mirror of
https://github.com/microsoft/regorus.git
synced 2026-08-05 02:16:11 +00:00
3f7a5496dc
- FFI: add RVM/Program APIs, execution state accessors, HostAwait handling, and buffer/result helpers in rvm.rs, common.rs, engine.rs. - Compiler: emit HostAwait for __builtin_host_await in function_calls.rs. - RVM tests: add HostAwait regression cases and extend harness for suspend/resume responses in host_await.yaml and mod.rs. - C/C++: add RVM tests/examples and wrapper updates in rvm_tests.c, rvm_tests.cpp, regorus.hpp, plus CMake wiring. - C#: add Program/Rvm bindings, SafeHandle/PInvoke, tests, and example usage in Regorus, RvmProgramTests.cs, Program.cs, and README updates. - Go: add Program/Rvm bindings, tests, and examples in rvm.go, rvm_test.go, main.go. - Java: add Program/Rvm bindings, JNI glue, and examples in lib.rs, regorus, Test.java. - Python: add Program/Rvm bindings and examples in lib.rs, test.py. - WASM: add Program/Rvm bindings and examples in lib.rs, test.js. - Tooling: wire binding tests in xtask and ignore generated Java artifacts in .gitignore. Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
166 lines
3.8 KiB
Python
166 lines
3.8 KiB
Python
# Copyright (c) Microsoft Corporation.
|
|
# Licensed under the MIT License.
|
|
|
|
import regorus
|
|
import sys
|
|
|
|
if hasattr(sys.stdout, "reconfigure"):
|
|
sys.stdout.reconfigure(encoding="utf-8")
|
|
|
|
# Create engine
|
|
engine = regorus.Engine()
|
|
|
|
engine.set_rego_v0(True)
|
|
|
|
# Load policies
|
|
pkg = engine.add_policy_from_file('../../tests/aci/framework.rego')
|
|
print(' Loaded package %s' % pkg)
|
|
|
|
pkg = engine.add_policy_from_file('../../tests/aci/api.rego')
|
|
print(' Loaded package %s' % pkg)
|
|
|
|
pkg = engine.add_policy_from_file('../../tests/aci/policy.rego')
|
|
print(' Loaded package %s' % pkg)
|
|
|
|
# Add policy data
|
|
data = {
|
|
"metadata": {
|
|
"devices": {
|
|
"/run/layers/p0-layer0": "1b80f120dbd88e4355d6241b519c3e25290215c469516b49dece9cf07175a766",
|
|
"/run/layers/p0-layer1": "e769d7487cc314d3ee748a4440805317c19262c7acd2fdbdb0d47d2e4613a15c",
|
|
"/run/layers/p0-layer2": "eb36921e1f82af46dfe248ef8f1b3afb6a5230a64181d960d10237a08cd73c79",
|
|
"/run/layers/p0-layer3": "41d64cdeb347bf236b4c13b7403b633ff11f1cf94dbc7cf881a44d6da88c5156",
|
|
"/run/layers/p0-layer4": "4dedae42847c704da891a28c25d32201a1ae440bce2aecccfa8e6f03b97a6a6c",
|
|
"/run/layers/p0-layer5": "fe84c9d5bfddd07a2624d00333cf13c1a9c941f3a261f13ead44fc6a93bc0e7a"
|
|
}
|
|
}
|
|
}
|
|
engine.add_data(data)
|
|
|
|
# Set input
|
|
input = {
|
|
"containerID": "container0",
|
|
"layerPaths": [
|
|
"/run/layers/p0-layer0",
|
|
"/run/layers/p0-layer1",
|
|
"/run/layers/p0-layer2",
|
|
"/run/layers/p0-layer3",
|
|
"/run/layers/p0-layer4",
|
|
"/run/layers/p0-layer5"
|
|
],
|
|
"target": "/run/gcs/c/container0/rootfs"
|
|
}
|
|
engine.set_input(input)
|
|
|
|
# Eval query
|
|
results = engine.eval_query('data.framework.mount_overlay=x')
|
|
|
|
# Print results
|
|
print(results['result'][0])
|
|
|
|
# Eval query as json
|
|
results_json = engine.eval_query_as_json('data.framework.mount_overlay=x')
|
|
print(results_json)
|
|
|
|
# Eval rule
|
|
v = engine.eval_rule('data.framework.mount_overlay')
|
|
print(v)
|
|
|
|
# Eval rule as json
|
|
v = engine.eval_rule_as_json('data.framework.mount_overlay')
|
|
print(v)
|
|
|
|
# Enable coverage
|
|
engine.set_enable_coverage(True)
|
|
engine.eval_rule('data.framework.mount_overlay')
|
|
|
|
# Print coverage
|
|
report_json = engine.get_coverage_report_as_json()
|
|
print(report_json)
|
|
|
|
# Pretty coverage report
|
|
report = engine.get_coverage_report_pretty()
|
|
print(report)
|
|
|
|
# Clone engine
|
|
engine1 = engine.clone()
|
|
|
|
|
|
# Clear coverage data
|
|
engine.clear_coverage_data();
|
|
|
|
print(engine1.get_coverage_report_pretty())
|
|
|
|
# Enable gathering prints
|
|
engine1.set_gather_prints(True)
|
|
|
|
# Gather prints
|
|
engine1.eval_query('print("Hello")')
|
|
ps = engine1.take_prints()
|
|
print(ps)
|
|
|
|
# RVM regular example
|
|
policy = """
|
|
package demo
|
|
import rego.v1
|
|
|
|
default allow := false
|
|
|
|
allow if {
|
|
input.user == "alice"
|
|
input.active == true
|
|
}
|
|
"""
|
|
def run_regular_example():
|
|
module = ("demo.rego", policy)
|
|
program = regorus.Program.compile_from_modules(
|
|
"{}",
|
|
[module],
|
|
["data.demo.allow"],
|
|
)
|
|
|
|
print(program.generate_listing())
|
|
|
|
binary = program.serialize_binary()
|
|
program, is_partial = regorus.Program.deserialize_binary(binary)
|
|
if is_partial:
|
|
raise RuntimeError("Deserialized program marked partial")
|
|
|
|
vm = regorus.Rvm()
|
|
vm.load_program(program)
|
|
vm.set_input_json('{"user":"alice","active":true}')
|
|
print(vm.execute())
|
|
|
|
run_regular_example()
|
|
|
|
# RVM HostAwait example
|
|
policy = """
|
|
package demo
|
|
import rego.v1
|
|
|
|
default allow := false
|
|
|
|
allow if {
|
|
input.account.active == true
|
|
details := __builtin_host_await(input.account.id, "account")
|
|
details.tier == "gold"
|
|
}
|
|
"""
|
|
def run_host_await_example():
|
|
module = ("await.rego", policy)
|
|
program = regorus.Program.compile_from_modules(
|
|
"{}",
|
|
[module],
|
|
["data.demo.allow"],
|
|
)
|
|
|
|
vm = regorus.Rvm()
|
|
vm.set_execution_mode(1)
|
|
vm.load_program(program)
|
|
vm.set_input_json('{"account":{"id":"acct-1","active":true}}')
|
|
vm.execute()
|
|
print(vm.get_execution_state())
|
|
print(vm.resume('{"tier":"gold"}'))
|
|
|
|
run_host_await_example()
|