name: wheels
+          path: dist
+
+  windows:
+    runs-on: windows-latest
+    strategy:
+      matrix:
+        target: [x64, x86]
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-python@v4
+        with:
+          python-version: '3.10'
+          architecture: ${{ matrix.target }}
+      - name: Build wheels
+        uses: PyO3/maturin-action@v1
+        with:
+          target: ${{ matrix.target }}
+          args: --release --out dist --find-interpreter --manifest-path bindings/python/Cargo.toml
+          sccache: 'true'
+      - name: Upload wheels
+        uses: actions/upload-artifact@v3
+        with:
+          name: wheels
+          path: dist
+
+  macos:
+    runs-on: macos-latest
+    strategy:
+      matrix:
+        target: [x86_64, aarch64, universal2-apple-darwin]
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-python@v4
+        with:
+          python-version: '3.10'
+      - name: Build wheels
+        uses: PyO3/maturin-action@v1
+        with:
+          target: ${{ matrix.target }}
+          args: --release --out dist --find-interpreter --manifest-path bindings/python/Cargo.toml
+          sccache: 'true'
+      - name: Upload wheels
+        uses: actions/upload-artifact@v3
+        with:
+          name: wheels
+          path: dist
+
+  sdist:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Build sdist
+        uses: PyO3/maturin-action@v1
+        with:
+          command: sdist
+          args: --out dist --manifest-path bindings/python/Cargo.toml
+      - name: Upload sdist
+        uses: actions/upload-artifact@v3
+        with:
+          name: wheels
+          path: dist
+
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    # Commented out for initial release.
+    # if: "startsWith(github.ref, 'refs/tags/')"
+    needs: [linux, windows, macos, sdist]
+    steps:
+      - uses: actions/download-artifact@v3
+        with:
+          name: wheels
+      - name: Publish to PyPI
+        uses: PyO3/maturin-action@v1
+        env:
+          MATURIN_PYPI_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
+        with:
+          command: upload
+          args: --non-interactive --skip-existing *

.github/workflows/publish-wasm.yml

@@ -0,0 +1,32 @@
+name: publish-wasm
+
+permissions:
+  pull-requests: write
+  contents: write
+
+on: workflow_dispatch
+
+jobs:
+  publish-wasm:
+    name: publish
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      # Setup .npmrc file to publish to npm
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20.x'
+          registry-url: 'https://registry.npmjs.org'
+      - name: Install wasm-pack
+        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
+      - name: Build
+        run: wasm-pack build --target nodejs --release
+        working-directory: ./bindings/wasm
+      - name: Publish
+        run: wasm-pack publish --target nodejs
+        working-directory: ./bindings/wasm
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}

.github/workflows/rust-clippy.yml

@@ -0,0 +1,54 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+# rust-clippy is a tool that runs a bunch of lints to catch common
+# mistakes in your Rust code and help improve your Rust code.
+# More details at https://github.com/rust-lang/rust-clippy
+# and https://rust-lang.github.io/rust-clippy/
+
+name: rust-clippy analyze
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [ "main" ]
+  workflow_dispatch:
+
+jobs:
+  rust-clippy-analyze:
+    name: Run rust-clippy analyzing
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v2
+
+      - name: Install Rust toolchain
+        uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af #@v1
+        with:
+          profile: minimal
+          toolchain: stable
+          components: clippy
+          override: true
+
+      - name: Install required cargo
+        run: cargo install clippy-sarif sarif-fmt
+
+      - name: Run rust-clippy
+        run:
+          cargo clippy
+          --all-features
+          --message-format=json | clippy-sarif | tee rust-clippy-results.sarif | sarif-fmt
+        continue-on-error: true
+
+      - name: Upload analysis results to GitHub
+        uses: github/codeql-action/upload-sarif@v1
+        with:
+          sarif_file: rust-clippy-results.sarif
+          wait-for-processing: true

.github/workflows/rust.yml

@@ -1,39 +0,0 @@
-name: Rust
-
-on:
-  push:
-    branches: [ "main" ]
-  pull_request:
-    branches: [ "main" ]
-
-env:
-  CARGO_TERM_COLOR: always
-
-jobs:
-  build:
-
-    runs-on: ubuntu-latest
-
-    steps:
-    - uses: actions/checkout@v3
-    - name: Add musl target
-      run: rustup target add x86_64-unknown-linux-musl
-    - name: Format Check
-      run: cargo fmt --check
-    - name: Build
-      run: cargo build --verbose
-    - name: Build Tests
-      run: cargo build --all-targets --verbose
-    - name: Clippy
-      run: cargo clippy --all-targets --no-deps -- -Dwarnings
-    - name: Run tests
-      run: cargo test -r --verbose
-    - name: Build (MUSL)
-      run: cargo build --verbose --all-targets --target x86_64-unknown-linux-musl
-    - name: Run tests (MUSL)
-      run: cargo test -r --verbose --target x86_64-unknown-linux-musl
-    - name: Run tests (ACI)
-      run: cargo test -r --test aci
-    - name: Run tests (OPA Conformance)
-      run: >-
-        cargo test -r --test opa -- $(tr '\n' ' ' < tests/opa.passing)

CHANGELOG.md

@@ -6,6 +6,196 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.5](https://github.com/microsoft/regorus/compare/regorus-v0.1.4...regorus-v0.1.5) - 2024-05-07
+
+### Added
+- Support policy files greater than 64KB in size ([#217](https://github.com/microsoft/regorus/pull/217))
+- Add tests for kata containers policies ([#221](https://github.com/microsoft/regorus/pull/221))
+- Support for OPA v0.64.0 ([#219](https://github.com/microsoft/regorus/pull/219))
+  - New builtin `json.marshal_with_options`
+### Changed
+- Improve example in readme ([#224](https://github.com/microsoft/regorus/pull/224))
+### Fixed
+- OPA Conformance: Do not interpret # within regular string ([#216](https://github.com/microsoft/regorus/pull/216))
+
+## [0.1.4](https://github.com/microsoft/regorus/compare/regorus-v0.1.3...regorus-v0.1.4) - 2024-04-22
+
+### Other
+- early return ([#189](https://github.com/microsoft/regorus/pull/189))
+- Fix anyhow dependency issues ([#208](https://github.com/microsoft/regorus/pull/208))
+- remove unused compact-rc dependency ([#207](https://github.com/microsoft/regorus/pull/207))
+
+## [0.1.3](https://github.com/microsoft/regorus/compare/regorus-v0.1.2...regorus-v0.1.3) - 2024-04-11
+
+### Other
+- Add a note in example to prefer eval_rule over eval_query ([#204](https://github.com/microsoft/regorus/pull/204))
+- Do not enable serde_json/arbitrary_precision by default ([#203](https://github.com/microsoft/regorus/pull/203))
+- Rewrite so that code compiles with chrono_tz 0.8.5 and 0.9.0 ([#201](https://github.com/microsoft/regorus/pull/201))
+- update ruby bindings ([#200](https://github.com/microsoft/regorus/pull/200))
+- Store Value instances in AST for strings, numbers and idents ([#197](https://github.com/microsoft/regorus/pull/197))
+- :Value> and From<serde_yaml::Value> ([#196](https://github.com/microsoft/regorus/pull/196))
+- Build dependency on git only if opa.runtime feature is enabled. ([#194](https://github.com/microsoft/regorus/pull/194))
+- Update to opa v0.63.0 ([#192](https://github.com/microsoft/regorus/pull/192))
+- Update pyo3 requirement from 0.20.2 to 0.21.0 ([#190](https://github.com/microsoft/regorus/pull/190))
+- Ruby bindings for existing FFI methods, plus eval_rule() ([#188](https://github.com/microsoft/regorus/pull/188))
+- Evaluate rules directly instead of queries ([#186](https://github.com/microsoft/regorus/pull/186))
+- Remove cruft. ([#184](https://github.com/microsoft/regorus/pull/184))
+
+## [0.1.2](https://github.com/microsoft/regorus/compare/regorus-v0.1.1...regorus-v0.1.2) - 2024-03-22
+
+### Other
+- Handle non simple refs in chained expressions ([#182](https://github.com/microsoft/regorus/pull/182))
+- Ability to gather print statements ([#179](https://github.com/microsoft/regorus/pull/179))
+- Top-down evaluation ([#177](https://github.com/microsoft/regorus/pull/177))
+- Make unary `-` operator OPA compatible. ([#175](https://github.com/microsoft/regorus/pull/175))
+- Don't use deprecated chrono `Duration` methods ([#173](https://github.com/microsoft/regorus/pull/173))
+- Propagate Undefined in object expressions ([#171](https://github.com/microsoft/regorus/pull/171))
+- Bump to OPA v0.62.0 ([#169](https://github.com/microsoft/regorus/pull/169))
+- Fix regression ([#164](https://github.com/microsoft/regorus/pull/164))
+- Separately keep track of whether rules have been evaluated or not ([#163](https://github.com/microsoft/regorus/pull/163))
+- Link Linux libraries against glibc 2.17 using `cargo-zigbuild` ([#158](https://github.com/microsoft/regorus/pull/158))
+
+## [0.1.1](https://github.com/microsoft/regorus/compare/regorus-v0.1.0...regorus-v0.1.1) - 2024-02-23
+
+### Other
+- Handle else block without body ([#155](https://github.com/microsoft/regorus/pull/155))
+- Ignore errors from builtin functions in non strict mode ([#154](https://github.com/microsoft/regorus/pull/154))
+- Java publishing ([#151](https://github.com/microsoft/regorus/pull/151))
+- Document coverage feature; Convenience query functions ([#152](https://github.com/microsoft/regorus/pull/152))
+- Policy Coverage ([#149](https://github.com/microsoft/regorus/pull/149))
+- Initial implementation of policy coverage ([#146](https://github.com/microsoft/regorus/pull/146))
+- Java bindings ([#147](https://github.com/microsoft/regorus/pull/147))
+- Preserve false in single-expression queries ([#145](https://github.com/microsoft/regorus/pull/145))
+- Create rust-clippy.yml ([#143](https://github.com/microsoft/regorus/pull/143))
+- `arc` feature to enable using Engine and other data structures from multiple threads ([#142](https://github.com/microsoft/regorus/pull/142))
+- genpolicy tweaks ([#141](https://github.com/microsoft/regorus/pull/141))
+- io.jwt.decode ([#140](https://github.com/microsoft/regorus/pull/140))
+- Use compact_rc ([#139](https://github.com/microsoft/regorus/pull/139))
+- Scripting tweaks ([#138](https://github.com/microsoft/regorus/pull/138))
+
+## [0.1.0-alpha.3](https://github.com/microsoft/regorus/compare/regorus-v0.1.0-alpha.2...regorus-v0.1.0-alpha.3) - 2024-02-01
+
+### Fixed
+- fix bitwise.and and add tests ([#19](https://github.com/microsoft/regorus/pull/19))
+
+### Other
+- Document bindings ([#119](https://github.com/microsoft/regorus/pull/119))
+- Conform to OPA 0.61.0. ([#118](https://github.com/microsoft/regorus/pull/118))
+- Update publish-python.yml
+- Publish python packages ([#117](https://github.com/microsoft/regorus/pull/117))
+- Publish wasm ([#116](https://github.com/microsoft/regorus/pull/116))
+- Set working-directory for wasm-pack
+- Python bindings ([#115](https://github.com/microsoft/regorus/pull/115))
+- WASM binding ([#114](https://github.com/microsoft/regorus/pull/114))
+- release ([#112](https://github.com/microsoft/regorus/pull/112))
+- Improve crate documentation ([#111](https://github.com/microsoft/regorus/pull/111))
+- Try out manual trigger for release-plz ([#110](https://github.com/microsoft/regorus/pull/110))
+- - Document Location, Expression, QueryResult ([#109](https://github.com/microsoft/regorus/pull/109))
+- Update Cargo.toml ([#108](https://github.com/microsoft/regorus/pull/108))
+- Change version to `0.1.0-alpha.1` ([#107](https://github.com/microsoft/regorus/pull/107))
+- Add crate documentation ([#106](https://github.com/microsoft/regorus/pull/106))
+- Release preparation ([#105](https://github.com/microsoft/regorus/pull/105))
+- Update READEME.md with current status, grammar etc. ([#102](https://github.com/microsoft/regorus/pull/102))
+- Implement builtin `time.parse_duration_ns` method ([#100](https://github.com/microsoft/regorus/pull/100))
+- Implement import keyword ([#101](https://github.com/microsoft/regorus/pull/101))
+- OPA conformance: Pass refheads test suite ([#90](https://github.com/microsoft/regorus/pull/90))
+- OPA conformance: Ensure that `withkeyword` OPA tests pass ([#88](https://github.com/microsoft/regorus/pull/88))
+- Handle walk builtin as a loop expression ([#86](https://github.com/microsoft/regorus/pull/86))
+- Implement most of the builtin `time` module ([#82](https://github.com/microsoft/regorus/pull/82))
+- OPA Conformance
+- OPA conformance ([#81](https://github.com/microsoft/regorus/pull/81))
+- More OPA conformance ([#77](https://github.com/microsoft/regorus/pull/77))
+- OPA conformance ([#71](https://github.com/microsoft/regorus/pull/71))
+- Builtin UUID module ([#68](https://github.com/microsoft/regorus/pull/68))
+- Add tests for builtin `string::format_int` method ([#65](https://github.com/microsoft/regorus/pull/65))
+- More builtins and semantic improvements ([#66](https://github.com/microsoft/regorus/pull/66))
+- More OPA conformance; in-progress: ability to trace interpreter ([#63](https://github.com/microsoft/regorus/pull/63))
+- More OPA conformant semantics ([#62](https://github.com/microsoft/regorus/pull/62))
+- Updated readme. Added bundle support. ([#61](https://github.com/microsoft/regorus/pull/61))
+- crypto builtins ([#57](https://github.com/microsoft/regorus/pull/57))
+- Regex and Glob builtins ([#56](https://github.com/microsoft/regorus/pull/56))
+- Formalize concept of a Number ([#55](https://github.com/microsoft/regorus/pull/55))
+- Lock down ACI tests and more OPA test folders ([#54](https://github.com/microsoft/regorus/pull/54))
+- Fix scheduling regression ([#53](https://github.com/microsoft/regorus/pull/53))
+- add full api to engine ([#50](https://github.com/microsoft/regorus/pull/50))
+- Use Rc<str> instead of string. ([#52](https://github.com/microsoft/regorus/pull/52))
+- More library functions ([#51](https://github.com/microsoft/regorus/pull/51))
+- Added semver.is_valid and semver.compare ([#49](https://github.com/microsoft/regorus/pull/49))
+- OPA conformance tests ([#45](https://github.com/microsoft/regorus/pull/45))
+- Avoid dependency on `source lifetime. ([#43](https://github.com/microsoft/regorus/pull/43))
+- Allow with modifier for builtin and user functions ([#42](https://github.com/microsoft/regorus/pull/42))
+- Special cases of refs to data ([#41](https://github.com/microsoft/regorus/pull/41))
+- Fix scheduling statements that don't create bindings ([#40](https://github.com/microsoft/regorus/pull/40))
+- Ability to run the OPA testsuite ([#39](https://github.com/microsoft/regorus/pull/39))
+- Engine ([#38](https://github.com/microsoft/regorus/pull/38))
+- Use Ref for storing ast nodes in collections. ([#37](https://github.com/microsoft/regorus/pull/37))
+- all, any deprecated functions ([#35](https://github.com/microsoft/regorus/pull/35))
+- all, any deprecated functions ([#34](https://github.com/microsoft/regorus/pull/34))
+- Improvements ([#33](https://github.com/microsoft/regorus/pull/33))
+- Order query expression results ([#32](https://github.com/microsoft/regorus/pull/32))
+- Scheduling of statements in user queries ([#31](https://github.com/microsoft/regorus/pull/31))
+- eval, lex, parse commands ([#30](https://github.com/microsoft/regorus/pull/30))
+- eval_user_query for OPA style results ([#29](https://github.com/microsoft/regorus/pull/29))
+- Arity for builtins ([#28](https://github.com/microsoft/regorus/pull/28))
+- Handle chained _ ([#27](https://github.com/microsoft/regorus/pull/27))
+- Minimize PR 22  ([#26](https://github.com/microsoft/regorus/pull/26))
+- improve errors location ([#23](https://github.com/microsoft/regorus/pull/23))
+- Fix clippy warning ([#25](https://github.com/microsoft/regorus/pull/25))
+- negation of an undefined value should return true ([#21](https://github.com/microsoft/regorus/pull/21))
+- Ensure that scopes are cleaned up correctly upon error. ([#20](https://github.com/microsoft/regorus/pull/20))
+- support of or-functions ([#18](https://github.com/microsoft/regorus/pull/18))
+- Statement Scheduler Implementation
+- Remove unnecessary lifetime
+- json.filter, object.filter, object.get, object.keys, object.remove
+- :to_number builtin
+- :trace builtin
+- bitwise builtins
+- :print builtin
+- Partial sprintf implementation.
+- All string functions except sprintf. TODO: Add tests
+- More string functions without tests
+- More string functions
+- concat and contains
+- string concat (WIP)
+- Support build on non Linux platforms
+- Prepare for upstreaming
+- Test for multi-assign
+- Support dependencies between vars defined in same statement
+- Statement scheduler (WIP)
+- Print small-form table of files without 100% coverage.
+- Code tweaks to improve coverage
+- Tests for aggregates builtins
+- Tests for numbers builtins
+- Tests for arrays builtins
+- Tests for types functions
+- Destructuring of arrays and objects in some-in expressions
+- `some .. in` implementation
+- Fix key, value in membership and some-in
+- refactor
+- Arrays and Aggregates
+- Implement `every` statement ([#4](https://github.com/microsoft/regorus/pull/4))
+- Set loop index variable if not "_" ([#3](https://github.com/microsoft/regorus/pull/3))
+- Allow comprehensions in default value. ([#2](https://github.com/microsoft/regorus/pull/2))
+- Lock down numbers
+- mod function
+- Builtin functions for numbers (WIP)
+- Implement comparison operators. Formalize semantics.
+- Rework assign operations ([#6](https://github.com/microsoft/regorus/pull/6))
+- Locked down supported values in default rule.
+- Improvements to github workflow ([#4](https://github.com/microsoft/regorus/pull/4))
+- Update name to regorus
+- Update rust.yml
+- Add simple git action
+- Add missing config.toml
+- Update license to MIT
+- Code from github.com/anakrish/rego-rs
+- SUPPORT.md committed
+- SECURITY.md committed
+- README.md committed
+- LICENSE committed
+- CODE_OF_CONDUCT.md committed
+- Initial commit
+
 ## [0.1.0-alpha.2](https://github.com/microsoft/regorus/compare/v0.1.0-alpha.1...v0.1.0-alpha.2) - 2024-01-19
 
 ### Other

Cargo.toml

@@ -1,7 +1,17 @@
+[workspace]
+
+members = [
+    "bindings/ffi",
+    "bindings/python",
+    "bindings/wasm",
+    "bindings/java",
+    "bindings/ruby/ext/regorusrb",
+]
+
 [package]
 name = "regorus"
 description = "A fast, lightweight Rego (OPA policy language) interpreter"
-version = "0.1.0-alpha.2"
+version = "0.1.5"
 edition = "2021"
 license-file = "LICENSE"
 repository = "https://github.com/microsoft/regorus"
@@ -9,16 +19,21 @@ keywords = ["interpreter", "opa", "policy-as-code", "rego"]
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
-[features]
-default = ["full-opa"]
+[lib]
+doctest = false
 
+[features]
+default = ["full-opa", "arc"]
+
+arc = ["scientific/arc"]
 base64 = ["dep:data-encoding"]
 base64url = ["dep:data-encoding"]
+coverage = []
 crypto = ["dep:constant_time_eq", "dep:hmac", "dep:hex", "dep:md-5", "dep:sha1", "dep:sha2"]
 deprecated = []
 hex = ["dep:data-encoding"]
 http = []
-jwt = []
+jwt = ["dep:jsonwebtoken", "dep:data-encoding"]
 glob = ["dep:wax"]
 graph = []
 jsonschema = ["dep:jsonschema"]
@@ -32,6 +47,7 @@ yaml = ["serde_yaml"]
 full-opa = [
     "base64",
     "base64url",
+    "coverage",
     "crypto",
     "deprecated",
     "glob",
@@ -53,12 +69,10 @@ full-opa = [
 opa-testutil = []
 
 [dependencies]
-anyhow = {version = "1.0.66", features = ["backtrace"] }
+anyhow = { version = "1.0.45", default-features=false }
 serde = {version = "1.0.150", features = ["derive", "rc"] }
-serde_json = {version = "1.0.89", features = ["arbitrary_precision"] }
+serde_json = "1.0.89"
 serde_yaml = {version = "0.9.16", optional = true }
-log = "0.4.17"
-env_logger="0.10.0"
 lazy_static = "1.4.0"
 rand = "0.8.5"
 num = "0.4.1"
@@ -82,18 +96,19 @@ uuid = { version = "1.6.1", features = ["v4", "fast-rng"], optional = true }
 jsonschema = { version = "0.17.1", default-features = false, optional = true }
 chrono = { version = "0.4.31", optional = true }
 chrono-tz = { version = "0.8.5", optional = true }
-document-features = "0.2.8"
-
+jsonwebtoken = { version = "9.2.0", optional = true }
+itertools = "0.12.1"
 
 [dev-dependencies]
+cfg-if = "1.0.0"
 clap = { version = "4.4.7", features = ["derive"] }
-colored-diff = "0.2.3"
+prettydiff = { version = "0.6.4", default-features = false }
 serde_yaml = "0.9.16"
 test-generator = "0.3.1"
 walkdir = "2.3.2"
 
 [build-dependencies]
-anyhow = "1.0.66"
+anyhow = "1.0"
 
 [profile.release]
 debug = true
@@ -108,3 +123,14 @@ required-features = ["full-opa"]
 name="aci"
 harness=false
 test=false
+
+[[test]]
+name="kata"
+harness=false
+test=false
+
+[package.metadata.docs.rs]
+# To build locally:
+# RUSTDOCFLAGS="--cfg docsrs" cargo +nightly doc --all-features --no-deps
+all-features = true
+rustdoc-args = ["--cfg", "docsrs"]

README.md

@@ -6,47 +6,88 @@
    interpreter written in Rust.
   - *Rigorous* - A rigorous enforcer of well-defined Rego semantics.
 
-Regorus is available as a library that can be easily integrated into your Rust projects.
+Regorus is also
+  - *cross-platform* - Written in platform-agnostic Rust.
+  - *current* - We strive to keep Regorus up to date with latest OPA release. Regorus supports `import rego.v1`.
+  - *compliant* - Regorus is mostly compliant with the latest [OPA release v0.64.0](https://github.com/open-policy-agent/opa/releases/tag/v0.64.0). See [OPA Conformance](#opa-conformance) for details. Note that while we behaviorally produce the same results, we don't yet support all the builtins.
+  - *extensible* - Extend the Rego language by implementing custom stateful builtins in Rust.
+    See [add_extension](https://github.com/microsoft/regorus/blob/fc68bf9c8bea36427dae9401a7d1f6ada771f7ab/src/engine.rs#L352).
+    Support for extensibility using other languages coming soon.
+  - *polyglot* - In addition to Rust, Regorus can be used from *C*, *C++*, *C#*, *Golang*, *Java*, *Javascript*, *Python*, and *Ruby*.
+    This is made possible by the excellent FFI tools available in the Rust ecosystem. See [bindings](#bindings) for information on how to use Regorus from different languages.
 
