mirror of
https://github.com/microsoft/regorus.git
synced 2026-08-05 02:16:11 +00:00
394625d4bc
- Introduce ExecutionTimer/ExecutionTimerConfig to allow limiting evaluating time. - To amortize time checking costs, checking interval can be configured via the notion of work units - A global fallback time limit can be set to universally limit all evaluation in addition to engine level limit setting. - Implement limnits in interpreter and RVM. In RVM, also handle suspend/resume so that time during pause is not counted. - Add engine-level APIs to set/clear per-engine timer configuration and apply global fallback defaults. - Surface execution-time limits through FFI and C# bindings - Add C# tests and example usage to validate engine overrides, global fallback behavior, and compiled policy enforcement. - Expand docs for execution-time limit - Add interpreter YAML cases and VM unit tests for time-limit behavior and deterministic time sources. Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
91 lines
2.2 KiB
YAML
91 lines
2.2 KiB
YAML
# Copyright (c) Microsoft Corporation.
|
|
# Licensed under the MIT License.
|
|
|
|
cases:
|
|
- note: engine-configured timer triggers limit error
|
|
data:
|
|
values: [1, 2, 3, 4, 5]
|
|
modules:
|
|
- |
|
|
package limits.timer
|
|
import rego.v1
|
|
|
|
count_values := count({value | value := data.values[_]})
|
|
query: data.limits.timer.count_values
|
|
execution_timer:
|
|
limit_ms: 1
|
|
check_interval: 1
|
|
time_source:
|
|
default_increment_ms: 5
|
|
error: execution exceeded time limit
|
|
|
|
- note: global timer limit applies without engine override
|
|
data:
|
|
values: [1, 2, 3, 4, 5]
|
|
modules:
|
|
- |
|
|
package limits.timer
|
|
import rego.v1
|
|
|
|
count_values := count({value | value := data.values[_]})
|
|
query: data.limits.timer.count_values
|
|
global_execution_timer:
|
|
limit_ms: 1
|
|
check_interval: 1
|
|
time_source:
|
|
default_increment_ms: 5
|
|
error: execution exceeded time limit
|
|
|
|
- note: engine override increases limit above global default
|
|
data:
|
|
values: [1, 2, 3, 4, 5]
|
|
modules:
|
|
- |
|
|
package limits.timer
|
|
import rego.v1
|
|
|
|
count_values := count({value | value := data.values[_]})
|
|
query: data.limits.timer.count_values
|
|
global_execution_timer:
|
|
limit_ms: 1
|
|
check_interval: 1
|
|
execution_timer:
|
|
limit_ms: 500
|
|
check_interval: 1
|
|
time_source:
|
|
default_increment_ms: 5
|
|
want_result: 5
|
|
|
|
- note: repeated ticks eventually exceed limit
|
|
data:
|
|
values: [1, 2, 3, 4, 5]
|
|
modules:
|
|
- |
|
|
package limits.timer
|
|
import rego.v1
|
|
|
|
count_values := count({value | value := data.values[_]})
|
|
query: data.limits.timer.count_values
|
|
execution_timer:
|
|
limit_ms: 6
|
|
check_interval: 1
|
|
time_source:
|
|
default_increment_ms: 2
|
|
error: execution exceeded time limit
|
|
|
|
- note: global timer disabled removes limit
|
|
data:
|
|
values: [1, 2, 3, 4, 5]
|
|
modules:
|
|
- |
|
|
package limits.timer
|
|
import rego.v1
|
|
|
|
count_values := count({value | value := data.values[_]})
|
|
query: data.limits.timer.count_values
|
|
global_execution_timer:
|
|
disable: true
|
|
time_source:
|
|
default_increment_ms: 5
|
|
want_result: 5
|