+    To try out a *Javascript(WASM)* compiled version of Regorus from your browser, visit [Regorus Playground](https://anakrish.github.io/regorus-playground/).
+
+
+
+Regorus is available as a library that can be easily integrated into your Rust projects.
 Here is an example of evaluating a simple Rego policy:
 
 ```rust
-use anyhow::Result;
-use regorus::*;
-use serde_json;
+fn main() -> anyhow::Result<()> {
+    // Create an engine for evaluating Rego policies.
+    let mut engine = regorus::Engine::new();
 
-fn main() -> Result<()> {
-  // Create an engine for evaluating Rego policies.
-  let mut engine = Engine::new();
+    let policy = String::from(
+        r#"
+       package example
+       import rego.v1
 
-  // Add policy to the engine.
-  engine.add_policy(
-    // Filename to be associated with the policy.
-    "hello.rego".to_string(),
+       allow if {
+          ## All actions are allowed for admins.
+          input.principal == "admin"
+       } else if {
+          ## Check if action is allowed for given user.
+          input.action in data.allowed_actions[input.principal]
+       }
+	"#,
+    );
 
-    // Rego policy that just sets a message.
-    r#"
-       package test
-       message = "Hello, World!"
-    "#.to_string()
-  )?;
+    // Add policy to the engine.
+    engine.add_policy(String::from("policy.rego"), policy)?;
 
-  // Evaluate the policy, fetch the message and print it.
-  let results = engine.eval_query("data.test.message".to_string(), false)?;
-  println!("{}", serde_json::to_string_pretty(&results)?);
+    // Add data to engine.
+    engine.add_data(regorus::Value::from_json_str(
+        r#"{
+     "allowed_actions": {
+        "user1" : ["read", "write"],
+        "user2" : ["read"]
+     }}"#,
+    )?)?;
 
-  Ok(())
+    // Set input and evaluate whether user1 can write.
+    engine.set_input(regorus::Value::from_json_str(
+        r#"{
+      "principal": "user1",
+      "action": "write"
+    }"#,
+    )?);
+
+    let r = engine.eval_rule(String::from("data.example.allow"))?;
+    assert_eq!(r, regorus::Value::from(true));
+
+    // Set input and evaluate whether user2 can write.
+    engine.set_input(regorus::Value::from_json_str(
+        r#"{
+      "principal": "user2",
+      "action": "write"
+    }"#,
+    )?);
+
+    let r = engine.eval_rule(String::from("data.example.allow"))?;
+    assert_eq!(r, regorus::Value::Undefined);
+
+    Ok(())
 }
 ```
 
 Regorus is designed with [Confidential Computing](https://confidentialcomputing.io/about/) in mind. In Confidential Computing environments,
-it is important to be able to control exactly what is being run. Regorus allows enabling and disabling various components using cargo 
+it is important to be able to control exactly what is being run. Regorus allows enabling and disabling various components using cargo
 features. By default all features are enabled.
 
 The default build of regorus example program is 6.4M:
 ```bash
 $ cargo build -r --example regorus; strip target/release/examples/regorus; ls -lh target/release/examples/regorus
-$ cargo build -r --example regorus; strip target/release/examples/regorus; ls -lh target/release/examples/regorus
 -rwxr-xr-x  1 anand  staff   6.4M Jan 19 11:23 target/release/examples/regorus*
 ```
 
@@ -57,10 +98,34 @@ $ cargo build -r --example regorus --features "yaml" --no-default-features; stri
 -rwxr-xr-x  1 anand  staff   2.9M Jan 19 11:26 target/release/examples/regorus*
 ```
 
-
-Regorus passes the [OPA v0.60.0 test-suite](https://www.openpolicyagent.org/docs/latest/ir/#test-suite) barring a few
+Regorus passes the [OPA v0.64.0 test-suite](https://www.openpolicyagent.org/docs/latest/ir/#test-suite) barring a few
 builtins. See [OPA Conformance](#opa-conformance) below.
 
+## Bindings
+
+Regorus can be used from a variety of languages:
+
+- *C*: C binding is generated using [cbindgen](https://github.com/mozilla/cbindgen).
+  [corrosion-rs](https://github.com/corrosion-rs/corrosion) can be used to seamlessly use Regorous
+   in your CMake based projects. See [bindings/c](https://github.com/microsoft/regorus/tree/main/bindings/c).
+- *C++*: C++ binding is generated using [cbindgen](https://github.com/mozilla/cbindgen).
+  [corrosion-rs](https://github.com/corrosion-rs/corrosion) can be used to seamlessly use Regorous
+   in your CMake based projects. See [bindings/cpp](https://github.com/microsoft/regorus/tree/main/bindings/cpp).
+- *C#*: C# binding is generated using [csbindgen](https://github.com/Cysharp/csbindgen). See [bindings/csharp](https://github.com/microsoft/regorus/tree/main/bindings/csharp) for an example of how to build and use Regorus in your C# projects.
+- *Golang*: The C bindings are exposed to Golang via [CGo](https://pkg.go.dev/cmd/cgo). See [bindings/go](https://github.com/microsoft/regorus/tree/main/bindings/go) for an example of how to build and use Regorus in your Go projects.
+- *Python*: Python bindings are generated using [pyo3](https://github.com/PyO3/pyo3). Wheels are created using [maturin](https://github.com/PyO3/maturin). See [bindings/python](https://github.com/microsoft/regorus/tree/main/bindings/python).
+- *Java*: Java bindings are developed using [jni-rs](https://github.com/jni-rs/jni-rs).
+  See [bindings/java](https://github.com/microsoft/regorus/tree/main/bindings/java).
+- *Javascript*: Regorus is compiled to WASM using [wasmpack](https://github.com/rustwasm/wasm-pack).
+  See [bindings/wasm](https://github.com/microsoft/regorus/tree/main/bindings/wasm) for an example of using Regorus from nodejs.
+  To try out a *Javascript(WASM)* compiled version of Regorus from your browser, visit [Regorus Playground](https://anakrish.github.io/regorus-playground/).
+- *Ruby*: Ruby bindings are developed using [magnus](https://github.com/matsadler/magnus).
+  See [bindings/ruby](https://github.com/microsoft/regorus/tree/main/bindings/ruby).
+
+To avoid operational overhead, we currently don't publish these bindings to various repositories.
+It is straight-forward to build these bindings yourself.
+
+
 ## Getting Started
 
 [examples/regorus](https://github.com/microsoft/regorus/blob/main/examples/regorus.rs) is an example program that
@@ -117,7 +182,7 @@ This produces the following output
 }
 ```
 
-Next, evaluate a sample [policy](examples/example.rego) and [input](examples/input.json)
+Next, evaluate a sample [policy](https://github.com/microsoft/regorus/blob/main/examples/example.rego) and [input](https://github.com/microsoft/regorus/blob/main/examples/input.json)
 (borrowed from [Rego tutorial](https://www.openpolicyagent.org/docs/latest/#2-try-opa-eval)):
 
 ```bash
@@ -130,6 +195,23 @@ Finally, evaluate real-world [policies](tests/aci/) used in Azure Container Inst
 $ regorus eval -b tests/aci -d tests/aci/data.json -i tests/aci/input.json data.policy.mount_overlay=x
 ```
 
+## Policy coverage
+
+Regorus allows determining which lines of a policy have been executed using the `coverage` feature (enabled by default).
+
+We can try it out using the `regorus` example program by passing in the `--coverage` flag.
+
+```shell
+$ regorus eval -d examples/example.rego -i examples/input.json data.example --coverage
+```
+
+It produces the following coverage report which shows that all lines are executed except the line that sets `allow` to true.
+
+![coverage.png](https://github.com/microsoft/regorus/blob/main/docs/coverage.png?raw=true)
+
+See [Engine::get_coverage_report](https://docs.rs/regorus/latest/regorus/struct.Engine.html#method.get_coverage_report) for details.
+Policy coverage information is useful for debugging your policy as well as to write tests for your policy so that all
+lines of the policy are exercised by the tests.
 
 ## ACI Policies
 
@@ -192,14 +274,13 @@ Benchmark 1: opa eval -b tests/aci -d tests/aci/data.json -i tests/aci/input.jso
 ```
 ## OPA Conformance
 
-Regorus has been verified to be compliant with [OPA v0.60.0](https://github.com/open-policy-agent/opa/releases/tag/v0.60.0)
-using a [test driver](https://github.com/microsoft/regorus/blob/main/tests/opa.rs) that loads and runs the OPA testsuite using Regorus, and verifies that expected outputs
-are produced.
+Regorus has been verified to be compliant with [OPA v0.64.0](https://github.com/open-policy-agent/opa/releases/tag/v0.64.0)
+using a [test driver](https://github.com/microsoft/regorus/blob/main/tests/opa.rs) that loads and runs the OPA testsuite using Regorus, and verifies that expected outputs are produced.
 
 The test driver can be invoked by running:
 
 ```bash
-$ cargo test -r --test opa
+$ cargo test -r --test opa --features opa-testutil,serde_json/arbitrary_precision
 ```
 
 Currently, Regorus passes all the non-builtin specific tests.
@@ -216,7 +297,6 @@ The following test suites don't pass fully due to mising builtins:
 - `graphql`
 - `invalidkeyerror`
 - `jsonpatch`
-- `jwtbuiltins`
 - `jwtdecodeverify`
 - `jwtencodesign`
 - `jwtencodesignraw`
@@ -237,7 +317,6 @@ The following test suites don't pass fully due to mising builtins:
 - `regometadatarule`
 - `regoparsemodule`
 - `rendertemplate`
-- `time`
 
 They are captured in the following [github issues](https://github.com/microsoft/regorus/issues?q=is%3Aopen+is%3Aissue+label%3Alib).
 

bindings/c/CMakeLists.txt

@@ -0,0 +1,27 @@
+# Copyright (c) Microsoft
+# Licensed under the MIT License.
+
+cmake_minimum_required(VERSION 3.12 FATAL_ERROR)
+include(FetchContent)
+
+FetchContent_Declare(
+    Corrosion
+    GIT_REPOSITORY https://github.com/corrosion-rs/corrosion.git
+    GIT_TAG v0.4 # Optionally specify a commit hash, version tag or branch here
+)
+FetchContent_MakeAvailable(Corrosion)
+
+project("regorus-test")
+
+corrosion_import_crate(
+  # Path to <regorus-source-folder>/bindings/ffi/Cargo.toml
+  MANIFEST_PATH "../ffi/Cargo.toml"
+  # Always build regorus in Release mode.
+  PROFILE "release"
+  # Only build the "regorusc" crate.
+  CRATES "regorus-ffi")
+
+add_executable(regorus_test main.c)
+# Add path to <regorus-source-folder>/bindings/ffi
+target_include_directories(regorus_test PRIVATE "../ffi")
+target_link_libraries(regorus_test regorus-ffi)

bindings/c/main.c

@@ -0,0 +1,55 @@
+#include <stdio.h>
+#include "regorus.h"
+
+int main() {
+    // Create engine.
+    RegorusEngine* engine = regorus_engine_new();
+    RegorusResult r;
+
+    // Load policies.
+    r = regorus_engine_add_policy_from_file(engine, "../../../tests/aci/framework.rego");
+    if (r.status != RegorusStatusOk)
+	goto error;
+    regorus_result_drop(r);
+
+    r = regorus_engine_add_policy_from_file(engine, "../../../tests/aci/api.rego");
+    if (r.status != RegorusStatusOk)
+	goto error;
+    regorus_result_drop(r);
+    
+    r = regorus_engine_add_policy_from_file(engine, "../../../tests/aci/policy.rego");
+    if (r.status != RegorusStatusOk)
+	goto error;
+    regorus_result_drop(r);
+
+    // Add data
+    r = regorus_engine_add_data_from_json_file(engine, "../../../tests/aci/data.json");
+    if (r.status != RegorusStatusOk)
+	goto error;
+    regorus_result_drop(r);
+
+    // Set input
+    r = regorus_engine_set_input_from_json_file(engine, "../../../tests/aci/input.json");
+    if (r.status != RegorusStatusOk)
+	goto error;
+    regorus_result_drop(r);
+
+    // Eval query
+    r = regorus_engine_eval_query(engine, "data.framework.mount_overlay=x");
+    if (r.status != RegorusStatusOk)
+	goto error;
+
+    // Print output
+    printf("%s", r.output);
+    regorus_result_drop(r);
+    
+    
+    // Free the engine.
+    regorus_engine_drop(engine);
+
+    return 0;
+error:
+    printf("%s", r.error_message);
+	
+    return 1;
+}

bindings/cpp/CMakeLists.txt

@@ -0,0 +1,28 @@
+# Copyright (c) Microsoft
+# Licensed under the MIT License.
+
+cmake_minimum_required(VERSION 3.12 FATAL_ERROR)
+include(FetchContent)
+
+FetchContent_Declare(
+    Corrosion
+    GIT_REPOSITORY https://github.com/corrosion-rs/corrosion.git
+    GIT_TAG v0.4 # Optionally specify a commit hash, version tag or branch here
+)
+FetchContent_MakeAvailable(Corrosion)
+
+project("regorus-test")
+set(CMAKE_CXX_STANDARD 17)
+
+corrosion_import_crate(
+  # Path to <regorus-source-folder>/bindings/ffi/Cargo.toml
+  MANIFEST_PATH "../ffi/Cargo.toml"
+  # Always build regorus in Release mode.
+  PROFILE "release"
+  # Only build the "regorusc" crate.
+  CRATES "regorus-ffi")
+
+add_executable(regorus_test main.cpp)
+# Add path to <regorus-source-folder>/bindings/ffi
+target_include_directories(regorus_test PRIVATE "../ffi")
+target_link_libraries(regorus_test regorus-ffi)

bindings/cpp/main.cpp

@@ -0,0 +1,118 @@
+#include <iostream>
+#include "regorus.hpp"
+
+void example()
+{
+    // Create engine
+    regorus::Engine engine;
+
+    // Add policies.
+    engine.add_policy("objects.rego",R"(package objects
+
+rect := {`width`: 2, "height": 4}
+cube := {"width": 3, `height`: 4, "depth": 5}
+a := 42
+b := false
+c := null
+d := {"a": a, "x": [b, c]}
+index := 1
+shapes := [rect, cube]
+names := ["prod", `smoke1`, "dev"]
+sites := [{"name": "prod"}, {"name": names[index]}, {"name": "dev"}]
+e := {
+    a: "foo",
+    "three": c,
+    names[2]: b,
+    "four": d,
+}
+f := e["dev"])");
+
+    // Add data.
+    engine.add_data_json(R"({
+    "one": {
+        "bar": "Foo",
+        "baz": 5,
+        "be": true,
+        "bop": 23.4
+    },
+    "two": {
+        "bar": "Bar",
+        "baz": 12.3,
+        "be": false,
+        "bop": 42
+    }
+})");
+
+    engine.add_data_json(R"({
+    "three": {
+        "bar": "Baz",
+        "baz": 15,
+        "be": true,
+        "bop": 4.23
+    }
+})");
+
+    // Set input.
+    engine.set_input_json(R"({
+    "a": 10,
+    "b": "20",
+    "c": 30.0,
+    "d": true
+})");
+
+    // Eval query.
+    auto result = engine.eval_query("[data.one, input.b, data.objects.sites[1]] = x");
+    if (result) {
+	std::cout<<result.output()<<std::endl;
+    } else {
+	std::cerr<<result.error()<<std::endl;
+    }
+}
+
+int main() {
+
+    // Create engine.
+    regorus::Engine engine;
+
+
+    // Load policies.
+    const char* policies[] = {
+	"../../../tests/aci/framework.rego",
+	"../../../tests/aci/policy.rego",
+	"../../../tests/aci/api.rego",
+    };
+
+    // Add policies and data.
+    for (auto policy : policies) {
+	auto result = engine.add_policy_from_file(policy);
+	if (!result) {
+	    std::cerr<<result.error()<<std::endl;
+	    return -1;
+	}
+    }
+    {
+	auto result = engine.add_data_from_json_file("../../../tests/aci/data.json");
+	if (!result) {
+	    std::cerr<<result.error()<<std::endl;
+	    return -1;
+	}
+    }
+
+    // Set input and eval query.
+    {
+	auto result = engine.set_input_from_json_file("../../../tests/aci/input.json");
+	if (!result) {
+	    std::cerr<<result.error()<<std::endl;
+	    return -1;
+	}
+    }
+    auto result = engine.eval_query("data.framework.mount_overlay = x");
+    if (!result) {
+	std::cerr<<result.error()<<std::endl;
+	return -1;
+    }
+
+    std::cout<<result.output()<<std::endl;
+    
+    example();
+}

bindings/cpp/regorus.hpp

@@ -0,0 +1,101 @@
+#ifndef REGORUS_WRAPPER_HPP
+#define REGORUS_WRAPPER_HPP
+
+#include <memory>
+#include <variant>
+
+#include "regorus.ffi.hpp"
+
+namespace regorus {
+
+    class Result {
+    public:
+
+	operator bool() const { return result.status == RegorusStatus::RegorusStatusOk; }
+	bool operator !() const { return result.status != RegorusStatus::RegorusStatusOk; }
+
+	const char* output() const {
+	    if (*this && result.output) {
+		return result.output;
+	    } else {
+		return "";
+	    }
+	}
+	
+	const char* error() const {
+	    if (!*this && result.error_message) {
+		return result.error_message;
+	    } else {
+		return "";
+	    }
+	}
+
+	~Result() {
+	    regorus_result_drop(result);
+	}
+	
+    private:
+	friend class Engine;
+	RegorusResult result;
+
+	Result(RegorusResult r) : result(r) {}	
+    private:
+	Result(const Result&) = delete;
+	Result(Result&&) = delete;
+	Result& operator=(const Result&) = delete;
+
+    };
+    
+    class Engine {
+    public:
+	Engine() : Engine(regorus_engine_new()) {}
+
+	std::unique_ptr<Engine> clone() const {
+	    return std::unique_ptr<Engine>(new Engine(regorus_engine_clone(engine)));
+	}
+
+
+	Result add_policy(const char* path, const char* policy) {
+	    return Result(regorus_engine_add_policy(engine, path, policy));
+	}
+	
+	Result add_policy_from_file(const char* path) {
+	    return Result(regorus_engine_add_policy_from_file(engine, path));
+	}
+	
+	Result add_data_json(const char* data) {
+	    return Result(regorus_engine_add_data_json(engine, data));
+	}
+	
+	Result add_data_from_json_file(const char* path) {
+	    return Result(regorus_engine_add_data_from_json_file(engine, path));
+	}
+	
+	Result set_input_json(const char* input) {
+	    return Result(regorus_engine_set_input_json(engine, input));
+	}
+	
+	Result set_input_from_json_file(const char* path) {
+	    return Result(regorus_engine_set_input_from_json_file(engine, path));
+	}
+
+	Result eval_query(const char* query) {
+	    return Result(regorus_engine_eval_query(engine, query));
+	}
+	
+	~Engine() {
+	    regorus_engine_drop(engine);
+	}
+	    
+	
+    private:
+	RegorusEngine* engine;
+    private:
+	Engine(RegorusEngine* e) : engine(e) {}
+	Engine(const Engine&) = delete;
+	Engine(Engine&&) = delete;
+	Engine& operator=(const Engine&) = delete;
+    };
+}
+
+#endif // REGORUS_WRAPPER_HPP

bindings/csharp/Program.cs

@@ -0,0 +1,51 @@
+using System.Diagnostics;
+
+long nanosecPerTick = (1000L*1000L*1000L) / Stopwatch.Frequency;
+var w = new Stopwatch();
+
+
+// Force load of modules.
+{
+    var _e = new Regorus.Engine();
+    var _j = System.Text.Json.JsonDocument.Parse("{}");
+}
+
+w.Restart();
+
+var engine = new Regorus.Engine();
+
+w.Stop();
+var newEngineTicks = w.ElapsedTicks;
+
+
+w.Restart();
+
+// Load policies and data.
+engine.AddPolicyFromFile("../../tests/aci/framework.rego");
+engine.AddPolicyFromFile("../../tests/aci/api.rego");
+engine.AddPolicyFromFile("../../tests/aci/policy.rego");
+engine.AddDataFromJsonFile("../../tests/aci/data.json");
+
+
+w.Stop();
+var loadPoliciesTicks = w.ElapsedTicks;
+
+
+w.Restart();
+
+// Set input and eval query.
+engine.SetInputFromJsonFile("../../tests/aci/input.json");
+var results = engine.EvalQuery("data.framework.mount_overlay = x");
+var resultsDoc = System.Text.Json.JsonDocument.Parse(results);
+
+w.Stop();
+var evalTicks = w.ElapsedTicks;
+
+Console.WriteLine("{0}", results);
+
+
+Console.WriteLine("Engine creation took {0} msecs", (newEngineTicks*nanosecPerTick)/(1000.0*1000.0));
+Console.WriteLine("Load policies and data took {0} msecs", (loadPoliciesTicks*nanosecPerTick)/(1000.0*1000.0));
+Console.WriteLine("EvalQuery took {0} msecs", (evalTicks*nanosecPerTick)/(1000.0*1000.0));
+
+

bindings/csharp/Regorus.cs

@@ -0,0 +1,169 @@
+using System.Text;
+
+namespace Regorus
+{
+    public class Exception : System.Exception
+    {
+	public Exception(string? message) : base(message) {}
+    }
+
+    public class Engine : ICloneable
+    {
+	unsafe private RegorusFFI.RegorusEngine* E;
+	public Engine()
+	{
+	    unsafe
+	    {
+		E = RegorusFFI.API.regorus_engine_new();
+	    }
+	}
+
+	public object Clone()
+	{
+	    var clone = (Engine)this.MemberwiseClone();
+	    unsafe
+	    {
+		clone.E = RegorusFFI.API.regorus_engine_clone(E);
+	    }
+	    return clone;
+
+	}
+
+	public void AddPolicy(string path, string rego)
+	{
+	    var pathBytes = Encoding.UTF8.GetBytes(path);
+	    var regoBytes = Encoding.UTF8.GetBytes(rego);
+	    
+	    unsafe
+	    {
+		fixed (byte* pathPtr = pathBytes)
+		{
+		    fixed(byte* regoPtr = regoBytes)
+		    {
+			CheckAndDropResult(RegorusFFI.API.regorus_engine_add_policy(E, pathPtr, regoPtr));
+		    }
+		}		
+	    }
+	}
+
+	public void AddPolicyFromFile(string path)
+	{
+	    var pathBytes = Encoding.UTF8.GetBytes(path);
+	    
+	    unsafe
+	    {
+		fixed (byte* pathPtr = pathBytes)
+		{
+		    CheckAndDropResult(RegorusFFI.API.regorus_engine_add_policy_from_file(E, pathPtr));
+		}		
+	    }
+	}
+	
+	public void AddDataJson(string data)
+	{
+	    var dataBytes = Encoding.UTF8.GetBytes(data);
+	    
+	    unsafe
+	    {
+		fixed (byte* dataPtr = dataBytes)
+		{
+		    CheckAndDropResult(RegorusFFI.API.regorus_engine_add_data_json(E, dataPtr));
+
+		}		
+	    }
+	}
+	
+	public void AddDataFromJsonFile(string path)
+	{
+	    var pathBytes = Encoding.UTF8.GetBytes(path);
+	    
+	    unsafe
+	    {
+		fixed (byte* pathPtr = pathBytes)
+		{
+		    CheckAndDropResult(RegorusFFI.API.regorus_engine_add_data_from_json_file(E, pathPtr));
+
+		}		
+	    }
+	}
+	
+	public void SetInputJson(string input)
+	{
+	    var inputBytes = Encoding.UTF8.GetBytes(input);
+	    
+	    unsafe
+	    {
+		fixed (byte* inputPtr = inputBytes)
+		{
+		    CheckAndDropResult(RegorusFFI.API.regorus_engine_set_input_json(E, inputPtr));
+
+		}		
+	    }
+	}
+	
+	public void SetInputFromJsonFile(string path)
+	{
+	    var pathBytes = Encoding.UTF8.GetBytes(path);
+	    
+	    unsafe
+	    {
+		fixed (byte* pathPtr = pathBytes)
+		{
+		    CheckAndDropResult(RegorusFFI.API.regorus_engine_set_input_from_json_file(E, pathPtr));
+
+		}		
+	    }
+	}
+	
+	public string EvalQuery(string query)
+	{
+	    var queryBytes = Encoding.UTF8.GetBytes(query);
+
+	    var resultJson = "";
+	    unsafe
+	    {
+		fixed (byte* queryPtr = queryBytes)
+		{
+		    var result = RegorusFFI.API.regorus_engine_eval_query(E, queryPtr);
+		    if (result.status == RegorusFFI.RegorusStatus.RegorusStatusOk) {
+			if (result.output is not null) {
+			    resultJson = System.Runtime.InteropServices.Marshal.PtrToStringUTF8((IntPtr)result.output);
+			}
+			RegorusFFI.API.regorus_result_drop(result);
+		    } else {
+			CheckAndDropResult(result);
+		    }
+		    
+		}		
+	    }
+	    if (resultJson is not null) {
+		return resultJson;
+	    } else {
+		return "";
+	    }
+	}
+	
+	~Engine()
+	{
+	    unsafe
+	    {
+		RegorusFFI.API.regorus_engine_drop(E);
+	    }
+	}
+
+	
+	void CheckAndDropResult(RegorusFFI.RegorusResult result)
+	{
+	    if (result.status != RegorusFFI.RegorusStatus.RegorusStatusOk) {
+		unsafe {
+		    var message = System.Runtime.InteropServices.Marshal.PtrToStringUTF8((IntPtr)result.error_message);
+		    var ex = new Exception(message);
+		    RegorusFFI.API.regorus_result_drop(result);
+		    throw ex;
+		}
+	    }
+	    RegorusFFI.API.regorus_result_drop(result);		    
+	}
+
+    }
+}

bindings/csharp/regorus-test.csproj

@@ -0,0 +1,24 @@
+<Project Sdk="Microsoft.NET.Sdk"> 
+
+  <Target Name="BuildRegorusFFI">
+    <Exec Command="cargo build -r --manifest-path ../ffi/Cargo.toml" />
+    <Copy SourceFiles="../ffi/RegorusFFI.g.cs" DestinationFolder="." />
+    <ItemGroup>
+        <RegorusDylib Include="..\..\target\release\*regorus_ffi*" />
+    </ItemGroup>    
+    <Copy SourceFiles="@(RegorusDylib)" DestinationFolder="." />
+  </Target>
+
+
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <TargetFramework>net8.0</TargetFramework>
+    <RootNamespace>regorus_test</RootNamespace>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
+  </PropertyGroup>
+
+
+
+</Project>

bindings/ffi/CHANGELOG.md

@@ -0,0 +1,13 @@
+# Changelog
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/microsoft/regorus/releases/tag/regorus-ffi-v0.1.0) - 2024-02-08
+
+### Other
+- C++ binding ([#129](https://github.com/microsoft/regorus/pull/129))
+- Bindings for C, C#, Golang ([#124](https://github.com/microsoft/regorus/pull/124))

bindings/ffi/Cargo.toml

@@ -0,0 +1,17 @@
+[package]
+name = "regorus-ffi"
+version = "0.1.0"
+edition = "2021"
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+[lib]
+crate-type = ["cdylib"]
+
+[dependencies]
+anyhow = "1.0"
+regorus = { path  = "../.." }
+serde_json = "1.0.113"
+
+[build-dependencies]
+cbindgen = "0.26.0"
+csbindgen = "1.9.0"

bindings/ffi/RegorusFFI.g.cs

@@ -0,0 +1,88 @@
+// <auto-generated>
+// This code is generated by csbindgen.
+// DON'T CHANGE THIS DIRECTLY.
+// </auto-generated>
+#pragma warning disable CS8500
+#pragma warning disable CS8981
+using System;
+using System.Runtime.InteropServices;
+
+
+namespace RegorusFFI
+{
+    internal static unsafe partial class API
+    {
+        const string __DllName = "regorusc";
+
+
+
+        /// <summary>Drop a `RegorusResult`.  `output` and `error_message` strings are not valid after drop.</summary>
+        [DllImport(__DllName, EntryPoint = "regorus_result_drop", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        public static extern void regorus_result_drop(RegorusResult r);
+
+        /// <summary>Construct a new Engine  See https://docs.rs/regorus/latest/regorus/struct.Engine.html</summary>
+        [DllImport(__DllName, EntryPoint = "regorus_engine_new", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        public static extern RegorusEngine* regorus_engine_new();
+
+        /// <summary>Clone a [`RegorusEngine`]  To avoid having to parse same policy again, the engine can be cloned after policies and data have been added.</summary>
+        [DllImport(__DllName, EntryPoint = "regorus_engine_clone", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        public static extern RegorusEngine* regorus_engine_clone(RegorusEngine* engine);
+
+        [DllImport(__DllName, EntryPoint = "regorus_engine_drop", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        public static extern void regorus_engine_drop(RegorusEngine* engine);
+
+        /// <summary>Add a policy  The policy is parsed into AST. See https://docs.rs/regorus/latest/regorus/struct.Engine.html#method.add_policy  * `path`: A filename to be associated with the policy. * `rego`: Rego policy.</summary>
+        [DllImport(__DllName, EntryPoint = "regorus_engine_add_policy", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        public static extern RegorusResult regorus_engine_add_policy(RegorusEngine* engine, byte* path, byte* rego);
+
+        [DllImport(__DllName, EntryPoint = "regorus_engine_add_policy_from_file", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        public static extern RegorusResult regorus_engine_add_policy_from_file(RegorusEngine* engine, byte* path);
+
+        /// <summary>Add policy data.  See https://docs.rs/regorus/latest/regorus/struct.Engine.html#method.add_data * `data`: JSON encoded value to be used as policy data.</summary>
+        [DllImport(__DllName, EntryPoint = "regorus_engine_add_data_json", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        public static extern RegorusResult regorus_engine_add_data_json(RegorusEngine* engine, byte* data);
+
+        [DllImport(__DllName, EntryPoint = "regorus_engine_add_data_from_json_file", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        public static extern RegorusResult regorus_engine_add_data_from_json_file(RegorusEngine* engine, byte* path);
+
+        /// <summary>Clear policy data.  See https://docs.rs/regorus/0.1.0-alpha.2/regorus/struct.Engine.html#method.clear_data</summary>
+        [DllImport(__DllName, EntryPoint = "regorus_engine_clear_data", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        public static extern RegorusResult regorus_engine_clear_data(RegorusEngine* engine);
+
+        /// <summary>Set input.  See https://docs.rs/regorus/0.1.0-alpha.2/regorus/struct.Engine.html#method.set_input * `input`: JSON encoded value to be used as input to query.</summary>
+        [DllImport(__DllName, EntryPoint = "regorus_engine_set_input_json", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        public static extern RegorusResult regorus_engine_set_input_json(RegorusEngine* engine, byte* input);
+
+        [DllImport(__DllName, EntryPoint = "regorus_engine_set_input_from_json_file", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        public static extern RegorusResult regorus_engine_set_input_from_json_file(RegorusEngine* engine, byte* path);
+
+        /// <summary>Evaluate query.  See https://docs.rs/regorus/0.1.0-alpha.2/regorus/struct.Engine.html#method.eval_query * `query`: Rego expression to be evaluate.</summary>
+        [DllImport(__DllName, EntryPoint = "regorus_engine_eval_query", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        public static extern RegorusResult regorus_engine_eval_query(RegorusEngine* engine, byte* query);
+
+
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    internal unsafe partial struct RegorusResult
+    {
+        public RegorusStatus status;
+        public byte* output;
+        public byte* error_message;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    internal unsafe partial struct RegorusEngine
+    {
+    }
+
+
+    internal enum RegorusStatus : uint
+    {
+        RegorusStatusOk,
+        RegorusStatusError,
+    }
+
+
+}
+    

bindings/ffi/build.rs

@@ -0,0 +1,32 @@
+extern crate cbindgen;
+extern crate csbindgen;
+
+use std::env;
+
+fn main() {
+    let crate_dir = env::var("CARGO_MANIFEST_DIR").unwrap();
+
+    cbindgen::Builder::new()
+        .with_crate(&crate_dir)
+        .with_language(cbindgen::Language::C)
+        .with_include_guard("REGORUS_H")
+        .generate()
+        .expect("Unable to generate bindings")
+        .write_to_file("regorus.h");
+
+    cbindgen::Builder::new()
+        .with_crate(crate_dir)
+        .with_language(cbindgen::Language::Cxx)
+        .with_include_guard("REGORUS_FFI_HPP")
+        .generate()
+        .expect("Unable to generate bindings")
+        .write_to_file("regorus.ffi.hpp");
+
+    csbindgen::Builder::default()
+        .input_extern_file("src/lib.rs")
+        .csharp_dll_name("regorusc")
+        .csharp_class_name("API")
+        .csharp_namespace("RegorusFFI")
+        .generate_csharp_file("./RegorusFFI.g.cs")
+        .unwrap();
+}

bindings/ffi/cbindgen.toml

@@ -0,0 +1,158 @@
+# This is a template cbindgen.toml file with all of the default values.
+# Some values are commented out because their absence is the real default.
+#
+# See https://github.com/mozilla/cbindgen/blob/master/docs.md#cbindgentoml
+# for detailed documentation of every option here.
+
+
+
+language = "C++"
+
+
+
+############## Options for Wrapping the Contents of the Header #################
+
+# header = "/* Text to put at the beginning of the generated file. Probably a license. */"
+# trailer = "/* Text to put at the end of the generated file */"
+# include_guard = "my_bindings_h"
+# pragma_once = true
+# autogen_warning = "/* Warning, this file is autogenerated by cbindgen. Don't modify this manually. */"
+include_version = false
+# namespace = "my_namespace"
+namespaces = []
+using_namespaces = []
+sys_includes = []
+includes = []
+no_includes = false
+after_includes = ""
+
+
+
+
+############################ Code Style Options ################################
+
+braces = "SameLine"
+line_length = 100
+tab_width = 2
+documentation = true
+documentation_style = "auto"
+documentation_length = "full"
+line_endings = "LF" # also "CR", "CRLF", "Native"
+
+
+
+
+############################# Codegen Options ##################################
+
+style = "both"
+sort_by = "Name" # default for `fn.sort_by` and `const.sort_by`
+usize_is_size_t = true
+
+
+
+[defines]
+# "target_os = freebsd" = "DEFINE_FREEBSD"
+# "feature = serde" = "DEFINE_SERDE"
+
+
+
+[export]
+include = []
+exclude = []
+# prefix = "CAPI_"
+item_types = []
+renaming_overrides_prefixing = false
+
+
+
+[export.rename]
+
+
+
+[export.body]
+
+
+[export.mangle]
+
+
+[fn]
+rename_args = "None"
+# must_use = "MUST_USE_FUNC"
+# deprecated = "DEPRECATED_FUNC"
+# deprecated_with_note = "DEPRECATED_FUNC_WITH_NOTE"
+# no_return = "NO_RETURN"
+# prefix = "START_FUNC"
+# postfix = "END_FUNC"
+args = "auto"
+sort_by = "Name"
+
+
+
+
+[struct]
+rename_fields = "None"
+# must_use = "MUST_USE_STRUCT"
+# deprecated = "DEPRECATED_STRUCT"
+# deprecated_with_note = "DEPRECATED_STRUCT_WITH_NOTE"
+derive_constructor = false
+derive_eq = false
+derive_neq = false
+derive_lt = false
+derive_lte = false
+derive_gt = false
+derive_gte = false
+
+
+
+
+[enum]
+rename_variants = "None"
+# must_use = "MUST_USE_ENUM"
+# deprecated = "DEPRECATED_ENUM"
+# deprecated_with_note = "DEPRECATED_ENUM_WITH_NOTE"
+add_sentinel = false
+prefix_with_name = false
+derive_helper_methods = false
+derive_const_casts = false
+derive_mut_casts = false
+# cast_assert_name = "ASSERT"
+derive_tagged_enum_destructor = false
+derive_tagged_enum_copy_constructor = false
+enum_class = true
+private_default_tagged_enum_constructor = false
+
+
+
+
+[const]
+allow_static_const = true
+allow_constexpr = false
+sort_by = "Name"
+
+
+
+
+[macro_expansion]
+bitflags = false
+
+
+
+
+
+
+############## Options for How Your Rust library Should Be Parsed ##############
+
+[parse]
+parse_deps = false
+# include = []
+exclude = []
+clean = false
+extra_bindings = []
+
+
+
+[parse.expand]
+crates = []
+all_features = false
+default_features = true
+features = []

bindings/ffi/regorus.ffi.hpp

@@ -0,0 +1,95 @@
+#ifndef REGORUS_FFI_HPP
+#define REGORUS_FFI_HPP
+
+#include <cstdarg>
+#include <cstdint>
+#include <cstdlib>
+#include <ostream>
+#include <new>
+
+/// Status of a call on `RegorusEngine`.
+enum class RegorusStatus {
+  /// The operation was successful.
+  RegorusStatusOk,
+  /// The operation was unsuccessful.
+  RegorusStatusError,
+};
+
+/// Wrapper for `regorus::Engine`.
+struct RegorusEngine;
+
+/// Result of a call on `RegorusEngine`.
+///
+/// Must be freed using `regorus_result_drop`.
+struct RegorusResult {
+  /// Status
+  RegorusStatus status;
+  /// Output produced by the call.
+  /// Owned by Rust.
+  char *output;
+  /// Errors produced by the call.
+  /// Owned by Rust.
+  char *error_message;
+};
+
+extern "C" {
+
+/// Drop a `RegorusResult`.
+///
+/// `output` and `error_message` strings are not valid after drop.
+void regorus_result_drop(RegorusResult r);
+
+/// Construct a new Engine
+///
+/// See https://docs.rs/regorus/latest/regorus/struct.Engine.html
+RegorusEngine *regorus_engine_new();
+
+/// Clone a [`RegorusEngine`]
+///
+/// To avoid having to parse same policy again, the engine can be cloned
+/// after policies and data have been added.
+RegorusEngine *regorus_engine_clone(RegorusEngine *engine);
+
+void regorus_engine_drop(RegorusEngine *engine);
+
+/// Add a policy
+///
+/// The policy is parsed into AST.
+/// See https://docs.rs/regorus/latest/regorus/struct.Engine.html#method.add_policy
+///
+/// * `path`: A filename to be associated with the policy.
+/// * `rego`: Rego policy.
+RegorusResult regorus_engine_add_policy(RegorusEngine *engine, const char *path, const char *rego);
+
+RegorusResult regorus_engine_add_policy_from_file(RegorusEngine *engine, const char *path);
+
+/// Add policy data.
+///
+/// See https://docs.rs/regorus/latest/regorus/struct.Engine.html#method.add_data
+/// * `data`: JSON encoded value to be used as policy data.
+RegorusResult regorus_engine_add_data_json(RegorusEngine *engine, const char *data);
+
+RegorusResult regorus_engine_add_data_from_json_file(RegorusEngine *engine, const char *path);
+
+/// Clear policy data.
+///
+/// See https://docs.rs/regorus/0.1.0-alpha.2/regorus/struct.Engine.html#method.clear_data
+RegorusResult regorus_engine_clear_data(RegorusEngine *engine);
+
+/// Set input.
+///
+/// See https://docs.rs/regorus/0.1.0-alpha.2/regorus/struct.Engine.html#method.set_input
+/// * `input`: JSON encoded value to be used as input to query.
+RegorusResult regorus_engine_set_input_json(RegorusEngine *engine, const char *input);
+
+RegorusResult regorus_engine_set_input_from_json_file(RegorusEngine *engine, const char *path);
+
+/// Evaluate query.
+///
+/// See https://docs.rs/regorus/0.1.0-alpha.2/regorus/struct.Engine.html#method.eval_query
+/// * `query`: Rego expression to be evaluate.
+RegorusResult regorus_engine_eval_query(RegorusEngine *engine, const char *query);
+
+} // extern "C"
+
+#endif // REGORUS_FFI_HPP

bindings/ffi/regorus.h

@@ -0,0 +1,127 @@
+#ifndef REGORUS_H
+#define REGORUS_H
+
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdlib.h>
+
+/**
+ * Status of a call on `RegorusEngine`.
+ */
+typedef enum RegorusStatus {
+  /**
+   * The operation was successful.
+   */
+  RegorusStatusOk,
+  /**
+   * The operation was unsuccessful.
+   */
+  RegorusStatusError,
+} RegorusStatus;
+
+/**
+ * Wrapper for `regorus::Engine`.
+ */
+typedef struct RegorusEngine RegorusEngine;
+
+/**
+ * Result of a call on `RegorusEngine`.
+ *
+ * Must be freed using `regorus_result_drop`.
+ */
+typedef struct RegorusResult {
+  /**
+   * Status
+   */
+  enum RegorusStatus status;
+  /**
+   * Output produced by the call.
+   * Owned by Rust.
+   */
+  char *output;
+  /**
+   * Errors produced by the call.
+   * Owned by Rust.
+   */
+  char *error_message;
+} RegorusResult;
+
+/**
+ * Drop a `RegorusResult`.
+ *
+ * `output` and `error_message` strings are not valid after drop.
+ */
+void regorus_result_drop(struct RegorusResult r);
+
+/**
+ * Construct a new Engine
+ *
+ * See https://docs.rs/regorus/latest/regorus/struct.Engine.html
+ */
+struct RegorusEngine *regorus_engine_new(void);
+
+/**
+ * Clone a [`RegorusEngine`]
+ *
+ * To avoid having to parse same policy again, the engine can be cloned
+ * after policies and data have been added.
+ */
+struct RegorusEngine *regorus_engine_clone(struct RegorusEngine *engine);
+
+void regorus_engine_drop(struct RegorusEngine *engine);
+
+/**
+ * Add a policy
+ *
+ * The policy is parsed into AST.
+ * See https://docs.rs/regorus/latest/regorus/struct.Engine.html#method.add_policy
+ *
+ * * `path`: A filename to be associated with the policy.
+ * * `rego`: Rego policy.
+ */
+struct RegorusResult regorus_engine_add_policy(struct RegorusEngine *engine,
+                                               const char *path,
+                                               const char *rego);
+
+struct RegorusResult regorus_engine_add_policy_from_file(struct RegorusEngine *engine,
+                                                         const char *path);
+
+/**
+ * Add policy data.
+ *
+ * See https://docs.rs/regorus/latest/regorus/struct.Engine.html#method.add_data
+ * * `data`: JSON encoded value to be used as policy data.
+ */
+struct RegorusResult regorus_engine_add_data_json(struct RegorusEngine *engine, const char *data);
+
+struct RegorusResult regorus_engine_add_data_from_json_file(struct RegorusEngine *engine,
+                                                            const char *path);
+
+/**
+ * Clear policy data.
+ *
+ * See https://docs.rs/regorus/0.1.0-alpha.2/regorus/struct.Engine.html#method.clear_data
+ */
+struct RegorusResult regorus_engine_clear_data(struct RegorusEngine *engine);
+
+/**
+ * Set input.
+ *
+ * See https://docs.rs/regorus/0.1.0-alpha.2/regorus/struct.Engine.html#method.set_input
+ * * `input`: JSON encoded value to be used as input to query.
+ */
+struct RegorusResult regorus_engine_set_input_json(struct RegorusEngine *engine, const char *input);
+
+struct RegorusResult regorus_engine_set_input_from_json_file(struct RegorusEngine *engine,
+                                                             const char *path);
+
+/**
+ * Evaluate query.
+ *
+ * See https://docs.rs/regorus/0.1.0-alpha.2/regorus/struct.Engine.html#method.eval_query
+ * * `query`: Rego expression to be evaluate.
+ */
+struct RegorusResult regorus_engine_eval_query(struct RegorusEngine *engine, const char *query);
+
+#endif /* REGORUS_H */

bindings/ffi/src/lib.rs

@@ -0,0 +1,248 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+use anyhow::{anyhow, bail, Result};
+use std::ffi::{CStr, CString};
+use std::os::raw::c_char;
+
+/// Status of a call on `RegorusEngine`.
+#[repr(C)]
+pub enum RegorusStatus {
+    /// The operation was successful.
+    RegorusStatusOk,
+
+    /// The operation was unsuccessful.
+    RegorusStatusError,
+}
+
+/// Result of a call on `RegorusEngine`.
+///
+/// Must be freed using `regorus_result_drop`.
+#[repr(C)]
+pub struct RegorusResult {
+    /// Status
+    status: RegorusStatus,
+
+    /// Output produced by the call.
+    /// Owned by Rust.
+    output: *mut c_char,
+
+    /// Errors produced by the call.
+    /// Owned by Rust.
+    error_message: *mut c_char,
+}
+
+fn to_c_str(s: String) -> *mut c_char {
+    match CString::new(s) {
+        Ok(cs) => cs.into_raw(),
+        _ => to_c_str("binding error: failed to create c-style string".to_string()),
+    }
+}
+
+fn from_c_str(s: *const c_char) -> Result<String> {
+    if s.is_null() {
+        bail!("null pointer");
+    }
+    unsafe {
+        CStr::from_ptr(s)
+            .to_str()
+            .map_err(|_| anyhow!("`path`: invalid utf8"))
+            .map(|s| s.to_string())
+    }
+}
+
+fn to_ref<T>(t: &*mut T) -> Result<&mut T> {
+    unsafe { t.as_mut().ok_or_else(|| anyhow!("null pointer")) }
+}
+
+fn to_regorus_result(r: Result<()>) -> RegorusResult {
+    match r {
+        Ok(()) => RegorusResult {
+            status: RegorusStatus::RegorusStatusOk,
+            output: std::ptr::null_mut(),
+            error_message: std::ptr::null_mut(),
+        },
+        Err(e) => RegorusResult {
+            status: RegorusStatus::RegorusStatusError,
+            output: std::ptr::null_mut(),
+            error_message: to_c_str(format!("{e}")),
+        },
+    }
+}
+
+/// Wrapper for `regorus::Engine`.
+#[derive(Clone)]
+pub struct RegorusEngine {
+    engine: ::regorus::Engine,
+}
+
+/// Drop a `RegorusResult`.
+///
+/// `output` and `error_message` strings are not valid after drop.
+#[no_mangle]
+pub extern "C" fn regorus_result_drop(r: RegorusResult) {
+    if !r.error_message.is_null() {
+        unsafe {
+            let _ = CString::from_raw(r.error_message);
+        }
+    }
+}
+
+#[no_mangle]
+/// Construct a new Engine
+///
+/// See https://docs.rs/regorus/latest/regorus/struct.Engine.html
+pub extern "C" fn regorus_engine_new() -> *mut RegorusEngine {
+    let engine = ::regorus::Engine::new();
+    Box::into_raw(Box::new(RegorusEngine { engine }))
+}
+
+/// Clone a [`RegorusEngine`]
+///
+/// To avoid having to parse same policy again, the engine can be cloned
+/// after policies and data have been added.
+#[no_mangle]
+pub extern "C" fn regorus_engine_clone(engine: *mut RegorusEngine) -> *mut RegorusEngine {
+    unsafe {
+        if engine.is_null() {
+            return std::ptr::null_mut();
+        }
+        Box::into_raw(Box::new((*engine).clone()))
+    }
+}
+
+#[no_mangle]
+pub extern "C" fn regorus_engine_drop(engine: *mut RegorusEngine) {
+    if !engine.is_null() {
+        unsafe {
+            let _ = Box::from_raw(engine);
+        }
+    }
+}
+
+/// Add a policy
+///
+/// The policy is parsed into AST.
+/// See https://docs.rs/regorus/latest/regorus/struct.Engine.html#method.add_policy
+///
+/// * `path`: A filename to be associated with the policy.
+/// * `rego`: Rego policy.
+
+#[no_mangle]
+pub extern "C" fn regorus_engine_add_policy(
+    engine: *mut RegorusEngine,
+    path: *const c_char,
+    rego: *const c_char,
+) -> RegorusResult {
+    to_regorus_result(|| -> Result<()> {
+        to_ref(&engine)?
+            .engine
+            .add_policy(from_c_str(path)?, from_c_str(rego)?)
+    }())
+}
+
+#[no_mangle]
+pub extern "C" fn regorus_engine_add_policy_from_file(
+    engine: *mut RegorusEngine,
+    path: *const c_char,
+) -> RegorusResult {
+    to_regorus_result(|| -> Result<()> {
+        to_ref(&engine)?
+            .engine
+            .add_policy_from_file(from_c_str(path)?)
+    }())
+}
+
+/// Add policy data.
+///
+/// See https://docs.rs/regorus/latest/regorus/struct.Engine.html#method.add_data
+/// * `data`: JSON encoded value to be used as policy data.
+#[no_mangle]
+pub extern "C" fn regorus_engine_add_data_json(
+    engine: *mut RegorusEngine,
+    data: *const c_char,
+) -> RegorusResult {
+    to_regorus_result(|| -> Result<()> {
+        to_ref(&engine)?
+            .engine
+            .add_data(regorus::Value::from_json_str(&from_c_str(data)?)?)
+    }())
+}
+
+#[no_mangle]
+pub extern "C" fn regorus_engine_add_data_from_json_file(
+    engine: *mut RegorusEngine,
+    path: *const c_char,
+) -> RegorusResult {
+    to_regorus_result(|| -> Result<()> {
+        to_ref(&engine)?
+            .engine
+            .add_data(regorus::Value::from_json_file(&from_c_str(path)?)?)
+    }())
+}
+
+/// Clear policy data.
+///
+/// See https://docs.rs/regorus/0.1.0-alpha.2/regorus/struct.Engine.html#method.clear_data
+#[no_mangle]
+pub extern "C" fn regorus_engine_clear_data(engine: *mut RegorusEngine) -> RegorusResult {
+    to_regorus_result(|| -> Result<()> {
+        to_ref(&engine)?.engine.clear_data();
+        Ok(())
+    }())
+}
+
+/// Set input.
+///
+/// See https://docs.rs/regorus/0.1.0-alpha.2/regorus/struct.Engine.html#method.set_input
+/// * `input`: JSON encoded value to be used as input to query.
+#[no_mangle]
+pub extern "C" fn regorus_engine_set_input_json(
+    engine: *mut RegorusEngine,
+    input: *const c_char,
+) -> RegorusResult {
+    to_regorus_result(|| -> Result<()> {
+        to_ref(&engine)?
+            .engine
+            .set_input(regorus::Value::from_json_str(&from_c_str(input)?)?);
+        Ok(())
+    }())
+}
+
+#[no_mangle]
+pub extern "C" fn regorus_engine_set_input_from_json_file(
+    engine: *mut RegorusEngine,
+    path: *const c_char,
+) -> RegorusResult {
+    to_regorus_result(|| -> Result<()> {
+        to_ref(&engine)?
+            .engine
+            .set_input(regorus::Value::from_json_file(&from_c_str(path)?)?);
+        Ok(())
+    }())
+}
+
+/// Evaluate query.
+///
+/// See https://docs.rs/regorus/0.1.0-alpha.2/regorus/struct.Engine.html#method.eval_query
+/// * `query`: Rego expression to be evaluate.
+#[no_mangle]
+pub extern "C" fn regorus_engine_eval_query(
+    engine: *mut RegorusEngine,
+    query: *const c_char,
+) -> RegorusResult {
+    let output = || -> Result<String> {
+        let results = to_ref(&engine)?
+            .engine
+            .eval_query(from_c_str(query)?, false)?;
+        Ok(serde_json::to_string_pretty(&results)?)
+    }();
+    match output {
+        Ok(out) => RegorusResult {
+            status: RegorusStatus::RegorusStatusOk,
+            output: to_c_str(out),
+            error_message: std::ptr::null_mut(),
+        },
+        Err(e) => to_regorus_result(Err(e)),
+    }
+}

bindings/go/go.mod

@@ -0,0 +1,3 @@
+module regorus-test
+
+go 1.21.5

bindings/go/main.go

@@ -0,0 +1,58 @@
+package main
+
+import (
+	"fmt"
+	"os"
+	"regorus-test/pkg/regorus"
+	"time"
+)
+
+func main() {
+	var output string
+	var err error
+
+	t := time.Now();
+	
+	// Create new engine
+	engine := regorus.NewEngine()
+	defer engine.Close()
+	elapsed1 := time.Since(t)
+
+	t = time.Now()
+	// Add policies and data.
+	policies := []string{
+		"../../tests/aci/framework.rego",
+		"../../tests/aci/api.rego",
+		"../../tests/aci/policy.rego",
+	}
+	for _, policy := range policies {
+		if err := engine.AddPolicyFromFile(policy); err != nil {
+			fmt.Fprintf(os.Stderr, "error: %v\n", err)
+			os.Exit(1)
+		}
+	}
+	if err = engine.AddDataFromJsonFile("../../tests/aci/data.json"); err != nil {
+		fmt.Fprintf(os.Stderr, "error: %v\n", err)
+		os.Exit(1)
+	}
+	elapsed2 := time.Since(t)
+
+	t = time.Now()
+	// Set input and eval query.
+	if err = engine.SetInputFromJsonFile("../../tests/aci/input.json"); err != nil {
+		fmt.Fprintf(os.Stderr, "error: %v\n", err)
+		os.Exit(1)
+	}
+
+
+	if output, err = engine.EvalQuery("data.framework.mount_overlay = x"); err != nil {
+		fmt.Fprintf(os.Stderr, "error: %v\n", err)
+		os.Exit(1)
+	}
+	elapsed3 := time.Since(t)
+
+	fmt.Println("{%s}", output)
+	fmt.Printf("NewEngine took %v\n", elapsed1)
+	fmt.Printf("Add policies and data took %v\n", elapsed2)
+	fmt.Printf("Set input and eval query took %v\n", elapsed3)
+}

bindings/go/pkg/regorus/mod.go

@@ -0,0 +1,117 @@
+package regorus
+
+// #cgo LDFLAGS: -L ../../../../target/release -lregorus_ffi
+// #include "../../../ffi/regorus.h"
+import "C"
+import (
+	"fmt"
+	"unsafe"
+)
+
+type Engine struct {
+	e *C.RegorusEngine
+}
+
+func NewEngine() *Engine {
+	e := new(Engine)
+	e.e = C.regorus_engine_new()
+	return e
+}
+
+func (e *Engine) Close() {
+	C.regorus_engine_drop(e.e)
+}
+
+func (e *Engine) Clone() *Engine {
+	c := new(Engine)
+	c.e = C.regorus_engine_clone(e.e)
+	return c
+}
+
+func (e *Engine) AddPolicy(path string, rego string) error {
+	path_c := C.CString(path)
+	defer C.free(unsafe.Pointer(path_c))
+
+	rego_c := C.CString(rego)
+	defer C.free(unsafe.Pointer(rego_c))
+
+	result := C.regorus_engine_add_policy(e.e, path_c, rego_c)
+	defer C.regorus_result_drop(result)
+	if result.status != C.RegorusStatusOk {
+		return fmt.Errorf("%s", C.GoString(result.error_message))
+	}
+	return nil
+}
+
+func (e *Engine) AddPolicyFromFile(path string) error {
+	path_c := C.CString(path)
+	defer C.free(unsafe.Pointer(path_c))
+
+	result := C.regorus_engine_add_policy_from_file(e.e, path_c)
+	defer C.regorus_result_drop(result)
+	if result.status != C.RegorusStatusOk {
+		return fmt.Errorf("%s", C.GoString(result.error_message))
+	}
+	return nil
+}
+
+func (e *Engine) AddDataJson(data string) error {
+	data_c := C.CString(data)
+	defer C.free(unsafe.Pointer(data_c))
+
+	result := C.regorus_engine_add_data_json(e.e, data_c)
+	defer C.regorus_result_drop(result)
+	if result.status != C.RegorusStatusOk {
+		return fmt.Errorf("%s", C.GoString(result.error_message))
+	}
+	return nil
+}
+
+func (e *Engine) AddDataFromJsonFile(path string) error {
+	path_c := C.CString(path)
+	defer C.free(unsafe.Pointer(path_c))
+
+	result := C.regorus_engine_add_data_from_json_file(e.e, path_c)
+	defer C.regorus_result_drop(result)
+	if result.status != C.RegorusStatusOk {
+		return fmt.Errorf("%s", C.GoString(result.error_message))
+	}
+	return nil
+}
+
+func (e *Engine) SetInputJson(input string) error {
+	input_c := C.CString(input)
+	defer C.free(unsafe.Pointer(input_c))
+
+	result := C.regorus_engine_set_input_json(e.e, input_c)
+	defer C.regorus_result_drop(result)
+	if result.status != C.RegorusStatusOk {
+		return fmt.Errorf("%s", C.GoString(result.error_message))
+	}
+	return nil
+}
+
+func (e *Engine) SetInputFromJsonFile(path string) error {
+	path_c := C.CString(path)
+	defer C.free(unsafe.Pointer(path_c))
+
+	result := C.regorus_engine_set_input_from_json_file(e.e, path_c)
+	defer C.regorus_result_drop(result)
+	if result.status != C.RegorusStatusOk {
+		return fmt.Errorf("%s", C.GoString(result.error_message))
+	}
+	return nil
+}
+
+func (e *Engine) EvalQuery(query string) (string, error) {
+	query_c := C.CString(query)
+	defer C.free(unsafe.Pointer(query_c))
+
+	result := C.regorus_engine_eval_query(e.e, query_c)
+	defer C.regorus_result_drop(result)
+	if result.status != C.RegorusStatusOk {
+		return "", fmt.Errorf("%s", C.GoString(result.error_message))
+	}
+
+	return C.GoString(result.output), nil
+}

bindings/java/.gitignore

@@ -0,0 +1 @@
+target/

bindings/java/CHANGELOG.md

@@ -0,0 +1,13 @@
+# Changelog
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/microsoft/regorus/releases/tag/regorus-java-v0.1.0) - 2024-02-23
+
+### Other
+- Java publishing ([#151](https://github.com/microsoft/regorus/pull/151))
+- Java bindings ([#147](https://github.com/microsoft/regorus/pull/147))

bindings/java/Cargo.toml

@@ -0,0 +1,17 @@
+[package]
+name = "regorus-java"
+version = "0.1.0"
+edition = "2021"
+repository = "https://github.com/microsoft/regorus/bindings/java"
+description = "Java bindings for Regorus - a fast, lightweight Rego interpreter written in Rust"
+keywords = ["interpreter", "opa", "policy-as-code", "rego"]
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+[lib]
+crate-type = ["cdylib"]
+
+[dependencies]
+anyhow = "1.0"
+serde_json = "1.0.112"
+jni = "0.21.1"
+regorus = { path = "../.." }

bindings/java/README.md

@@ -0,0 +1,97 @@
+# Regorus Java
+
+**Regorus** is
+
+  - *Rego*-*Rus(t)*  - A fast, light-weight [Rego](https://www.openpolicyagent.org/docs/latest/policy-language/)
+   interpreter written in Rust.
+  - *Rigorous* - A rigorous enforcer of well-defined Rego semantics.
+
+See main [Regorus page](https://github.com/microsoft/regorus) for more details about the project.
+
+## Usage
+
+Regorus Java is published to Maven Central with native libraries for the following:
+
+- 64-bit Linux (kernel 3.2+, glibc 2.17+)
+- ARM64 Linux (kernel 4.1, glibc 2.17+)
+- 64-bit macOS (10.12+, Sierra+)
+- ARM64 macOS (11.0+, Big Sur+)
+- 64-bit MSVC (Windows 7+)
+
+If you need to run it in a different OS or an architecture you need to manually [build it](#Building).
+
+If you're on one of the supported platforms, you can just pull prebuilt JAR from Maven Central by declaring a dependency on `com.microsoft.regorus:regorus-java`.
+
+With [Maven](https://maven.apache.org/):
+```xml
+<dependencies>
+    <dependency>
+        <groupId>com.microsoft.regorus</groupId>
+        <artifactId>regorus-java</artifactId>
+        <version>0.0.1</version>
+    </dependency>
+</dependencies>
+```
+
+With [Gradle](https://gradle.org/):
+```kotlin
+// build.gradle.kts
+implementation("com.microsoft.regorus:regorus-java:0.0.1")
+```
+
+Afterwards you can use it as follows:
+
+```java
+import com.microsoft.regorus.Engine;
+
+public class Test {
+    public static void main(String[] args) {
+        try (Engine engine = new Engine()) {
+            engine.addPolicy(
+                "hello.rego",
+                "package test\nmessage = concat(\", \", [input.message, data.message])"
+            );
+            engine.addDataJson("{\"message\":\"World!\"}");
+            engine.setInputJson("{\"message\":\"Hello\"}");
+            String resJson = engine.evalQuery("data.test.message");
+
+            System.out.println(resJson);
+        }
+    }
+}
+```
+
+And you can see the following output once you run it:
+```shell
+{"result":[{"expressions":[{"value":"Hello, World!","text":"data.test.message","location":{"row":1,"col":1}}]}]}
+```
+
+## Building
+
+In order to build Regorus Java for a target platform, you need to install Rust target
+for that target platform first:
+
+```bash
+$ rustup target add aarch64-apple-darwin
+```
+
+Afterwards, you can build native library for that target using:
+```bash
+$ cargo build --release --target aarch64-apple-darwin
+```
+
+You will then have a native library at `../../target/aarch64-apple-darwin/release/libregorus_java.dylib` depending on your target.
+
+You can then build a JAR from source using:
+```bash
+$ mvn package
+```
+
+And you will have a JAR at `./target/regorus-java-0.0.1.jar`.
+
+You need to make sure both of the artifacts in Java's classpath.
+For example with `java` CLI:
+```bash
+$ java -Djava.library.path=../../target/aarch64-apple-darwin/release/ -cp target/regorus-java-0.0.1.jar Test.java
+```
+

bindings/java/com_microsoft_regorus_Engine.h

@@ -0,0 +1,93 @@
+/* DO NOT EDIT THIS FILE - it is machine generated */
+#include <jni.h>
+/* Header for class com_microsoft_regorus_Engine */
+
+#ifndef _Included_com_microsoft_regorus_Engine
+#define _Included_com_microsoft_regorus_Engine
+#ifdef __cplusplus
+extern "C" {
+#endif
+/*
+ * Class:     com_microsoft_regorus_Engine
+ * Method:    nativeNewEngine
+ * Signature: ()J
+ */
+JNIEXPORT jlong JNICALL Java_com_microsoft_regorus_Engine_nativeNewEngine
+  (JNIEnv *, jclass);
+
+/*
+ * Class:     com_microsoft_regorus_Engine
+ * Method:    nativeAddPolicy
+ * Signature: (JLjava/lang/String;Ljava/lang/String;)V
+ */
+JNIEXPORT void JNICALL Java_com_microsoft_regorus_Engine_nativeAddPolicy
+  (JNIEnv *, jclass, jlong, jstring, jstring);
+
+/*
+ * Class:     com_microsoft_regorus_Engine
+ * Method:    nativeAddPolicyFromFile
+ * Signature: (JLjava/lang/String;)V
+ */
+JNIEXPORT void JNICALL Java_com_microsoft_regorus_Engine_nativeAddPolicyFromFile
+  (JNIEnv *, jclass, jlong, jstring);
+
+/*
+ * Class:     com_microsoft_regorus_Engine
+ * Method:    nativeClearData
+ * Signature: (J)V
+ */
+JNIEXPORT void JNICALL Java_com_microsoft_regorus_Engine_nativeClearData
+  (JNIEnv *, jclass, jlong);
+
+/*
+ * Class:     com_microsoft_regorus_Engine
+ * Method:    nativeAddDataJson
+ * Signature: (JLjava/lang/String;)V
+ */
+JNIEXPORT void JNICALL Java_com_microsoft_regorus_Engine_nativeAddDataJson
+  (JNIEnv *, jclass, jlong, jstring);
+
+/*
+ * Class:     com_microsoft_regorus_Engine
+ * Method:    nativeAddDataJsonFromFile
+ * Signature: (JLjava/lang/String;)V
+ */
+JNIEXPORT void JNICALL Java_com_microsoft_regorus_Engine_nativeAddDataJsonFromFile
+  (JNIEnv *, jclass, jlong, jstring);
+
+/*
+ * Class:     com_microsoft_regorus_Engine
+ * Method:    nativeSetInputJson
+ * Signature: (JLjava/lang/String;)V
+ */
+JNIEXPORT void JNICALL Java_com_microsoft_regorus_Engine_nativeSetInputJson
+  (JNIEnv *, jclass, jlong, jstring);
+
+/*
+ * Class:     com_microsoft_regorus_Engine
+ * Method:    nativeSetInputJsonFromFile
+ * Signature: (JLjava/lang/String;)V
+ */
+JNIEXPORT void JNICALL Java_com_microsoft_regorus_Engine_nativeSetInputJsonFromFile
+  (JNIEnv *, jclass, jlong, jstring);
+
+/*
+ * Class:     com_microsoft_regorus_Engine
+ * Method:    nativeEvalQuery
+ * Signature: (JLjava/lang/String;)Ljava/lang/String;
+ */
+JNIEXPORT jstring JNICALL Java_com_microsoft_regorus_Engine_nativeEvalQuery
+  (JNIEnv *, jclass, jlong, jstring);
+
+/*
+ * Class:     com_microsoft_regorus_Engine
+ * Method:    nativeDestroyEngine
+ * Signature: (J)V
+ */
+JNIEXPORT void JNICALL Java_com_microsoft_regorus_Engine_nativeDestroyEngine
+  (JNIEnv *, jclass, jlong);
+
+#ifdef __cplusplus
+}
+#endif
+#endif

bindings/java/pom.xml

@@ -0,0 +1,138 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  Copyright (c) Microsoft Corporation.
+  Licensed under the MIT License.
+-->
+
+<project>
+  <modelVersion>4.0.0</modelVersion>
+
+  <groupId>com.microsoft.regorus</groupId>
+  <artifactId>regorus-java</artifactId>
+  <version>0.0.1</version>
+
+  <name>Regorus Java</name>
+  <description>Java bindings for Regorus - a fast, lightweight Rego interpreter written in Rust</description>
+  <url>https://github.com/microsoft/regorus/bindings/java</url>
+
+  <licenses>
+    <license>
+      <name>MIT License</name>
+      <url>https://opensource.org/blog/license/mit</url>
+    </license>
+  </licenses>
+
+  <properties>
+    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+    <maven.compiler.source>1.8</maven.compiler.source>
+    <maven.compiler.target>1.8</maven.compiler.target>
+  </properties>
+
+  <distributionManagement>
+    <repository>
+      <id>ossrh</id>
+      <name>Central Repository OSSRH</name>
+      <url>https://oss.sonatype.org/service/local/staging/deploy/maven2/</url>
+    </repository>
+  </distributionManagement>
+
+  <dependencies>
+    <dependency>
+      <groupId>junit</groupId>
+      <artifactId>junit</artifactId>
+      <version>3.8.1</version>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>com.google.code.gson</groupId>
+      <artifactId>gson</artifactId>
+      <version>2.10.1</version>
+      <scope>test</scope>
+    </dependency>
+  </dependencies>
+
+  <build>
+    <resources>
+      <resource>
+        <!-- 
+          Include native/ folder in built JAR.
+          During CI build we build native libraries for various platforms
+          and put them into native/ folder. 
+          See `.github/publish-java.yml`.
+         -->
+        <directory>${project.basedir}/native</directory>
+      </resource>
+    </resources>
+
+    <plugins>
+      <plugin>
+        <artifactId>exec-maven-plugin</artifactId>
+        <groupId>org.codehaus.mojo</groupId>
+        <version>3.1.0</version>
+        <executions>
+          <execution>
+            <!-- Build a debug release for tests -->
+            <id>build-native-lib-for-test</id>
+            <phase>test-compile</phase>
+            <goals>
+              <goal>exec</goal>
+            </goals>
+            <configuration>
+              <executable>python3</executable>
+              <arguments>
+                <argument>${project.basedir}/tools/testbuild.py</argument>
+              </arguments>
+            </configuration>
+          </execution>
+        </executions>
+      </plugin>
+
+      <plugin>
+        <artifactId>maven-surefire-plugin</artifactId>
+        <version>3.2.5</version>
+        <configuration>
+          <!-- Add debug build to Java path, so it's discoverable by JVM. This is only for tests. -->
+          <argLine>-Djava.library.path=${project.basedir}/target/debug:${java.library.path}</argLine>
+        </configuration>
+      </plugin>
+
+      <!-- Build javadoc JAR, this is required by Maven Central. -->
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-javadoc-plugin</artifactId>
+        <version>3.6.3</version>
+        <executions>
+          <execution>
+            <id>attach-javadoc</id>
+            <goals>
+              <goal>jar</goal>
+            </goals>
+          </execution>
+        </executions>
+      </plugin>
+
+      <!-- Build sources JAR, this is required by Maven Central. -->
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-source-plugin</artifactId>
+        <version>3.3.0</version>
+        <executions>
+          <execution>
+            <id>attach-sources</id>
+            <goals>
+              <goal>jar</goal>
+            </goals>
+          </execution>
+        </executions>
+      </plugin>
+    </plugins>
+  </build>
+
+  <reporting>
+    <plugins>
+      <plugin>
+        <artifactId>maven-project-info-reports-plugin</artifactId>
+      </plugin>
+    </plugins>
+  </reporting>
+</project>

bindings/java/src/lib.rs

@@ -0,0 +1,163 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+use anyhow::Result;
+use jni::objects::{JClass, JObject, JString};
+use jni::sys::{jlong, jstring};
+use jni::JNIEnv;
+
+use regorus::{Engine, Value};
+
+#[no_mangle]
+pub extern "system" fn Java_com_microsoft_regorus_Engine_nativeNewEngine(
+    _env: JNIEnv,
+    _class: JClass,
+) -> jlong {
+    let engine = Engine::new();
+    Box::into_raw(Box::new(engine)) as jlong
+}
+
+#[no_mangle]
+pub extern "system" fn Java_com_microsoft_regorus_Engine_nativeAddPolicy(
+    env: JNIEnv,
+    _class: JClass,
+    engine_ptr: jlong,
+    path: JString,
+    rego: JString,
+) {
+    let _ = throw_err(env, |env| {
+        let engine = unsafe { &mut *(engine_ptr as *mut Engine) };
+        let path: String = env.get_string(&path)?.into();
+        let rego: String = env.get_string(&rego)?.into();
+        engine.add_policy(path, rego)?;
+        Ok(())
+    });
+}
+
+#[no_mangle]
+pub extern "system" fn Java_com_microsoft_regorus_Engine_nativeAddPolicyFromFile(
+    env: JNIEnv,
+    _class: JClass,
+    engine_ptr: jlong,
+    path: JString,
+) {
+    let _ = throw_err(env, |env| {
+        let engine = unsafe { &mut *(engine_ptr as *mut Engine) };
+        let path: String = env.get_string(&path)?.into();
+        engine.add_policy_from_file(path)?;
+        Ok(())
+    });
+}
+
+#[no_mangle]
+pub extern "system" fn Java_com_microsoft_regorus_Engine_nativeClearData(
+    env: JNIEnv,
+    _class: JClass,
+    engine_ptr: jlong,
+) {
+    let _ = throw_err(env, |_env| {
+        let engine = unsafe { &mut *(engine_ptr as *mut Engine) };
+        engine.clear_data();
+        Ok(())
+    });
+}
+
+#[no_mangle]
+pub extern "system" fn Java_com_microsoft_regorus_Engine_nativeAddDataJson(
+    env: JNIEnv,
+    _class: JClass,
+    engine_ptr: jlong,
+    data: JString,
+) {
+    let _ = throw_err(env, |env| {
+        let engine = unsafe { &mut *(engine_ptr as *mut Engine) };
+        let data: String = env.get_string(&data)?.into();
+        engine.add_data_json(&data)?;
+        Ok(())
+    });
+}
+
+#[no_mangle]
+pub extern "system" fn Java_com_microsoft_regorus_Engine_nativeAddDataJsonFromFile(
+    env: JNIEnv,
+    _class: JClass,
+    engine_ptr: jlong,
+    path: JString,
+) {
+    let _ = throw_err(env, |env| {
+        let engine = unsafe { &mut *(engine_ptr as *mut Engine) };
+        let path: String = env.get_string(&path)?.into();
+        engine.add_data(Value::from_json_file(path)?)?;
+        Ok(())
+    });
+}
+
+#[no_mangle]
+pub extern "system" fn Java_com_microsoft_regorus_Engine_nativeSetInputJson(
+    env: JNIEnv,
+    _class: JClass,
+    engine_ptr: jlong,
+    input: JString,
+) {
+    let _ = throw_err(env, |env| {
+        let engine = unsafe { &mut *(engine_ptr as *mut Engine) };
+        let input: String = env.get_string(&input)?.into();
+        engine.set_input_json(&input)?;
+        Ok(())
+    });
+}
+
+#[no_mangle]
+pub extern "system" fn Java_com_microsoft_regorus_Engine_nativeSetInputJsonFromFile(
+    env: JNIEnv,
+    _class: JClass,
+    engine_ptr: jlong,
+    path: JString,
+) {
+    let _ = throw_err(env, |env| {
+        let engine = unsafe { &mut *(engine_ptr as *mut Engine) };
+        let path: String = env.get_string(&path)?.into();
+        engine.set_input(Value::from_json_file(&path)?);
+        Ok(())
+    });
+}
+
+#[no_mangle]
+pub extern "system" fn Java_com_microsoft_regorus_Engine_nativeEvalQuery(
+    env: JNIEnv,
+    _class: JClass,
+    engine_ptr: jlong,
+    query: JString,
+) -> jstring {
+    let res = throw_err(env, |env| {
+        let engine = unsafe { &mut *(engine_ptr as *mut Engine) };
+        let query: String = env.get_string(&query)?.into();
+        let results = engine.eval_query(query, false)?;
+        let output = env.new_string(serde_json::to_string(&results)?)?;
+        Ok(output.into_raw())
+    });
+
+    match res {
+        Ok(val) => val,
+        Err(_) => JObject::null().into_raw(),
+    }
+}
+
+#[no_mangle]
+pub unsafe extern "system" fn Java_com_microsoft_regorus_Engine_nativeDestroyEngine(
+    _env: JNIEnv,
+    _class: JClass,
+    engine_ptr: jlong,
+) {
+    let _engine = Box::from_raw(engine_ptr as *mut Engine);
+}
+
+fn throw_err<T>(mut env: JNIEnv, mut f: impl FnMut(&mut JNIEnv) -> Result<T>) -> Result<T> {
+    match f(&mut env) {
+        Ok(val) => Ok(val),
+        Err(err) => {
+            env.throw(err.to_string())?;
+            Err(err)
+        }
+    }
+}

bindings/java/src/main/java/com/microsoft/regorus/Engine.java

@@ -0,0 +1,199 @@
+/**
+ * Copyright (c) Microsoft Corporation.
+ * Licensed under the MIT License.
+ **/
+
+package com.microsoft.regorus;
+
+import java.io.File;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.UncheckedIOException;
+import java.nio.file.Files;
+import java.nio.file.StandardCopyOption;
+import java.util.concurrent.atomic.AtomicReference;
+
+/**
+ * Regorus Engine.
+ */
+public class Engine implements AutoCloseable {
+    // Methods exposed from Rust side, you can run
+    // `javac -h . src/main/java/com/microsoft/regorus/Engine.java` to update
+    // expected native header at `bindings/java/com_microsoft_regorus_Engine.h`
+    // if you update the native API.
+    private static native long nativeNewEngine();
+    private static native void nativeAddPolicy(long enginePtr, String path, String rego);
+    private static native void nativeAddPolicyFromFile(long enginePtr, String path);
+    private static native void nativeClearData(long enginePtr);
+    private static native void nativeAddDataJson(long enginePtr, String data);
+    private static native void nativeAddDataJsonFromFile(long enginePtr, String path);
+    private static native void nativeSetInputJson(long enginePtr, String input);
+    private static native void nativeSetInputJsonFromFile(long enginePtr, String path);
+    private static native String nativeEvalQuery(long enginePtr, String query);
+    private static native void nativeDestroyEngine(long enginePtr);
+
+    // Pointer to Engine allocated on Rust's heap, all native methods works on
+    // engine expects this pointer. It is free'd in `close` method.
+    private final long enginePtr;
+
+    /**
+     * Creates a new Regorus Engine.
+     */
+    public Engine() {
+        enginePtr = nativeNewEngine();
+    }
+
+    /**
+     * Adds an inline Rego policy.
+     * 
+     * @param filename Filename of this Rego policy.
+     * @param rego     Rego policy.
+     */
+    public void addPolicy(String filename, String rego) {
+        nativeAddPolicy(enginePtr, filename, rego);
+    }
+
+    /**
+     * Adds a Rego policy from given path.
+     * 
+     * @param path Path of the Rego policy.
+     */
+    public void addPolicyFromFile(String path) {
+        nativeAddPolicyFromFile(enginePtr, path);
+    }
+
+    /**
+     * Clears the data  document.
+     */
+    public void clearData() {
+        nativeClearData(enginePtr);
+    }
+
+    /**
+     * Adds inline data document from given JSON. 
+     * The specified data document is merged into existing data document.
+     * It will throw an error if new data conflicts with the existing document.
+     * 
+     * Example:
+     *  addDataJson("[]") - Throws as it's not an object.
+     *  addDataJson('{"a": 1}') - Fine
+     *  addDataJson('{"b": 2}') - Fine, now {"a": 1, "b": 2}
+     *  addDataJson('{"b": 3}') - Throws as `b` conflicts.
+     * 
+     * @see clearData
+     * 
+     * @throws RuntimeException If data conflicts with the existing document 
+     *                          or data is not an object.
+     * 
+     * @param data Inline data document.
+     */
+    public void addDataJson(String data) throws RuntimeException {
+        nativeAddDataJson(enginePtr, data);
+    }
+
+    /**
+     * Adds data document from given JSON file. 
+     * The specified data document is merged into existing data document.
+     * It will throw an error if new data conflicts with the existing document.
+     * 
+     * @see addDataJson
+     * @see clearData
+     * 
+     * @throws RuntimeException If data conflicts with the existing document 
+     *                          or data is not an object.
+     * 
+     * @param path Path to JSON data document.
+     */
+    public void addDataJsonFromFile(String path) throws RuntimeException {
+        nativeAddDataJsonFromFile(enginePtr, path);
+    }
+
+    /**
+     * Sets inline JSON input.
+     * 
+     * @param input inline JSON input.
+     */
+    public void setInputJson(String input) {
+        nativeSetInputJson(enginePtr, input);
+    }
+
+    /**
+     * Sets JSON input from given path.
+     * 
+     * @param path Path to JSON input.
+     */
+    public void setInputJsonFromFile(String path) {
+        nativeSetInputJsonFromFile(enginePtr, path);
+    }
+
+    /**
+     * Evaluates given Rego query and returns a JSON string as a result.
+     * 
+     * @param query The Rego query.
+     * 
+     * @return Query results as a JSON string.
+     */
+    public String evalQuery(String query) {
+        return nativeEvalQuery(enginePtr, query);
+    }
+    
+    @Override
+    public void close() {
+        nativeDestroyEngine(enginePtr);
+    }
+
+    // Loading native library from JAR is adapted from:
+    // https://github.com/apache/opendal/blob/93e5f65bbf30df2fed4bdd95bb0685c73c6418c2/bindings/java/src/main/java/org/apache/opendal/NativeLibrary.java
+    // https://github.com/apache/opendal/blob/93e5f65bbf30df2fed4bdd95bb0685c73c6418c2/bindings/java/src/main/java/org/apache/opendal/Environment.java
+    static {
+        // Build a Rust target triple, like: 'aarch64-unknown-linux-gnu'.
+        final StringBuilder targetTripleBuilder = new StringBuilder();
+
+        final String arch = System.getProperty("os.arch").toLowerCase();
+        if (arch.equals("aarch64")) {
+            targetTripleBuilder.append("aarch64");
+        } else {
+            targetTripleBuilder.append("x86_64");
+        }
+        targetTripleBuilder.append("-");
+
+        final String os = System.getProperty("os.name").toLowerCase();
+        if (os.startsWith("windows")) {
+            targetTripleBuilder.append("pc-windows-msvc");
+        } else if (os.startsWith("mac")) {
+            targetTripleBuilder.append("apple-darwin");
+        } else {
+            targetTripleBuilder.append("unknown-linux-gnu");
+        }
+
+        loadNativeLibrary(targetTripleBuilder.toString());
+    }
+
+    private static void loadNativeLibrary(String targetTriple) {
+        try {
+            // try dynamic library - the search path can be configured via "-Djava.library.path"
+            System.loadLibrary("regorus_java");
+            return;
+        } catch (UnsatisfiedLinkError ignore) {
+            // ignore - try from classpath
+        }
+
+        // Native libraries will be bundles into JARs like: 
+        // `aarch64-apple-darwin/libregorus_java.dylib`
+        final String libraryName = System.mapLibraryName("regorus_java");
+        final String libraryPath = "/" + targetTriple + "/" + libraryName;
+
+        try (final InputStream is = Engine.class.getResourceAsStream(libraryPath)) {
+            if (is == null) {
+                throw new RuntimeException("Cannot find " + libraryPath + "\nSee https://github.com/microsoft/regorus/tree/main/bindings/java for help.");
+            }
+            final int dot = libraryPath.indexOf('.');
+            final File tmpFile = File.createTempFile(libraryPath.substring(0, dot), libraryPath.substring(dot));
+            tmpFile.deleteOnExit();
+            Files.copy(is, tmpFile.toPath(), StandardCopyOption.REPLACE_EXISTING);
+            System.load(tmpFile.getAbsolutePath());
+        } catch (IOException exception) {
+            throw new RuntimeException(exception);
+        }
+    }
+}

bindings/java/src/test/java/com/microsoft/regorus/EngineTest.java

@@ -0,0 +1,36 @@
+/**
+ * Copyright (c) Microsoft Corporation.
+ * Licensed under the MIT License.
+ **/
+package com.microsoft.regorus;
+
+import java.util.Map;
+import java.util.ArrayList;
+import junit.framework.TestCase;
+import junit.framework.Assert;
+import com.google.gson.Gson;
+import com.google.gson.reflect.TypeToken;
+
+public class EngineTest extends TestCase
+{
+    public void test_engine()
+    {
+        String resJson;
+        try (Engine engine = new Engine()) {
+            engine.addPolicy(
+                "hello.rego",
+                "package test\nmessage = concat(\", \", [input.message, data.message])"
+            );
+            engine.addDataJson("{\"message\":\"World!\"}");
+            engine.setInputJson("{\"message\":\"Hello\"}");
+            resJson = engine.evalQuery("data.test.message");
+        }
+
+        Gson gson = new Gson();
+        Map res = gson.fromJson(resJson, Map.class);
+        ArrayList results = (ArrayList) res.get("result");
+        ArrayList expressions = (ArrayList) ((Map) results.get(0)).get("expressions");
+        Map expression = (Map) expressions.get(0);
+        Assert.assertEquals("Hello, World!", expression.get("value"));
+    }
+}

bindings/java/tools/testbuild.py

@@ -0,0 +1,17 @@
+#!/usr/bin/env python3
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+#
+# Builds Regorus Java to use in Java tests. See `pom.xml`.
+
+from pathlib import Path
+import subprocess
+
+if __name__ == "__main__":
+    basedir = Path(__file__).parent.parent
+
+    output = basedir / "target"
+    Path(output).mkdir(exist_ok=True, parents=True)
+    cmd = ["cargo", "build", "--target-dir", str(output)]
+    print("$ " + subprocess.list2cmdline(cmd))
+    subprocess.run(cmd, cwd=basedir, check=True)

bindings/python/.python-version

@@ -0,0 +1 @@
+pyo3

bindings/python/CHANGELOG.md

@@ -0,0 +1,14 @@
+# Changelog
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/microsoft/regorus/releases/tag/regoruspy-v0.1.0) - 2024-02-01
+
+### Other
+- Document bindings ([#119](https://github.com/microsoft/regorus/pull/119))
+- Publish python packages ([#117](https://github.com/microsoft/regorus/pull/117))
+- Python bindings ([#115](https://github.com/microsoft/regorus/pull/115))

bindings/python/Cargo.toml

@@ -0,0 +1,20 @@
+[package]
+name = "regoruspy"
+version = "0.1.0"
+edition = "2021"
+repository = "https://github.com/microsoft/regorus/bindings/python"
+description = "Python bindings for Regorus - a fast, lightweight Rego interpreter written in Rust"
+keywords = ["interpreter", "opa", "policy-as-code", "rego"]
+
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+[lib]
+crate-type = ["cdylib"]
+
+[dependencies]
+anyhow = "1.0"
+ordered-float = "4.2.0"
+pyo3 = {version = "0.21.0", features = ["anyhow", "extension-module"] }
+regorus = { path  = "../.." }
+serde_json = "1.0.112"
+

bindings/python/README.md

@@ -0,0 +1,67 @@
+# regorus
+
+**Regorus** is
+
+  - *Rego*-*Rus(t)*  - A fast, light-weight [Rego](https://www.openpolicyagent.org/docs/latest/policy-language/)
+   interpreter written in Rust.
+  - *Rigorous* - A rigorous enforcer of well-defined Rego semantics.
+
+Regorus can be used in Python via `regorus` package. (It is not yet available in PyPI, but can be manually built.)
+
+See [Repository](https://github.com/microsoft/regorus).
+
+To build this binding, see [building](https://github.com/microsoft/regorus/bindings/python/building.md)
+
+## Usage
+```Python
+import regorus
+
+# Create engine
+engine = regorus.Engine()
+
+# Load policies
+engine.add_policy_from_file('../../tests/aci/framework.rego')
+engine.add_policy_from_file('../../tests/aci/api.rego')
+engine.add_policy_from_file('../../tests/aci/policy.rego')
+
+# Add policy data
+data = {
+  "metadata": {
+    "devices": {
+      "/run/layers/p0-layer0": "1b80f120dbd88e4355d6241b519c3e25290215c469516b49dece9cf07175a766",
+      "/run/layers/p0-layer1": "e769d7487cc314d3ee748a4440805317c19262c7acd2fdbdb0d47d2e4613a15c",
+      "/run/layers/p0-layer2": "eb36921e1f82af46dfe248ef8f1b3afb6a5230a64181d960d10237a08cd73c79",
+      "/run/layers/p0-layer3": "41d64cdeb347bf236b4c13b7403b633ff11f1cf94dbc7cf881a44d6da88c5156",
+      "/run/layers/p0-layer4": "4dedae42847c704da891a28c25d32201a1ae440bce2aecccfa8e6f03b97a6a6c",
+      "/run/layers/p0-layer5": "fe84c9d5bfddd07a2624d00333cf13c1a9c941f3a261f13ead44fc6a93bc0e7a"
+    }
+  }
+}
+engine.add_data(data)
+
+# Set input
+input = {
+  "containerID": "container0",
+  "layerPaths": [
+    "/run/layers/p0-layer0",
+    "/run/layers/p0-layer1",
+    "/run/layers/p0-layer2",
+    "/run/layers/p0-layer3",
+    "/run/layers/p0-layer4",
+    "/run/layers/p0-layer5"
+  ],
+  "target": "/run/gcs/c/container0/rootfs"
+}
+engine.set_input(input)
+
+# Eval query
+results = engine.eval_query('data.framework.mount_overlay=x')
+
+# Print results
+print(results['result'][0])
+
+# Eval query as json
+results_json = engine.eval_query_as_json('data.framework.mount_overlay=x')
+print(results_json)
+```
+

bindings/python/building.md

@@ -0,0 +1,22 @@
+- Install maturin
+  ```
+  pipx install maturin
+  ```
+  See [Maturin User Guide](https://www.maturin.rs)
+  
+- Build bindings for Python
+  ```
+  cd bindings/python
+  maturin build --release --target-dir wheels
+  ```
+  
+- Install python wheel
+  ```
+  pip3 install ../../target/wheels/regorus*.whl --force-reinstall
+  ```
+  
+- Run test script
+  ```
+  python3 test.py
+  ```
+  

bindings/python/pyproject.toml

@@ -0,0 +1,16 @@
+[build-system]
+requires = ["maturin>=1.4,<2.0"]
+build-backend = "maturin"
+
+[project]
+name = "regorus"
+requires-python = ">=3.8"
+classifiers = [
+    "Programming Language :: Rust",
+    "Programming Language :: Python :: Implementation :: CPython",
+    "Programming Language :: Python :: Implementation :: PyPy",
+]
+dynamic = ["version"]
+
+[tool.maturin]
+features = ["pyo3/extension-module"]

bindings/python/src/lib.rs

@@ -0,0 +1,301 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+use anyhow::{anyhow, Result};
+use pyo3::exceptions::PyTypeError;
+use pyo3::prelude::*;
+use pyo3::types::*;
+
+use std::collections::{BTreeMap, BTreeSet};
+
+use ::regorus::Value;
+
+/// Regorus engine.
+#[pyclass(unsendable)]
+pub struct Engine {
+    engine: ::regorus::Engine,
+}
+
+impl Default for Engine {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl Clone for Engine {
+    /// Clone a [`Engine`]
+    ///
+    /// To avoid having to parse same policy again, the engine can be cloned
+    /// after policies and data have been added.
+    fn clone(&self) -> Self {
+        Self {
+            engine: self.engine.clone(),
+        }
+    }
+}
+
+fn from<'source>(ob: &'source PyAny) -> Result<Value, PyErr> {
+    // dicts
+    Ok(if let Ok(dict) = ob.downcast::<PyDict>() {
+        let mut map = BTreeMap::new();
+        for (k, v) in dict {
+            map.insert(from(k)?, from(v)?);
+        }
+        map.into()
+    }
+    // set
+    else if let Ok(pset) = ob.downcast::<PySet>() {
+        let mut set = BTreeSet::new();
+        for v in pset {
+            set.insert(from(v)?);
+        }
+        set.into()
+    }
+    // frozen set
+    else if let Ok(pfset) = ob.downcast::<PyFrozenSet>() {
+        //
+        let mut set = BTreeSet::new();
+        for v in pfset {
+            set.insert(from(v)?);
+        }
+        set.into()
+    }
+    // lists and tuples
+    else if let Ok(plist) = ob.downcast::<PyList>() {
+        let mut array = Vec::new();
+        for v in plist {
+            array.push(from(v)?);
+        }
+        array.into()
+    } else if let Ok(ptuple) = ob.downcast::<PyTuple>() {
+        let mut array = Vec::new();
+        for v in ptuple {
+            array.push(from(v)?);
+        }
+        array.into()
+    }
+    // String
+    else if let Ok(s) = String::extract(ob) {
+        s.into()
+    }
+    // Numeric
+    else if let Ok(v) = i64::extract(ob) {
+        v.into()
+    } else if let Ok(v) = u64::extract(ob) {
+        v.into()
+    } else if let Ok(v) = f64::extract(ob) {
+        v.into()
+    }
+    // Boolean
+    else if let Ok(b) = bool::extract(ob) {
+        b.into()
+    }
+    // None
+    else if ob.downcast::<PyNone>().is_ok() {
+        Value::Null
+    }
+    // Anything that is a sequence
+    else if let Ok(pseq) = ob.downcast::<PySequence>() {
+        let mut array = Vec::new();
+        for i in 0..pseq.len()? {
+            array.push(from(pseq.get_item(i)?)?);
+        }
+        array.into()
+    }
+    // Anything that is a map
+    else if let Ok(pmap) = ob.downcast::<PyMapping>() {
+        let mut map = BTreeMap::new();
+        let keys = pmap.keys()?;
+        let values = pmap.values()?;
+        for i in 0..keys.len()? {
+            let key = keys.get_item(i)?;
+            let value = values.get_item(i)?;
+            map.insert(from(key)?, from(value)?);
+        }
+        map.into()
+    } else {
+        return Err(PyErr::new::<PyTypeError, _>(
+            "object cannot be converted to RegoValue",
+        ));
+    })
+}
+
+fn to(mut v: Value, py: Python<'_>) -> Result<PyObject> {
+    Ok(match v {
+        Value::Null => None::<u64>.to_object(py),
+
+        // TODO: Revisit this mapping
+        Value::Undefined => None::<u64>.to_object(py),
+
+        Value::Bool(b) => b.to_object(py),
+        Value::String(s) => s.to_object(py),
+
+        Value::Number(_) => {
+            if let Ok(f) = v.as_f64() {
+                f.to_object(py)
+            } else if let Ok(u) = v.as_u64() {
+                u.to_object(py)
+            } else {
+                v.as_i64()?.to_object(py)
+            }
+        }
+
+        Value::Array(_) => {
+            let list = PyList::empty(py);
+            for v in std::mem::replace(v.as_array_mut()?, Vec::new()) {
+                list.append(to(v, py)?)?;
+            }
+            list.into()
+        }
+
+        Value::Set(_) => {
+            let set = PySet::empty(py)?;
+            for v in std::mem::replace(v.as_set_mut()?, BTreeSet::new()) {
+                set.add(to(v, py)?)?;
+            }
+            set.into()
+        }
+
+        Value::Object(_) => {
+            let dict = PyDict::new(py);
+            for (k, v) in std::mem::replace(v.as_object_mut()?, BTreeMap::new()) {
+                dict.set_item(to(k, py)?, to(v, py)?)?;
+            }
+            dict.into()
+        }
+    })
+}
+
+#[pymethods]
+impl Engine {
+    /// Construct a new Engine
+    #[new]
+    pub fn new() -> Self {
+        Self {
+            engine: ::regorus::Engine::new(),
+        }
+    }
+
+    /// Add a policy
+    ///
+    /// The policy is parsed into AST.
+    ///
+    /// * `path`: A filename to be associated with the policy.
+    /// * `rego`: Rego policy.
+    pub fn add_policy(&mut self, path: String, rego: String) -> Result<()> {
+        self.engine.add_policy(path, rego)
+    }
+
+    /// Add a policy from given file.
+    ///
+    /// The policy is parsed into AST.
+    ///
+    /// * `path`: Path to the policy file.
+    pub fn add_policy_from_file(&mut self, path: String) -> Result<()> {
+        self.engine.add_policy_from_file(path)
+    }
+
+    /// Add policy data.
+    ///
+    /// * `data`: Rego value. A Rego value is a number, bool, string, None
+    ///           or a list/set/map whose items themselves are Rego values.
+    pub fn add_data(&mut self, data: &PyAny) -> Result<()> {
+        let data = from(data)?;
+        self.engine.add_data(data)
+    }
+
+    /// Add policy data.
+    ///
+    /// * `data`: JSON encoded value to be used as policy data.
+    pub fn add_data_json(&mut self, data: String) -> Result<()> {
+        let data = Value::from_json_str(&data)?;
+        self.engine.add_data(data)
+    }
+
+    /// Add policy data from file.
+    ///
+    /// * `path`: Path to JSON policy data.
+    pub fn add_data_from_json_file(&mut self, path: String) -> Result<()> {
+        let data = Value::from_json_file(&path)?;
+        self.engine.add_data(data)
+    }
+
+    /// Clear policy data.
+    pub fn clear_data(&mut self) -> Result<()> {
+        self.engine.clear_data();
+        Ok(())
+    }
+
+    /// Set input.
+    ///
+    /// * `input`: Rego value. A Rego value is a number, bool, string, None
+    ///            or a list/set/map whose items themselves are Rego values.
+    pub fn set_input(&mut self, input: &PyAny) -> Result<()> {
+        let input = from(input)?;
+        self.engine.set_input(input);
+        Ok(())
+    }
+
+    /// Set input.
+    ///
+    /// * `input`: JSON encoded value to be used as input to query.
+    pub fn set_input_json(&mut self, input: String) -> Result<()> {
+        let input = Value::from_json_str(&input)?;
+        self.engine.set_input(input);
+        Ok(())
+    }
+
+    /// Set input.
+    ///
+    /// * `path`: Path to JSON input data.
+    pub fn set_input_from_json_file(&mut self, path: String) -> Result<()> {
+        let input = Value::from_json_file(&path)?;
+        self.engine.set_input(input);
+        Ok(())
+    }
+
+    /// Evaluate query.
+    ///
+    /// * `query`: Rego expression to be evaluate.
+    pub fn eval_query(&mut self, query: String, py: Python<'_>) -> Result<PyObject> {
+        let results = self.engine.eval_query(query, false)?;
+
+        let rlist = PyList::empty(py);
+        for result in results.result.into_iter() {
+            let rdict = PyDict::new(py);
+
+            let elist = PyList::empty(py);
+            for expr in result.expressions.into_iter() {
+                let edict = PyDict::new(py);
+                edict.set_item("value".to_object(py), to(expr.value, py)?)?;
+                edict.set_item("text".to_object(py), expr.text.as_ref().to_object(py))?;
+
+                let ldict = PyDict::new(py);
+                ldict.set_item("row".to_object(py), expr.location.row.to_object(py))?;
+                ldict.set_item("col".to_object(py), expr.location.col.to_object(py))?;
+
+                edict.set_item("location".to_object(py), ldict)?;
+                elist.append(edict)?;
+            }
+
+            rdict.set_item("expressions".to_object(py), elist)?;
+            rdict.set_item("bindings".to_object(py), to(result.bindings, py)?)?;
+            rlist.append(rdict)?;
+        }
+        let dict = PyDict::new(py);
+        dict.set_item("result".to_object(py), rlist)?;
+        Ok(dict.into())
+    }
+
+    /// Evaluate query. Returns result as JSON.
+    ///
+    /// * `query`: Rego expression to be evaluate.
+    pub fn eval_query_as_json(&mut self, query: String) -> Result<String> {
+        let results = self.engine.eval_query(query, false)?;
+        serde_json::to_string_pretty(&results).map_err(|e| anyhow!("{e}"))
+    }
+}
+
+#[pymodule]
+pub fn regorus(_py: Python<'_>, m: &PyModule) -> PyResult<()> {
+    m.add_class::<crate::Engine>()
+}

bindings/python/test.py

@@ -0,0 +1,52 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+
+import regorus
+
+# Create engine
+engine = regorus.Engine()
+
+# Load policies
+engine.add_policy_from_file('../../tests/aci/framework.rego')
+engine.add_policy_from_file('../../tests/aci/api.rego')
+engine.add_policy_from_file('../../tests/aci/policy.rego')
+
+# Add policy data
+data = {
+  "metadata": {
+    "devices": {
+      "/run/layers/p0-layer0": "1b80f120dbd88e4355d6241b519c3e25290215c469516b49dece9cf07175a766",
+      "/run/layers/p0-layer1": "e769d7487cc314d3ee748a4440805317c19262c7acd2fdbdb0d47d2e4613a15c",
+      "/run/layers/p0-layer2": "eb36921e1f82af46dfe248ef8f1b3afb6a5230a64181d960d10237a08cd73c79",
+      "/run/layers/p0-layer3": "41d64cdeb347bf236b4c13b7403b633ff11f1cf94dbc7cf881a44d6da88c5156",
+      "/run/layers/p0-layer4": "4dedae42847c704da891a28c25d32201a1ae440bce2aecccfa8e6f03b97a6a6c",
+      "/run/layers/p0-layer5": "fe84c9d5bfddd07a2624d00333cf13c1a9c941f3a261f13ead44fc6a93bc0e7a"
+    }
+  }
+}
+engine.add_data(data)
+
+# Set input
+input = {
+  "containerID": "container0",
+  "layerPaths": [
+    "/run/layers/p0-layer0",
+    "/run/layers/p0-layer1",
+    "/run/layers/p0-layer2",
+    "/run/layers/p0-layer3",
+    "/run/layers/p0-layer4",
+    "/run/layers/p0-layer5"
+  ],
+  "target": "/run/gcs/c/container0/rootfs"
+}
+engine.set_input(input)
+
+# Eval query
+results = engine.eval_query('data.framework.mount_overlay=x')
+
+# Print results
+print(results['result'][0])
+
+# Eval query as json
+results_json = engine.eval_query_as_json('data.framework.mount_overlay=x')
+print(results_json)

bindings/ruby/.gitignore

@@ -0,0 +1,14 @@
+/.bundle/
+/.yardoc
+/_yardoc/
+/coverage/
+/doc/
+/pkg/
+/spec/reports/
+/tmp/
+*.bundle
+*.so
+*.o
+*.a
+mkmf.log
+target/

bindings/ruby/.rubocop.yml

@@ -0,0 +1,29 @@
+require:
+  - rubocop-minitest
+  - rubocop-rake
+
+AllCops:
+  TargetRubyVersion: 3.0
+  NewCops: enable
+
+Layout/LineLength:
+  Max: 180
+
+Lint/EmptyClass:
+  Enabled: false
+
+Metrics/ClassLength:
+  Exclude:
+    - 'test/**/*.rb'
+
+Metrics/MethodLength:
+  Enabled: false
+
+Style/StringLiterals:
+  EnforcedStyle: double_quotes
+
+Style/StringLiteralsInInterpolation:
+  EnforcedStyle: double_quotes
+
+Style/WordArray:
+  Enabled: false

bindings/ruby/.tool-versions

@@ -0,0 +1 @@
+ruby 3.3.0

bindings/ruby/CHANGELOG.md

@@ -0,0 +1,5 @@
+## [Unreleased]
+
+## [0.1.0] - 2024-03-29
+
+- Initial release

bindings/ruby/Cargo.toml

@@ -0,0 +1,3 @@
+[workspace]
+members = ["ext/regorusrb"]
+resolver = "2"

bindings/ruby/Gemfile

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+source "https://rubygems.org"
+
+# Specify your gem's dependencies in regorusrb.gemspec
+gemspec
+
+# These gems are required for local development and testing,
+# but won't be included in the published gem
+gem "minitest", "~> 5.16"
+gem "rake", "~> 13.0"
+gem "rake-compiler"
+gem "rake-compiler-dock"
+gem "rubocop", "~> 1.62", require: false
+gem "rubocop-minitest", require: false
+gem "rubocop-rake", require: false

bindings/ruby/Gemfile.lock

@@ -0,0 +1,63 @@
+PATH
+  remote: .
+  specs:
+    regorusrb (0.1.0)
+      rb_sys (~> 0.9.91)
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    ast (2.4.2)
+    json (2.7.2)
+    language_server-protocol (3.17.0.3)
+    minitest (5.22.3)
+    parallel (1.24.0)
+    parser (3.3.0.5)
+      ast (~> 2.4.1)
+      racc
+    racc (1.7.3)
+    rainbow (3.1.1)
+    rake (13.2.1)
+    rake-compiler (1.2.7)
+      rake
+    rake-compiler-dock (1.4.0)
+    rb_sys (0.9.91)
+    regexp_parser (2.9.0)
+    rexml (3.2.6)
+    rubocop (1.63.0)
+      json (~> 2.3)
+      language_server-protocol (>= 3.17.0)
+      parallel (~> 1.10)
+      parser (>= 3.3.0.2)
+      rainbow (>= 2.2.2, < 4.0)
+      regexp_parser (>= 1.8, < 3.0)
+      rexml (>= 3.2.5, < 4.0)
+      rubocop-ast (>= 1.31.1, < 2.0)
+      ruby-progressbar (~> 1.7)
+      unicode-display_width (>= 2.4.0, < 3.0)
+    rubocop-ast (1.31.2)
+      parser (>= 3.3.0.4)
+    rubocop-minitest (0.35.0)
+      rubocop (>= 1.61, < 2.0)
+      rubocop-ast (>= 1.31.1, < 2.0)
+    rubocop-rake (0.6.0)
+      rubocop (~> 1.0)
+    ruby-progressbar (1.13.0)
+    unicode-display_width (2.5.0)
+
+PLATFORMS
+  ruby
+  x86_64-linux
+
+DEPENDENCIES
+  minitest (~> 5.16)
+  rake (~> 13.0)
+  rake-compiler
+  rake-compiler-dock
+  regorusrb!
+  rubocop (~> 1.62)
+  rubocop-minitest
+  rubocop-rake
+
+BUNDLED WITH
+   2.5.7

bindings/ruby/LICENSE.txt

@@ -0,0 +1,21 @@
+    MIT License
+
+    Copyright (c) Microsoft Corporation.
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE

bindings/ruby/README.md

@@ -0,0 +1,99 @@
+# Regorusrb
+
+**Regorus** is
+
+  - *Rego*-*Rus(t)*  - A fast, light-weight [Rego](https://www.openpolicyagent.org/docs/latest/policy-language/)
+   interpreter written in Rust.
+  - *Rigorous* - A rigorous enforcer of well-defined Rego semantics.
+
+## Installation
+
+Regorus can be used in Ruby by configuring bundler to build from the remote git source.
+
+If using [Bundler](https://bundler.io/) to manage gems (recommended), edit your gemfile to include the following
+`
+gem "regorusrb", git: "https://github.com/microsoft/regorus/", glob: "bindings/ruby/*.gemspec"
+`
+
+or manually install checkout the source and build the gem
+
+`
+git clone https://github.com/microsoft/regorus/
+cd regorus/bindings/ruby
+rake && rake build # should eventually output 'regorusrb 0.1.0 built to pkg/regorusrb-0.1.0.gem.'
+gem install --local ./pkg/regorusrb-0.1.0.gem
+`
+
+It is not yet available in rubygems.
+
+See [Repository](https://github.com/microsoft/regorus).
+
+To build this gem locally without bundler,
+
+`rake build`
+
+then to install the gem and build the native extensions
+
+`gem install --local ./pkg/regorusrb-0.1.0.gem`
+
+## Usage
+
+```ruby
+require "regorus"
+
+engine = Regorus::Engine.new
+
+engine.add_policy_from_file('../../tests/aci/framework.rego')
+engine.add_policy_from_file('../../tests/aci/api.rego')
+engine.add_policy_from_file('../../tests/aci/policy.rego')
+
+
+# can be strings or symbols
+data = {
+  metadata: {
+    devices: {
+      "/run/layers/p0-layer0": "1b80f120dbd88e4355d6241b519c3e25290215c469516b49dece9cf07175a766",
+      "/run/layers/p0-layer1": "e769d7487cc314d3ee748a4440805317c19262c7acd2fdbdb0d47d2e4613a15c",
+      "/run/layers/p0-layer2": "eb36921e1f82af46dfe248ef8f1b3afb6a5230a64181d960d10237a08cd73c79",
+      "/run/layers/p0-layer3": "41d64cdeb347bf236b4c13b7403b633ff11f1cf94dbc7cf881a44d6da88c5156",
+      "/run/layers/p0-layer4": "4dedae42847c704da891a28c25d32201a1ae440bce2aecccfa8e6f03b97a6a6c",
+      "/run/layers/p0-layer5": "fe84c9d5bfddd07a2624d00333cf13c1a9c941f3a261f13ead44fc6a93bc0e7a"
+    }
+  }
+}
+
+engine.add_data(data)
+input = {
+  "containerID": "container0",
+  "layerPaths": [
+    "/run/layers/p0-layer0",
+    "/run/layers/p0-layer1",
+    "/run/layers/p0-layer2",
+    "/run/layers/p0-layer3",
+    "/run/layers/p0-layer4",
+    "/run/layers/p0-layer5"
+  ],
+  "target": "/run/gcs/c/container0/rootfs"
+}
+
+engine.set_input(input)
+
+# Evaluate a specife rule
+rule_results = engine.eval_rule('data.framework.mount_overlay')
+puts rule_results # { "allowed" => true, "metadata" => [...]}
+
+# Or evalute a full policy document
+query_results = engine.eval_query('data.framework')
+puts query_results[:result][0]
+
+# Query results can can also be returned as JSON strings instead of Ruby Hash structure
+results_json = engine.eval_query_as_json('data.framework.mount_overlay=x')
+puts results_json
+```
+
+## Development
+
+After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake test` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
+
+To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and the created tag, and push the `.gem` file to [rubygems.org](https://rubygems.org).
+

bindings/ruby/Rakefile

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+require "bundler/gem_tasks"
+require "minitest/test_task"
+require "rake/extensiontask"
+require "rubocop/rake_task"
+require "rb_sys/extensiontask"
+
+Minitest::TestTask.create
+
+RuboCop::RakeTask.new
+
+desc "build the .gem file, including native extensions, according to the .gemspec"
+task build: :compile
+
+GEMSPEC = Gem::Specification.load("regorusrb.gemspec")
+
+RbSys::ExtensionTask.new("regorusrb", GEMSPEC) do |ext|
+  ext.lib_dir = "lib/regorus"
+  ext.cross_compile = true
+  ext.cross_platform = %w[x86-mingw32 x64-mingw-ucrt x64-mingw32 x86-linux x86_64-linux x86_64-darwin arm64-darwin]
+end
+
+task default: %i[compile test rubocop]
+
+desc "Build native extension for a given platform (i.e. rake 'native[x86_64-linux]')"
+task :native, [:platform] do |_t, platform:|
+  sh "bundle", "exec", "rb-sys-dock", "--platform", platform, "--build"
+end

bindings/ruby/bin/console

@@ -0,0 +1,11 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require "bundler/setup"
+require "regorus"
+
+# You can add fixtures and/or initialization code here to make experimenting
+# with your gem easier. You can also use a different console, if you like.
+
+require "irb"
+IRB.start(__FILE__)

bindings/ruby/bin/setup

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -euo pipefail
+IFS=$'\n\t'
+set -vx
+
+bundle install
+
+# Do any other automated setup that you need to do here

bindings/ruby/ext/regorusrb/Cargo.toml

@@ -0,0 +1,16 @@
+[package]
+name = "regorusrb"
+version = "0.1.0"
+edition = "2021"
+description = "Ruby bindings for Regorus - a fast, lightweight Rego interpreter written in Rust"
+publish = false
+
+[lib]
+crate-type = ["cdylib"]
+path = "src/lib.rs"
+
+[dependencies]
+magnus = { version = "0.6.3" }
+regorus = { git = "https://github.com/microsoft/regorus" }
+serde_json = "1.0.115"
+serde_magnus = "0.8.1"

bindings/ruby/ext/regorusrb/extconf.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+require "mkmf"
+require "rb_sys/mkmf"
+
+create_rust_makefile("regorus/regorusrb") do |r|
+  r.auto_install_rust_toolchain = true
+end

bindings/ruby/ext/regorusrb/src/lib.rs

@@ -0,0 +1,241 @@
+use magnus::{exception::runtime_error, method, module, prelude::*, Error, Ruby};
+use regorus::Engine as RegorusEngine;
+use std::cell::RefCell;
+use std::cmp::Ordering;
+
+// `Value` exists under magnus, regorus, and serde_json, so be explicit
+
+#[derive(Default)]
+#[magnus::wrap(class = "Regorus::Engine")]
+pub struct Engine {
+    engine: RefCell<RegorusEngine>,
+}
+
+impl Clone for Engine {
+    fn clone(&self) -> Self {
+        Self {
+            engine: self.engine.clone(),
+        }
+    }
+}
+
+impl Engine {
+    fn initialize(&self) {
+        let engine = RegorusEngine::new();
+        *self.engine.borrow_mut() = engine;
+    }
+
+    fn compare(&self, other: &Self) -> Result<i32, Error> {
+        let self_ptr: *const _ = &*self.engine.borrow();
+        let other_ptr: *const _ = &*other.engine.borrow();
+        match self_ptr.partial_cmp(&other_ptr) {
+            Some(Ordering::Less) => Ok(-1),
+            Some(Ordering::Equal) => Ok(0),
+            Some(Ordering::Greater) => Ok(1),
+            None => Err(Error::new(runtime_error(), "Comparison failed")),
+        }
+    }
+
+    fn add_policy(&self, path: String, rego: String) -> Result<(), Error> {
+        self.engine
+            .borrow_mut()
+            .add_policy(path, rego)
+            .map_err(|e| Error::new(runtime_error(), format!("Failed to add policy: {}", e)))
+    }
+
+    fn add_policy_from_file(&self, path: String) -> Result<(), Error> {
+        self.engine
+            .borrow_mut()
+            .add_policy_from_file(path)
+            .map_err(|e| Error::new(runtime_error(), format!("Failed to add policy: {}", e)))
+    }
+
+    fn add_data(&self, ruby_hash: magnus::RHash) -> Result<(), Error> {
+        let data_value: regorus::Value = serde_magnus::deserialize(ruby_hash).map_err(|e| {
+            Error::new(
+                runtime_error(),
+                format!("Failed to deserialize Ruby value: {}", e),
+            )
+        })?;
+
+        self.engine
+            .borrow_mut()
+            .add_data(data_value)
+            .map_err(|e| Error::new(runtime_error(), format!("Failed to add data: {}", e)))
+    }
+
+    fn add_data_json(&self, json_string: String) -> Result<(), Error> {
+        self.engine
+            .borrow_mut()
+            .add_data_json(&json_string)
+            .map_err(|e| Error::new(runtime_error(), format!("Failed to add data json: {}", e)))
+    }
+
+    fn add_data_from_json_file(&self, path: String) -> Result<(), Error> {
+        let json_data = regorus::Value::from_json_file(&path).map_err(|e| {
+            Error::new(
+                runtime_error(),
+                format!("Failed to parse JSON data file: {}", e),
+            )
+        })?;
+
+        self.engine.borrow_mut().add_data(json_data).map_err(|e| {
+            Error::new(
+                runtime_error(),
+                format!("Failed to add data from file: {}", e),
+            )
+        })
+    }
+
+    fn clear_data(&self) -> Result<(), Error> {
+        self.engine.borrow_mut().clear_data();
+        Ok(())
+    }
+
+    fn set_input(&self, ruby_hash: magnus::RHash) -> Result<(), Error> {
+        let input_value: regorus::Value = serde_magnus::deserialize(ruby_hash).map_err(|e| {
+            Error::new(
+                runtime_error(),
+                format!("Failed to deserialize Ruby value: {}", e),
+            )
+        })?;
+
+        self.engine.borrow_mut().set_input(input_value);
+        Ok(())
+    }
+
+    fn set_input_json(&self, json_string: String) -> Result<(), Error> {
+        self.engine
+            .borrow_mut()
+            .set_input_json(&json_string)
+            .map_err(|e| Error::new(runtime_error(), format!("Failed to set input JSON: {}", e)))
+    }
+
+    fn add_input_from_json_file(&self, path: String) -> Result<(), Error> {
+        let json_data = regorus::Value::from_json_file(&path).map_err(|e| {
+            Error::new(
+                runtime_error(),
+                format!("Failed to parse JSON input file: {}", e),
+            )
+        })?;
+
+        self.engine.borrow_mut().set_input(json_data);
+        Ok(())
+    }
+
+    fn eval_query(&self, query: String) -> Result<magnus::Value, Error> {
+        let results = self
+            .engine
+            .borrow_mut()
+            .eval_query(query, false)
+            .map_err(|e| Error::new(runtime_error(), format!("Failed to evaluate query: {}", e)))?;
+
+        serde_magnus::serialize(&results).map_err(|e| {
+            Error::new(
+                runtime_error(),
+                format!("Failed to serailzie query results: {}", e),
+            )
+        })
+    }
+
+    fn eval_query_as_json(&self, query: String) -> Result<String, Error> {
+        let results = self
+            .engine
+            .borrow_mut()
+            .eval_query(query, false)
+            .map_err(|e| {
+                Error::new(
+                    runtime_error(),
+                    format!("Failed to evaluate query as json: {}", e),
+                )
+            })?;
+
+        serde_json::to_string(&results).map_err(|e| {
+            Error::new(
+                runtime_error(),
+                format!("Failed to serialize query results: {}", e),
+            )
+        })
+    }
+
+    fn eval_rule(&self, query: String) -> Result<Option<magnus::Value>, Error> {
+        let result =
+            self.engine.borrow_mut().eval_rule(query).map_err(|e| {
+                Error::new(runtime_error(), format!("Failed to evaluate rule: {}", e))
+            })?;
+
+        match result {
+            regorus::Value::Undefined => Ok(None), // Convert undefined to Ruby's nil
+            _ => serde_magnus::serialize(&result) // Serialize other results normally
+                .map(Some)
+                .map_err(|e| {
+                    magnus::Error::new(
+                        runtime_error(),
+                        format!("Failed to serialize the rule evaluation result: {}", e),
+                    )
+                }),
+        }
+    }
+
+    fn eval_bool_query(&self, query: String) -> Result<bool, Error> {
+        self.engine
+            .borrow_mut()
+            .eval_bool_query(query, false)
+            .map_err(|e| Error::new(runtime_error(), format!("Failed to evaluate query: {}", e)))
+    }
+
+    fn eval_allow_query(&self, query: String) -> Result<bool, Error> {
+        Ok(self.engine.borrow_mut().eval_allow_query(query, false))
+    }
+
+    fn eval_deny_query(&self, query: String) -> Result<bool, Error> {
+        Ok(self.engine.borrow_mut().eval_deny_query(query, false))
+    }
+}
+
+#[magnus::init]
+fn init(ruby: &Ruby) -> Result<(), Error> {
+    let regorus_module = ruby.define_module("Regorus")?;
+    let engine_class = regorus_module.define_class("Engine", ruby.class_object())?;
+
+    // ruby object methods
+    engine_class.define_alloc_func::<Engine>();
+    engine_class.define_method("initialize", method!(Engine::initialize, 0))?;
+    engine_class.define_method("clone", method!(Engine::clone, 0))?;
+    engine_class.define_method("<=>", method!(Engine::compare, 1))?;
+    // defines <, <=, >, >=, and == based on <=>
+    engine_class.include_module(module::comparable())?;
+
+    // policy operations
+    engine_class.define_method("add_policy", method!(Engine::add_policy, 2))?;
+    engine_class.define_method(
+        "add_policy_from_file",
+        method!(Engine::add_policy_from_file, 1),
+    )?;
+
+    // data operations
+    engine_class.define_method("add_data", method!(Engine::add_data, 1))?;
+    engine_class.define_method("add_data_json", method!(Engine::add_data_json, 1))?;
+    engine_class.define_method(
+        "add_data_from_json_file",
+        method!(Engine::add_data_from_json_file, 1),
+    )?;
+    engine_class.define_method("clear_data", method!(Engine::clear_data, 0))?;
+
+    // input operations
+    engine_class.define_method("set_input", method!(Engine::set_input, 1))?;
+    engine_class.define_method("set_input_json", method!(Engine::set_input_json, 1))?;
+    engine_class.define_method(
+        "add_input_from_json_file",
+        method!(Engine::add_input_from_json_file, 1),
+    )?;
+
+    // query operations
+    engine_class.define_method("eval_query", method!(Engine::eval_query, 1))?;
+    engine_class.define_method("eval_query_as_json", method!(Engine::eval_query_as_json, 1))?;
+    engine_class.define_method("eval_rule", method!(Engine::eval_rule, 1))?;
+    engine_class.define_method("eval_bool_query", method!(Engine::eval_bool_query, 1))?;
+    engine_class.define_method("eval_allow_query", method!(Engine::eval_allow_query, 1))?;
+    engine_class.define_method("eval_deny_query", method!(Engine::eval_deny_query, 1))?;
+    Ok(())
+}

bindings/ruby/lib/regorus.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+require_relative "regorus/version"
+require_relative "regorus/regorusrb"
+
+module Regorus
+  class Engine; end
+end

bindings/ruby/lib/regorus/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module Regorus
+  VERSION = "0.1.0"
+end

bindings/ruby/regorusrb.gemspec

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+require_relative "lib/regorus/version"
+
+Gem::Specification.new do |spec|
+  spec.name = "regorusrb"
+  spec.version = Regorus::VERSION
+  spec.authors = ["David Marshall"]
+
+  spec.summary = "Ruby bindings for Regorus - a fast, lightweight Rego interpreter written in Rust"
+  spec.homepage = "https://github.com/microsoft/regorus/blob/main/bindings/ruby"
+  spec.license = "MIT"
+  spec.required_ruby_version = ">= 3.0.0"
+  spec.required_rubygems_version = ">= 3.3.11"
+
+  spec.metadata["allowed_push_host"] = "TODO: Set to your gem server 'https://example.com'"
+
+  spec.metadata["homepage_uri"] = spec.homepage
+  spec.metadata["source_code_uri"] = spec.homepage
+  spec.metadata["changelog_uri"] = "#{spec.homepage}/blob/main/bindings/ruby/CHANGELOG.md"
+  spec.metadata["rubygems_mfa_required"] = "true"
+
+  spec.files = Dir["lib/*.rb", "lib/regorus/*.rb", "ext/**/*.{rs,rb,lock,toml}", "Cargo.{lock,toml}", "LICENSE.txt", "README.md"]
+
+  spec.bindir = "exe"
+  spec.executables = spec.files.grep(%r{\Aexe/}) { |f| File.basename(f) }
+  spec.require_paths = ["lib"]
+  spec.extensions = ["ext/regorusrb/extconf.rb"]
+  spec.add_dependency "rb_sys", "~> 0.9.91"
+end

bindings/ruby/sig/regorusrb.rbs

@@ -0,0 +1,4 @@
+module Regorus
+  VERSION: String
+  # See the writing guide of rbs: https://github.com/ruby/rbs#guides
+end

bindings/ruby/test/test_helper.rb

@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+$LOAD_PATH.unshift File.expand_path("../lib", __dir__)
+require "regorus"
+
+require "minitest/autorun"

bindings/ruby/test/test_regorus.rb

@@ -0,0 +1,204 @@
+# frozen_string_literal: true
+
+require "test_helper"
+require "json"
+
+class TestRegorus < Minitest::Test
+  ALICE = "Alice"
+  BOB = "Bob"
+  CARLOS = "Carlos"
+
+  def setup
+    @engine = ::Regorus::Engine.new
+    @engine.add_policy("regorus_test.rego", example_policy)
+    @engine.add_data(example_data)
+  end
+
+  def example_policy
+    <<~REGO
+      package regorus_test
+      is_manager {
+        input.name == data.managers[_]
+      }
+
+      is_employee {
+        input.name == data.employees[_]
+      }
+
+      # Set a default value for to return false instead of nil
+      default is_manager_bool = false
+      default is_employee_bool = false
+
+      is_manager_bool {
+        is_manager
+      }
+
+      is_employee_bool {
+        is_employee
+      }
+    REGO
+  end
+
+  def example_data
+    {
+      "managers" => [ALICE],
+      "employees" => [ALICE, BOB]
+    }
+  end
+
+  def input_for(name)
+    { "name" => name }
+  end
+
+  def test_version_number_presence
+    refute_nil ::Regorus::VERSION
+  end
+
+  def test_engine_creation
+    assert_instance_of ::Regorus::Engine, ::Regorus::Engine.new
+  end
+
+  def test_policy_addition
+    assert_silent { @engine.add_policy("example.rego", example_policy) }
+  end
+
+  def test_object_creation_with_new
+    refute_same ::Regorus::Engine.new, ::Regorus::Engine.new
+  end
+
+  def test_data_addition
+    assert_silent { @engine.add_data(example_data) }
+  end
+
+  def test_data_addition_as_json
+    assert_silent { @engine.add_data_json(example_data.to_json) }
+  end
+
+  def test_query_evaluation_for_alice
+    @engine.set_input(input_for(ALICE))
+
+    assert_equal alice_results, @engine.eval_query("data.regorus_test")
+  end
+
+  def test_query_evaluation_for_bob
+    @engine.set_input(input_for(BOB))
+
+    assert_equal bob_results, @engine.eval_query("data.regorus_test")
+  end
+
+  def test_query_evaluation_as_json
+    @engine.set_input(input_for(ALICE))
+
+    assert_equal alice_results.to_json, @engine.eval_query_as_json("data.regorus_test")
+  end
+
+  def test_rule_evaluation_for_alice
+    @engine.set_input(input_for(ALICE))
+
+    assert @engine.eval_rule("data.regorus_test.is_employee")
+    assert @engine.eval_rule("data.regorus_test.is_employee_bool")
+    assert @engine.eval_rule("data.regorus_test.is_manager")
+    assert @engine.eval_rule("data.regorus_test.is_manager_bool")
+  end
+
+  def test_rule_evaluation_for_bob
+    @engine.set_input(input_for(BOB))
+
+    assert @engine.eval_rule("data.regorus_test.is_employee")
+    assert @engine.eval_rule("data.regorus_test.is_employee_bool")
+    assert_nil @engine.eval_rule("data.regorus_test.is_manager")
+    refute @engine.eval_rule("data.regorus_test.is_manager_bool")
+  end
+
+  def test_rule_evaluation_for_carlos
+    @engine.set_input(input_for(CARLOS))
+
+    assert_nil @engine.eval_rule("data.regorus_test.is_employee")
+    refute @engine.eval_rule("data.regorus_test.is_employee_bool")
+    assert_nil @engine.eval_rule("data.regorus_test.is_manager")
+    refute @engine.eval_rule("data.regorus_test.is_manager_bool")
+  end
+
+  def test_eval_bool_query
+    assert @engine.eval_bool_query("1 < 2")
+    refute @engine.eval_bool_query("1 > 2")
+    assert_raises(RuntimeError) { @engine.eval_bool_query("1 + 1") }
+    assert_raises(RuntimeError) { @engine.eval_bool_query("true; true") }
+    assert_raises(RuntimeError) { @engine.eval_bool_query("true; false; true") }
+  end
+
+  def test_eval_allow_query
+    assert @engine.eval_allow_query("1 < 2")
+    refute @engine.eval_allow_query("1 > 2")
+    refute @engine.eval_allow_query("1 + 1")
+    refute @engine.eval_allow_query("true; true")
+    refute @engine.eval_allow_query("true; false; true")
+  end
+
+  def test_eval_deny_query
+    assert @engine.eval_deny_query("1 < 2")
+    refute @engine.eval_deny_query("1 > 2")
+    assert @engine.eval_deny_query("1 + 1")
+    assert @engine.eval_deny_query("true; true")
+    assert @engine.eval_deny_query("true; false; true")
+  end
+
+  def test_missing_rules_handling
+    @engine.set_input(input_for(ALICE))
+    assert_raises(RuntimeError) { @engine.eval_rule("data.regorus_test.not_a_rule") }
+  end
+
+  def test_engine_cloning
+    cloned_engine = @engine.clone
+
+    assert_instance_of ::Regorus::Engine, cloned_engine
+    refute_same @engine, cloned_engine
+  end
+
+  def alice_results
+    {
+      result: [
+        {
+          expressions: [
+            {
+              value: {
+                "is_employee" => true,
+                "is_employee_bool" => true,
+                "is_manager" => true,
+                "is_manager_bool" => true
+              },
+              text: "data.regorus_test",
+              location: {
+                row: 1,
+                col: 1
+              }
+            }
+          ]
+        }
+      ]
+    }
+  end
+
+  def bob_results
+    {
+      result: [
+        {
+          expressions: [
+            {
+              value: {
+                "is_employee" => true,
+                "is_employee_bool" => true,
+                "is_manager_bool" => false
+              },
+              text: "data.regorus_test",
+              location: {
+                row: 1,
+                col: 1
+              }
+            }
+          ]
+        }
+      ]
+    }
+  end
+end

bindings/wasm/CHANGELOG.md

@@ -0,0 +1,14 @@
+# Changelog
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/microsoft/regorus/releases/tag/regorusjs-v0.1.0) - 2024-02-01
+
+### Other
+- Document bindings ([#119](https://github.com/microsoft/regorus/pull/119))
+- Python bindings ([#115](https://github.com/microsoft/regorus/pull/115))
+- WASM binding ([#114](https://github.com/microsoft/regorus/pull/114))

bindings/wasm/Cargo.toml

@@ -0,0 +1,19 @@
+[package]
+name = "regorusjs"
+version = "0.1.0"
+edition = "2021"
+repository = "https://github.com/microsoft/regorus/bindings/wasm"
+description = "WASM bindings for Regorus - a fast, lightweight Rego interpreter written in Rust"
+keywords = ["interpreter", "opa", "policy-as-code", "rego"]
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+[lib]
+crate-type = ["cdylib"]
+
+[dependencies]
+regorus = { path  = "../.." }
+serde_json = "1.0.111"
+wasm-bindgen = "0.2.90"
+
+[dev-dependencies]
+wasm-bindgen-test = "0.3.40"

bindings/wasm/README.md

@@ -0,0 +1,81 @@
+# regorusjs
+
+**Regorus** is
+
+  - *Rego*-*Rus(t)*  - A fast, light-weight [Rego](https://www.openpolicyagent.org/docs/latest/policy-language/)
+   interpreter written in Rust.
+  - *Rigorous* - A rigorous enforcer of well-defined Rego semantics.
+
+`regorusjs` is Regorus compiled into WASM.
+
+See [Repository](https://github.com/microsoft/regorus).
+
+To build this binding, see [building](https://github.com/microsoft/regorus/bindings/wasm/building.md)
+
+
+
+## Usage
+
+```javascript
+
+var regorus = require('regorusjs')
+
+// Create an engine.
+var engine = new regorus.Engine();
+
+// Add Rego policy.
+engine.add_policy(
+    // Associate this file name with policy
+    'hello.rego',
+    
+    // Rego policy
+`
+  package test
+  
+  # Join messages
+  message = concat(", ", [input.message, data.message])
+`)
+
+// Set policy data
+engine.add_data_json(`
+ {
+    "message" : "World!"
+ }
+`)
+
+// Set policy input
+engine.set_input_json(`
+ {
+	"message" : "Hello"
+ }
+`)
+
+// Eval query
+results = engine.eval_query('data.test.message')
+
+// Display
+console.log(results)
+// {
+//   "result": [
+//     {
+//       "expressions": [
+//         {
+//           "value": "Hello, World!",
+//           "text": "data.test.message",
+//           "location": {
+//             "row": 1,
+//             "col": 1
+//           }
+//         }
+//       ]
+//     }
+//   ]
+// }
+
+// Convert results to object
+results = JSON.parse(results)
+
+// Process result
+console.log(results.result[0].expressions[0].value)
+// Hello, World!
+```

bindings/wasm/building.md

@@ -0,0 +1,34 @@
+
+- Install `wasm-pack`
+  ```
+  cargo install wasm-pack
+  ```
+
+- Build `regorusjs` for nodejs.
+  ```
+  cd bindings/wasm
+  wasm-pack build --target nodejs --release
+  ```
+
+- Install [nodejs](https://nodejs.org/en/download)
+
+- Run the test script
+  ```
+  $ node test.js
+  \\{
+  \\  "result": [
+  \\    {
+  \\      "expressions": [
+  \\        {
+  \\          "value": "Hello, World!",
+  \\          "text": "data.test.message",
+  \\          "location": {
+  \\            "row": 1,
+  \\            "col": 1
+  \\          }
+  \\        }
+  \\      ]
+  \\    }
+  \\   ]
+  \\}
+  ```

bindings/wasm/src/lib.rs

@@ -0,0 +1,146 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+use wasm_bindgen::prelude::*;
+
+#[wasm_bindgen]
+/// WASM wrapper for [`regorus::Engine`]
+pub struct Engine {
+    engine: regorus::Engine,
+}
+
+fn error_to_jsvalue<E: std::fmt::Display>(e: E) -> JsValue {
+    JsValue::from_str(&format!("{e}"))
+}
+
+impl Default for Engine {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl Clone for Engine {
+    /// Clone a [`Engine`]
+    ///
+    /// To avoid having to parse same policy again, the engine can be cloned
+    /// after policies and data have been added.
+    fn clone(&self) -> Self {
+        Self {
+            engine: self.engine.clone(),
+        }
+    }
+}
+
+#[wasm_bindgen]
+impl Engine {
+    #[wasm_bindgen(constructor)]
+    /// Construct a new Engine
+    ///
+    /// See https://docs.rs/regorus/latest/regorus/struct.Engine.html
+    pub fn new() -> Self {
+        Self {
+            engine: regorus::Engine::new(),
+        }
+    }
+
+    /// Add a policy
+    ///
+    /// The policy is parsed into AST.
+    /// See https://docs.rs/regorus/latest/regorus/struct.Engine.html#method.add_policy
+    ///
+    /// * `path`: A filename to be associated with the policy.
+    /// * `rego`: Rego policy.
+    pub fn add_policy(&mut self, path: String, rego: String) -> Result<(), JsValue> {
+        self.engine.add_policy(path, rego).map_err(error_to_jsvalue)
+    }
+
+    /// Add policy data.
+    ///
+    /// See https://docs.rs/regorus/latest/regorus/struct.Engine.html#method.add_data
+    /// * `data`: JSON encoded value to be used as policy data.
+    pub fn add_data_json(&mut self, data: String) -> Result<(), JsValue> {
+        let data = regorus::Value::from_json_str(&data).map_err(error_to_jsvalue)?;
+        self.engine.add_data(data).map_err(error_to_jsvalue)
+    }
+
+    /// Clear policy data.
+    ///
+    /// See https://docs.rs/regorus/0.1.0-alpha.2/regorus/struct.Engine.html#method.clear_data
+    pub fn clear_data(&mut self) -> Result<(), JsValue> {
+        self.engine.clear_data();
+        Ok(())
+    }
+
+    /// Set input.
+    ///
+    /// See https://docs.rs/regorus/0.1.0-alpha.2/regorus/struct.Engine.html#method.set_input
+    /// * `input`: JSON encoded value to be used as input to query.
+    pub fn set_input_json(&mut self, input: String) -> Result<(), JsValue> {
+        let input = regorus::Value::from_json_str(&input).map_err(error_to_jsvalue)?;
+        self.engine.set_input(input);
+        Ok(())
+    }
+
+    /// Evaluate query.
+    ///
+    /// See https://docs.rs/regorus/0.1.0-alpha.2/regorus/struct.Engine.html#method.eval_query
+    /// * `query`: Rego expression to be evaluate.
+    pub fn eval_query(&mut self, query: String) -> Result<String, JsValue> {
+        let results = self
+            .engine
+            .eval_query(query, false)
+            .map_err(error_to_jsvalue)?;
+        serde_json::to_string_pretty(&results).map_err(error_to_jsvalue)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use wasm_bindgen::prelude::*;
+    use wasm_bindgen_test::wasm_bindgen_test;
+
+    #[wasm_bindgen_test]
+    pub fn basic() -> Result<(), JsValue> {
+        let mut engine = crate::Engine::new();
+
+        // Exercise all APIs.
+        engine.add_data_json(
+            r#"
+        {
+           "foo" : "bar"
+        }
+        "#
+            .to_string(),
+        )?;
+
+        engine.set_input_json(
+            r#"
+        {
+           "message" : "Hello"
+        }
+        "#
+            .to_string(),
+        )?;
+
+        engine.add_policy(
+            "hello.rego".to_string(),
+            r#"
+            package test
+            message = input.message"#
+                .to_string(),
+        )?;
+
+        let results = engine.eval_query("data".to_string())?;
+        let r = regorus::Value::from_json_str(&results).map_err(crate::error_to_jsvalue)?;
+
+        let v = &r["result"][0]["expressions"][0]["value"];
+
+        // Ensure that input and policy were evaluated.
+        assert_eq!(v["test"]["message"], regorus::Value::from("Hello"));
+
+        // Test that data was set.
+        assert_eq!(v["foo"], regorus::Value::from("bar"));
+
+        Ok(())
+    }
+}

bindings/wasm/test.js

@@ -0,0 +1,47 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+var regorus = require('./pkg/regorusjs')
+
+// Create an engine.
+var engine = new regorus.Engine();
+
+// Add Rego policy.
+engine.add_policy(
+    // Associate this file name with policy
+    'hello.rego',
+    
+    // Rego policy
+`
+  package test
+  
+  # Join messages
+  message = concat(", ", [input.message, data.message])
+`)
+
+// Set policy data
+engine.add_data_json(`
+ {
+    "message" : "World!"
+ }
+`)
+
+// Set policy input
+engine.set_input_json(`
+ {
+	"message" : "Hello"
+ }
+`)
+
+// Eval query
+results = engine.eval_query('data.test.message')
+
+// Display
+console.log(results)
+
+// Convert results to object
+results = JSON.parse(results)
+
+// Process result
+console.log(results.result[0].expressions[0].value)
+

build.rs

@@ -3,7 +3,6 @@
 
 use anyhow::Result;
 use std::path::Path;
-use std::process::Command;
 
 fn main() -> Result<()> {
     // Copy hooks to appropriate location so that git will run them.
@@ -14,12 +13,15 @@ fn main() -> Result<()> {
     }
 
     // Supply information as compile-time environment variables.
-    let output = Command::new("git")
-        .args(["rev-parse", "HEAD"])
-        .output()
-        .unwrap();
-    let git_hash = String::from_utf8(output.stdout).unwrap();
-    println!("cargo:rustc-env=GIT_HASH={}", git_hash);
+    #[cfg(feature = "opa-runtime")]
+    {
+        let output = std::process::Command::new("git")
+            .args(["rev-parse", "HEAD"])
+            .output()
+            .expect("`git rev-parse HEAD` failed.");
+        let git_hash = String::from_utf8(output.stdout).unwrap();
+        println!("cargo:rustc-env=GIT_HASH={}", git_hash);
+    }
 
     Ok(())
 }

docs/builtins.md

@@ -159,24 +159,25 @@ In future, each builtin will be associated with a feature (many builtins could b
   | [type_name](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-types-type_name)   | _       |
   
 - [Encoding](https://www.openpolicyagent.org/docs/latest/policy-reference/#encoding)
-  | Builtin                                                                                                                          | Feature     |
-  |----------------------------------------------------------------------------------------------------------------------------------|-------------|
-  | [base64.is_valid](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-base64is_valid)                 | `base64`    |
-  | [base64url.decode](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-base64urldecode)               | `base64`    |
-  | [base64url.encode](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-base64urlencode)               | `base64url` |
-  | [base64url.encode_no_pad](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-base64urlencode_no_pad) | `base64url` |
-  | [hex.decode](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-hexdecode)                           | `hex`       |
-  | [hex.encode](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-hexencode)                           | `hex`       |
-  | [json.is_valid](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-jsonis_valid)                     | _           |
-  | [json.marshal](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-jsonmarshal)                       | _           |
-  | [json.unmarshal](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-jsonunmarshal)                   | _           |
-  | [urlquery.decode](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-urlquerydecode)                 | `urlquery`  |
-  | [urlquery.decode_object](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-urlquerydecode_object)   | `urlquery`  |
-  | [urlquery.encode](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-urlqueryencode)                 | `urlquery`  |
-  | [urlquery.encode_object](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-urlqueryencode_object)   | `urlquery`  |
-  | [yaml.is_valid](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-yamlis_valid)                     | `yaml`      |
-  | [yaml.marshal](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-yamlmarshal)                       | `yaml`      |
-  | [yaml.unmarshal](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-yamlunmarshal)                   | `yaml`            |
+  | Builtin                                                                                                                              | Feature     |
+  |--------------------------------------------------------------------------------------------------------------------------------------|-------------|
+  | [base64.is_valid](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-base64is_valid)                     | `base64`    |
+  | [base64url.decode](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-base64urldecode)                   | `base64`    |
+  | [base64url.encode](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-base64urlencode)                   | `base64url` |
+  | [base64url.encode_no_pad](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-base64urlencode_no_pad)     | `base64url` |
+  | [hex.decode](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-hexdecode)                               | `hex`       |
+  | [hex.encode](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-hexencode)                               | `hex`       |
+  | [json.is_valid](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-jsonis_valid)                         | _           |
+  | [json.marshal](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-jsonmarshal)                           | _           |
+  | [json.marshal_with_options](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-jsonmarshal_with_options) | _           |
+  | [json.unmarshal](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-jsonunmarshal)                       | _           |
+  | [urlquery.decode](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-urlquerydecode)                     | `urlquery`  |
+  | [urlquery.decode_object](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-urlquerydecode_object)       | `urlquery`  |
+  | [urlquery.encode](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-urlqueryencode)                     | `urlquery`  |
+  | [urlquery.encode_object](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-urlqueryencode_object)       | `urlquery`  |
+  | [yaml.is_valid](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-yamlis_valid)                         | `yaml`      |
+  | [yaml.marshal](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-yamlmarshal)                           | `yaml`      |
+  | [yaml.unmarshal](https://www.openpolicyagent.org/docs/latest/policy-reference/#builtin-encoding-yamlunmarshal)                       | `yaml`      |
 
 - [Time](https://www.openpolicyagent.org/docs/latest/policy-reference/#time)
    | Builtin                                                                                                                    | Feature |

examples/regorus.rs

@@ -10,12 +10,16 @@ fn rego_eval(
     query: String,
     enable_tracing: bool,
     non_strict: bool,
+    #[cfg(feature = "coverage")] coverage: bool,
 ) -> Result<()> {
     // Create engine.
     let mut engine = regorus::Engine::new();
 
     engine.set_strict_builtin_errors(!non_strict);
 
+    #[cfg(feature = "coverage")]
+    engine.set_enable_coverage(coverage);
+
     // Load files from given bundles.
     for dir in bundles.iter() {
         let entries =
@@ -66,10 +70,24 @@ fn rego_eval(
         engine.set_input(input);
     }
 
-    // Evaluate query.
+    // Note: The `eval_query` function is used below since it produces output
+    // in the same format as OPA. It also allows evaluating arbitrary statements
+    // as queries.
+    //
+    // Most applications will want to use `eval_rule` instead.
+    // It is faster since it does not have to parse the query string.
+    // It also returns the value of the rule directly and thus is easier
+    // to use.
     let results = engine.eval_query(query, enable_tracing)?;
+
     println!("{}", serde_json::to_string_pretty(&results)?);
 
+    #[cfg(feature = "coverage")]
+    if coverage {
+        let report = engine.get_coverage_report()?;
+        println!("{}", report.to_colored_string()?);
+    }
+
     Ok(())
 }
 
@@ -137,9 +155,14 @@ enum RegorusCommand {
         #[arg(long, short)]
         trace: bool,
 
-        // Non strict execution
+        /// Perform non-strict evaluation. (default behavior of OPA).
         #[arg(long, short)]
         non_strict: bool,
+
+        /// Display coverage information
+        #[cfg(feature = "coverage")]
+        #[arg(long, short)]
+        coverage: bool,
     },
 
     /// Tokenize a Rego policy.
@@ -168,10 +191,6 @@ struct Cli {
 
 fn main() -> Result<()> {
     use clap::Parser;
-    env_logger::builder()
-        .format_level(false)
-        .format_timestamp(None)
-        .init();
 
     // Parse and dispatch command.
     let cli = Cli::parse();
@@ -183,7 +202,18 @@ fn main() -> Result<()> {
             query,
             trace,
             non_strict,
-        } => rego_eval(&bundles, &data, input, query, trace, non_strict),
+            #[cfg(feature = "coverage")]
+            coverage,
+        } => rego_eval(
+            &bundles,
+            &data,
+            input,
+            query,
+            trace,
+            non_strict,
+            #[cfg(feature = "coverage")]
+            coverage,
+        ),
         RegorusCommand::Lex { file, verbose } => rego_lex(file, verbose),
         RegorusCommand::Parse { file } => rego_parse(file),
     }

scripts/coverage

@@ -1,71 +0,0 @@
-#!/bin/bash
-# Copyright (c) Microsoft Corporation.
-# Licensed under the MIT License.
-
-set -e
-
-if ! command -v grcov > /dev/null; then
-  cargo install grcov
-fi
-
-if ! command -v llvm-profdata > /dev/null; then
-  rustup component add llvm-tools-preview
-fi
-
-#export LLVM_PROFILE_FILE='target/cargo-test-%p-%m.profraw'
-#export CARGO_INCREMENTAL=1
-#export RUSTFLAGS='-Cinstrument-coverage'
-
-echo "Building with instrumentation"
-cargo build --all-targets
-
-if [ "$1" == "--no-run" ]; then
-    exit 0
-fi
-
-# Remove existing coverage information.
-rm -f target/*.profraw
-rm -rf target/coverage
-mkdir -p target/coverage
-
-echo "Running tests"
-cargo test
-
-# Generate html
-grcov target/ --binary-path ./target/debug/deps -s src/ -t html \
---branch --ignore-not-existing --ignore '../*' --ignore "/*" -o target/coverage/html
-
-if [ "$1" == "--show" ]; then
-    echo "Opening report in browser"
-    xdg-open target/coverage/html/index.html 2>/dev/null
-    echo "Done"
-fi
-
-# Generate markdown
-grcov target/ --binary-path ./target/debug/deps -s src/ -t markdown \
---branch --ignore-not-existing --ignore '../*' --ignore "/*" -o target/coverage/markdown
-
-cat target/coverage/markdown
-
-# Print small-form table of files without 100% coverage.
-echo "Files without 100% coverage"
-while read p; do
-    file=$(echo "$p" | cut -f 2 -d '|')
-    percent=$(echo "$p" | cut -f 3 -d '|')
-    missing=$(echo "$p" | cut -f 5 -d '|')
-
-    if [ -z "$file" ]; then
-	break
-    fi
-
-    # Trim percentage using xargs.
-    case $(echo "$percent" | xargs) in
-	 "100%"|"100.00%")
-		continue
-    esac
-
-
-    echo "| $file | $percent |"
-done < target/coverage/markdown
-
-#TODO: Maybe use coveralls format (json) and query data to lockdown code coverage.

scripts/make-docs

@@ -1,15 +0,0 @@
-#!/bin/bash
-# Copyright (c) Microsoft Corporation.
-# Licensed under the MIT License.
-
-git stash
-cargo doc --no-deps
-git checkout docs
-rm -rf docs
-cp -r target/x86_64-unknown-linux-musl/doc ./docs
-echo "<meta http-equiv=\"refresh\" content=\"0; url=regorus/index.html\">" > docs/index.html
-git add docs
-git commit -s
-git push
-git checkout -
-git stash pop

scripts/pre-commit

@@ -6,7 +6,7 @@ set -eo pipefail
 
 if [ -f Cargo.toml ]; then
     # Ensure that all targets can be built.
-    cargo build --all-targets
+    cargo build -r --all-targets
 
     #Ensure that code is correctly formatted.
     cargo fmt --check || (echo "Run cargo fmt to fix formatting" && exit 1)

scripts/pre-push

@@ -9,12 +9,14 @@ if [ -f Cargo.toml ]; then
    dir=$(dirname "${BASH_SOURCE[0]}")
    "$dir/pre-commit"
 
+   # Ensure that the public API works
+   cargo test -r --doc
+   
    # Ensure that all tests pass
-   # Also generate coverage information.
-   if [[ "$OSTYPE" == "linux-gnu"* ]]; then
-       scripts/coverage
-   fi
+   cargo test -r
+   cargo test -r --test aci
+   cargo test -r --test kata
 
    # Ensure that OPA conformance tests don't regress.
-   cargo test -r --test opa -- $(tr '\n' ' ' < tests/opa.passing)
+   cargo test -r --features opa-testutil,serde_json/arbitrary_precision --test opa -- $(tr '\n' ' ' < tests/opa.passing)
 fi

scripts/yaml-test-eval

@@ -1,8 +0,0 @@
-#!/bin/bash
-# Copyright (c) Microsoft Corporation.
-# Licensed under the MIT License.
-
-set -e
-yaml=$(realpath -e $1)
-
-RUST_BACKTRACE=1 cargo test interpreter::one_yaml -- --include-ignored --nocapture "$yaml"

scripts/yaml-test-parse

@@ -1,8 +0,0 @@
-#!/bin/bash
-# Copyright (c) Microsoft Corporation.
-# Licensed under the MIT License.
-
-set -e
-yaml=$(realpath -e $1)
-
-RUST_BACKTRACE=1 cargo test parser::one_yaml -- --include-ignored --nocapture "$yaml"

src/ast.rs

@@ -2,6 +2,8 @@
 // Licensed under the MIT License.
 
 use crate::lexer::*;
+use crate::value::Value;
+use crate::Rc;
 
 use std::ops::Deref;
 
@@ -37,7 +39,7 @@ pub enum AssignOp {
 }
 
 pub struct NodeRef<T> {
-    r: std::rc::Rc<T>,
+    r: Rc<T>,
 }
 
 impl<T> Clone for NodeRef<T> {
@@ -54,7 +56,7 @@ impl<T: std::fmt::Debug> std::fmt::Debug for NodeRef<T> {
 
 impl<T> std::cmp::PartialEq for NodeRef<T> {
     fn eq(&self, other: &Self) -> bool {
-        std::rc::Rc::as_ptr(&self.r).eq(&std::rc::Rc::as_ptr(&other.r))
+        Rc::as_ptr(&self.r).eq(&Rc::as_ptr(&other.r))
     }
 }
 
@@ -62,7 +64,7 @@ impl<T> std::cmp::Eq for NodeRef<T> {}
 
 impl<T> std::cmp::Ord for NodeRef<T> {
     fn cmp(&self, other: &Self) -> std::cmp::Ordering {
-        std::rc::Rc::as_ptr(&self.r).cmp(&std::rc::Rc::as_ptr(&other.r))
+        Rc::as_ptr(&self.r).cmp(&Rc::as_ptr(&other.r))
     }
 }
 
@@ -88,9 +90,7 @@ impl<T> AsRef<T> for NodeRef<T> {
 
 impl<T> NodeRef<T> {
     pub fn new(t: T) -> Self {
-        Self {
-            r: std::rc::Rc::new(t),
-        }
+        Self { r: Rc::new(t) }
     }
 }
 
@@ -99,13 +99,13 @@ pub type Ref<T> = NodeRef<T>;
 #[derive(Debug)]
 pub enum Expr {
     // Simple items that only have a span as content.
-    String(Span),
-    RawString(Span),
-    Number(Span),
+    String((Span, Value)),
+    RawString((Span, Value)),
+    Number((Span, Value)),
     True(Span),
     False(Span),
     Null(Span),
-    Var(Span),
+    Var((Span, Value)),
 
     // array
     Array {
@@ -159,7 +159,7 @@ pub enum Expr {
     RefDot {
         span: Span,
         refr: Ref<Expr>,
-        field: Span,
+        field: (Span, Value),
     },
 
     RefBrack {
@@ -208,7 +208,8 @@ impl Expr {
     pub fn span(&self) -> &Span {
         use Expr::*;
         match self {
-            String(s) | RawString(s) | Number(s) | True(s) | False(s) | Null(s) | Var(s) => s,
+            String(s) | RawString(s) | Number(s) | Var(s) => &s.0,
+            True(s) | False(s) | Null(s) => s,
             Array { span, .. }
             | Set { span, .. }
             | Object { span, .. }
@@ -353,6 +354,7 @@ pub struct Module {
     pub package: Package,
     pub imports: Vec<Import>,
     pub policy: Vec<Ref<Rule>>,
+    pub rego_v1: bool,
 }
 
 pub type ExprRef = Ref<Expr>;

src/builtins/arrays.rs

@@ -5,12 +5,12 @@ use crate::ast::{Expr, Ref};
 use crate::builtins;
 use crate::builtins::utils::{ensure_args_count, ensure_array, ensure_numeric};
 use crate::lexer::Span;
-use crate::value::Value;
+use crate::Rc;
+use crate::Value;
 
 use std::collections::HashMap;
 
 use anyhow::Result;
-use std::rc::Rc;
 
 pub fn register(m: &mut HashMap<&'static str, builtins::BuiltinFcn>) {
     m.insert("array.concat", (concat, 2));

src/builtins/debugging.rs

@@ -17,10 +17,12 @@ pub fn register(m: &mut HashMap<&'static str, builtins::BuiltinFcn>) {
     m.insert("print", (print, MAX_ARGS));
 }
 
-// Symbol analyzer must ensure that vars used by print are defined before
-// the print statement. Scheduler must ensure the above constraint.
-// Additionally interpreter must allow undefined inputs to print.
-fn print(span: &Span, _params: &[Ref<Expr>], args: &[Value], _strict: bool) -> Result<Value> {
+pub fn print_to_string(
+    span: &Span,
+    _params: &[Ref<Expr>],
+    args: &[Value],
+    _strict: bool,
+) -> Result<String> {
     if args.len() > MAX_ARGS as usize {
         bail!(span.error("print supports up to 100 arguments"));
     }
@@ -34,8 +36,17 @@ fn print(span: &Span, _params: &[Ref<Expr>], args: &[Value], _strict: bool) -> R
         };
     }
 
+    Ok(msg)
+}
+
+// Symbol analyzer must ensure that vars used by print are defined before
+// the print statement. Scheduler must ensure the above constraint.
+// Additionally interpreter must allow undefined inputs to print.
+fn print(span: &Span, params: &[Ref<Expr>], args: &[Value], strict: bool) -> Result<Value> {
+    let msg = print_to_string(span, params, args, strict)?;
+
     if !msg.is_empty() {
-        println!("{}", &msg[1..]);
+        eprintln!("{}", &msg[1..]);
     }
     Ok(Value::Bool(true))
 }

src/builtins/encoding.rs

@@ -42,6 +42,7 @@ pub fn register(m: &mut HashMap<&'static str, builtins::BuiltinFcn>) {
     }
     m.insert("json.is_valid", (json_is_valid, 1));
     m.insert("json.marshal", (json_marshal, 1));
+    m.insert("json.marshal_with_options", (json_marshal_with_options, 2));
     m.insert("json.unmarshal", (json_unmarshal, 1));
 
     #[cfg(feature = "yaml")]
@@ -368,6 +369,74 @@ fn json_marshal(span: &Span, params: &[Ref<Expr>], args: &[Value], _strict: bool
     ))
 }
 
+fn json_marshal_with_options(
+    span: &Span,
+    params: &[Ref<Expr>],
+    args: &[Value],
+    _strict: bool,
+) -> Result<Value> {
+    let name = "json.marshal_with_options";
+    ensure_args_count(span, name, params, args, 2)?;
+
+    let options = ensure_object(name, &params[1], args[1].clone())?;
+    let (mut pretty, mut indent, mut prefix) = (true, Some("\t".to_owned()), None);
+    for (option, option_value) in options.iter() {
+        match option {
+            Value::String(s) if s.as_ref() == "pretty" && option_value.as_bool().is_ok() => {
+                pretty = option_value == &Value::Bool(true);
+            }
+            Value::String(s) if s.as_ref() == "pretty" => bail!(params[1]
+                .span()
+                .error("marshaling option `pretty` must be true or false")),
+            Value::String(s) if s.as_ref() == "prefix" && option_value.as_string().is_ok() => {
+                prefix = Some(option_value.as_string()?.as_ref().to_string());
+            }
+            Value::String(s) if s.as_ref() == "prefix" => bail!(params[1]
+                .span()
+                .error("marshaling option `pretty` must be string")),
+            Value::String(s) if s.as_ref() == "indent" && option_value.as_string().is_ok() => {
+                indent = Some(option_value.as_string()?.as_ref().to_string());
+            }
+            Value::String(s) if s.as_ref() == "indent" => bail!(params[1]
+                .span()
+                .error("marshaling option `pretty` must be string")),
+            _ => bail!(params[1]
+                .span()
+                .error("marshaling option must be one of `indent`, `prefix` or `pretty`")),
+        }
+    }
+
+    if !pretty || options.is_empty() {
+        return Ok(Value::String(
+            serde_json::to_string(&args[0])
+                .with_context(|| span.error("could not serialize to json"))?
+                .into(),
+        ));
+    }
+
+    let lines: Vec<String> = serde_json::to_string_pretty(&args[0])
+        .with_context(|| span.error("could not serialize to json"))?
+        .split('\n')
+        .map(|line| {
+            let mut line = line.to_string();
+
+            if let Some(indent) = &indent {
+                let start_trimmed = line.trim_start();
+                let leading_spaces = line.len() - start_trimmed.len();
+                let indentation_level = leading_spaces / 2;
+                line = indent.repeat(indentation_level) + start_trimmed;
+            }
+
+            if let Some(prefix) = &prefix {
+                line = prefix.to_owned() + &line;
+            }
+            line
+        })
+        .collect();
+
+    Ok(Value::from(lines.join("\n")))
+}
+
 fn json_unmarshal(
     span: &Span,
     params: &[Ref<Expr>],

src/builtins/jwt.rs

@@ -3,19 +3,64 @@
 
 use crate::ast::{Expr, Ref};
 use crate::builtins;
-use crate::builtins::utils::ensure_args_count;
+use crate::builtins::utils::{ensure_args_count, ensure_string};
 
 use crate::lexer::Span;
 use crate::value::Value;
 
+use itertools::Itertools;
 use std::collections::HashMap;
 
-use anyhow::Result;
+use anyhow::{bail, Result};
 
 pub fn register(m: &mut HashMap<&'static str, builtins::BuiltinFcn>) {
+    m.insert("io.jwt.decode", (jwt_decode, 1));
     m.insert("io.jwt.decode_verify", (jwt_decode_verify, 2));
 }
 
+fn decode(span: &Span, jwt: String, strict: bool) -> Result<Value> {
+    let Some((Ok(header), Ok(payload), Ok(signature))) = jwt
+        .split('.')
+        .map(|p| data_encoding::BASE64URL_NOPAD.decode(p.as_bytes()))
+        .collect_tuple()
+    else {
+        if strict {
+            bail!(span.error("invalid jwt token"));
+        }
+        return Ok(Value::Undefined);
+    };
+
+    let header = String::from_utf8_lossy(&header).to_string();
+    let payload = String::from_utf8_lossy(&payload).to_string();
+    let signature = data_encoding::HEXLOWER_PERMISSIVE.encode(&signature);
+
+    let signature = Value::String(signature.into());
+    let header = Value::from_json_str(&header)?;
+
+    if header["enc"] != Value::Undefined {
+        bail!(span.error("JWT is a JWE object, which is not supported"));
+    }
+
+    if header["cty"] == "JWT".into() {
+        if payload.len() <= 2 || !payload.starts_with('"') || !payload.ends_with('"') {
+            bail!(span.error("invalid nested JWT"));
+        }
+        // Ignore ""
+        decode(span, payload[1..payload.len() - 1].to_string(), strict)
+    } else {
+        let payload = Value::from_json_str(&payload)?;
+        Ok(Value::from_array([header, payload, signature].into()))
+    }
+}
+
+fn jwt_decode(span: &Span, params: &[Ref<Expr>], args: &[Value], strict: bool) -> Result<Value> {
+    let name = "io.jwt.decode";
+    ensure_args_count(span, name, params, args, 1)?;
+    let jwt = ensure_string(name, &params[0], &args[0])?;
+
+    decode(span, jwt.to_string(), strict) //header, payload, signature, strict)
+}
+
 fn jwt_decode_verify(
     span: &Span,
     params: &[Ref<Expr>],

src/builtins/mod.rs

@@ -54,6 +54,8 @@ use lazy_static::lazy_static;
 
 pub type BuiltinFcn = (fn(&Span, &[Ref<Expr>], &[Value], bool) -> Result<Value>, u8);
 
+pub use debugging::print_to_string;
+
 #[cfg(feature = "deprecated")]
 pub use deprecated::DEPRECATED;
 

src/builtins/objects.rs

@@ -5,11 +5,11 @@ use crate::ast::{Expr, Ref};
 use crate::builtins;
 use crate::builtins::utils::{ensure_args_count, ensure_array, ensure_object};
 use crate::lexer::Span;
-use crate::value::Value;
+use crate::Rc;
+use crate::Value;
 
 use std::collections::{BTreeMap, BTreeSet, HashMap};
 use std::iter::Iterator;
-use std::rc::Rc;
 
 use anyhow::{bail, Result};
 

src/builtins/semver.rs

@@ -12,7 +12,7 @@ use semver::Version;
 use std::cmp::Ordering;
 use std::collections::HashMap;
 
-use anyhow::{Ok, Result};
+use anyhow::Result;
 
 pub fn register(m: &mut HashMap<&'static str, builtins::BuiltinFcn>) {
     m.insert("semver.compare", (compare, 2));

src/builtins/strings.rs

@@ -157,7 +157,9 @@ fn to_string(v: &Value, unescape: bool) -> String {
     match v {
         Value::Null => "null".to_owned(),
         Value::Bool(b) => b.to_string(),
-        Value::String(s) if unescape => serde_json::to_string(&s).unwrap_or(s.as_ref().to_string()),
+        Value::String(s) if unescape => {
+            serde_json::to_string(s.as_ref()).unwrap_or(s.as_ref().to_string())
+        }
         Value::String(s) => s.as_ref().to_string(),
         Value::Number(n) => n.format_decimal(),
         Value::Array(a) => {

src/builtins/time.rs

@@ -9,11 +9,11 @@ use crate::value::Value;
 
 use std::collections::HashMap;
 
-use anyhow::{anyhow, bail, Result};
+use anyhow::{bail, Result};
 
 use chrono::{
-    DateTime, Datelike, Days, FixedOffset, Local, Months, NaiveDateTime, SecondsFormat, TimeZone,
-    Timelike, Utc, Weekday,
+    DateTime, Datelike, Days, FixedOffset, Local, Months, SecondsFormat, TimeZone, Timelike, Utc,
+    Weekday,
 };
 use chrono_tz::Tz;
 
@@ -124,7 +124,7 @@ fn format(span: &Span, params: &[Ref<Expr>], args: &[Value], _strict: bool) -> R
     let (datetime, format) = parse_epoch(name, &params[0], &args[0])?;
 
     let result = match format {
-        Some(format) => datetime.format(&format).to_string(),
+        Some(format) => compat::format(datetime, layout_with_predefined_formats(&format)),
         None => datetime.to_rfc3339_opts(SecondsFormat::AutoSi, true),
     };
 
@@ -159,7 +159,7 @@ fn parse_ns(span: &Span, params: &[Ref<Expr>], args: &[Value], strict: bool) ->
     let layout = ensure_string(name, &params[0], &args[0])?;
     let value = ensure_string(name, &params[1], &args[1])?;
 
-    let datetime = NaiveDateTime::parse_from_str(&value, &layout)?;
+    let datetime = compat::parse(layout_with_predefined_formats(&layout), &value)?;
     safe_timestamp_nanos(span, strict, datetime.timestamp_nanos_opt())
 }
 
@@ -248,7 +248,10 @@ fn parse_epoch(
                     "UTC" | "" => Utc.timestamp_nanos(ns).fixed_offset(),
                     "Local" => Local.timestamp_nanos(ns).fixed_offset(),
                     _ => {
-                        let tz: Tz = tz.parse().map_err(|err: String| anyhow!(err))?;
+                        let tz: Tz = match tz.parse() {
+                            Ok(tz) => tz,
+                            Err(e) => bail!(e),
+                        };
                         tz.timestamp_nanos(ns).fixed_offset()
                     }
                 };
@@ -275,3 +278,21 @@ fn parse_epoch(
         "`{fcn}` expects `ns` to be a `number` or `array[number, string]`. Got `{val}` instead"
     )))
 }
+
+fn layout_with_predefined_formats(format: &str) -> &str {
+    match format {
+        "ANSIC" => "Mon Jan _2 15:04:05 2006",
+        "UnixDate" => "Mon Jan _2 15:04:05 MST 2006",
+        "RubyDate" => "Mon Jan 02 15:04:05 -0700 2006",
+        "RFC822" => "02 Jan 06 15:04 MST",
+        // RFC822 with numeric zone
+        "RFC822Z" => "02 Jan 06 15:04 -0700",
+        "RFC850" => "Monday, 02-Jan-06 15:04:05 MST",
+        "RFC1123" => "Mon, 02 Jan 2006 15:04:05 MST",
+        // RFC1123 with numeric zone
+        "RFC1123Z" => "Mon, 02 Jan 2006 15:04:05 -0700",
+        "RFC3339" => "2006-01-02T15:04:05Z07:00",
+        "RFC3339Nano" => "2006-01-02T15:04:05.999999999Z07:00",
+        other => other,
+    }
+}

src/builtins/time/diff.rs

@@ -2,7 +2,7 @@
 // Licensed under the MIT and Apache 2.0 License.
 
 use anyhow::{anyhow, Result};
-use chrono::{DateTime, Datelike, FixedOffset, TimeZone, Timelike, Utc};
+use chrono::{DateTime, Datelike, FixedOffset, NaiveDate, Timelike};
 
 // Adapted from the official Go implementation:
 // https://github.com/open-policy-agent/opa/blob/eb17a716b97720a27c6569395ba7c4b7409aae87/topdown/time.go#L179-L243
@@ -12,7 +12,6 @@ pub fn diff_between_datetimes(
 ) -> Result<(i32, i32, i32, i32, i32, i32)> {
     // The following implementation of this function is taken
     // from https://github.com/icza/gox licensed under Apache 2.0.
-    // The only modification made is to variable names.
     //
     // For details, see https://stackoverflow.com/a/36531443/1705598
     //
@@ -50,12 +49,9 @@ pub fn diff_between_datetimes(
         day -= 1;
     }
     if day < 0 {
-        // Days in month:
-        let t = Utc
-            .with_ymd_and_hms(datetime1.year(), datetime1.month(), 32, 0, 0, 0)
-            .single()
+        let days_in_month = days_in_month(datetime1.year(), datetime1.month())
             .ok_or(anyhow!("Could not convert `ns1` to datetime"))?;
-        day += 32 - t.day() as i32;
+        day += days_in_month as i32;
         month -= 1;
     }
     if month < 0 {
@@ -67,3 +63,21 @@ pub fn diff_between_datetimes(
 
     Ok((year, month, day, hour, min, sec))
 }
+
+fn days_in_month(year: i32, month: u32) -> Option<i64> {
+    Some(
+        NaiveDate::from_ymd_opt(
+            match month {
+                12 => year + 1,
+                _ => year,
+            },
+            match month {
+                12 => 1,
+                _ => month + 1,
+            },
+            1,
+        )?
+        .signed_duration_since(NaiveDate::from_ymd_opt(year, month, 1)?)
+        .num_days(),
+    )
+}

src/builtins/utils.rs

@@ -4,10 +4,10 @@
 use crate::ast::{Expr, Ref};
 use crate::lexer::Span;
 use crate::number::Number;
-use crate::value::Value;
+use crate::Rc;
+use crate::Value;
 
 use std::collections::{BTreeMap, BTreeSet};
-use std::rc::Rc;
 
 use anyhow::{bail, Result};
 

src/builtins/uuid.rs

@@ -9,7 +9,7 @@ use crate::value::Value;
 
 use std::collections::{BTreeMap, HashMap};
 
-use anyhow::{Ok, Result};
+use anyhow::Result;
 use uuid::{Timestamp, Uuid};
 
 pub fn register(m: &mut HashMap<&'static str, builtins::BuiltinFcn>) {