mirror of
https://github.com/microsoft/regorus.git
synced 2026-08-05 02:16:11 +00:00
50c0215fdb
* perf(rvm): fix O(n²) comprehension yield by mutating in-place Instead of cloning the entire accumulator collection on every yield iteration, use take_register + Rc::make_mut to get exclusive ownership and mutate in-place. This reduces comprehension yield from O(n²) to O(n) for both run-to-completion and suspendable execution modes. - Add RegoVM::take_register() helper that swaps register with Undefined - Comprehension yield now takes the accumulator, mutates via Rc::make_mut, and writes back — avoiding deep clones when refcount == 1 Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> * perf(rvm): use take_register for ObjectSet, ArrayPush, SetAdd These instructions were cloning the container register (bumping Rc to 2), then calling as_object_mut/as_array_mut/as_set_mut which invokes Rc::make_mut — deep-cloning the entire collection since refcount > 1. Use take_register instead so the Rc refcount stays at 1, making Rc::make_mut a no-op and allowing in-place mutation. Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> * perf(rvm): remove unnecessary clones in rule caching - execute_call_rule_common: move final_value into cache instead of cloning, since it is not used afterwards - finalize_rule_frame_data: add comment clarifying the clone is needed because the value is both cached and returned - Remove unnecessary .clone() on result_from_rule when setting register Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> * rvm: avoid RuleInfo clone per rule call Replace RuleInfo.clone() (which heap-allocates name, destructuring_blocks, and potentially function_info) with a cheap Arc<Program> clone (atomic refcount bump) followed by borrowing &RuleInfo from the local Arc. This eliminates per-rule-call heap allocations. Sites changed: - execute_call_rule_common: Arc clone + borrow - execute_call_rule_suspendable: Arc clone + borrow - finalize_rule_frame_data: Arc clone + borrow - handle_rule_break_event: inline Arc clone + borrow (was get_rule_info) - handle_rule_error_event: inline Arc clone + borrow (was get_rule_info) - Removed now-unused get_rule_info method Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> * rvm: replace bincode with postcard for serialization Remove unlinked bincode dependency. Use postcard (already a dep for rvm feature) for all binary serialization/deserialization in program serialization and tests. Also adds rvm_benchmark benchmark. Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> * perf(rvm): cache dummy Span/Expr for builtin calls Every builtin call was allocating a Source (via from_contents), a Span, and N Ref<Expr> wrappers just to satisfy the builtin function signature. These dummy values are only used for error reporting context. Cache the dummy Span and Vec<Ref<Expr>> on the RegoVM struct. The Source and Span are created once on first builtin call; dummy Expr entries grow as needed and are reused across calls via mem::take/put-back pattern. This eliminates per-builtin-call heap allocations for Source (Rc + String + Vec<lines>), Span clones, and Rc<Expr> wrappers. Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> * perf(rvm): round 2 allocation reduction in builtins, entry points, virtual data - Cache builtin args Vec on RegoVM (mem::take/clear/put-back pattern) - Restructure builtins_cache as two-level map for clone-free lookup - Use IndexMap::get_index() in execute_entry_point_by_index - Use mutable Vec path stack in traverse_rule_tree_subobject (push/pop) - Walk data tree and rule-result paths by reference, clone only leaf - Use mem::replace in resume() instead of cloning ExecutionState Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> * fix(rvm): address PR review feedback - Restore cached_builtin_args on all error/early-return paths in execute_builtin_call to preserve allocation reuse - Use 1-based line/col and \"<builtin>\" filename in dummy span for clearer diagnostics - Restore result register before returning errors in comprehension mode-mismatch branches (both run-to-completion and suspendable) - Avoid clone in resume() invalid-state error path by formatting debug string before moving state back --------- Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
208 lines
5.4 KiB
TOML
208 lines
5.4 KiB
TOML
[workspace]
|
|
|
|
members = [
|
|
"tests/ensure_no_std",
|
|
"xtask",
|
|
]
|
|
|
|
[package]
|
|
name = "regorus"
|
|
description = "A fast, lightweight Rego (OPA policy language) interpreter"
|
|
version = "0.9.1"
|
|
edition = "2021"
|
|
license = "MIT AND Apache-2.0 AND BSD-3-Clause"
|
|
repository = "https://github.com/microsoft/regorus"
|
|
keywords = ["interpreter", "no_std", "opa", "policy-as-code", "rego"]
|
|
|
|
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
|
|
|
|
[lib]
|
|
doctest = false
|
|
|
|
[features]
|
|
default = ["full-opa", "arc", "rvm"]
|
|
|
|
arc = []
|
|
ast = []
|
|
azure_policy = ["dep:jsonschema", "arc", "dashmap"]
|
|
azure-rbac = ["regex", "time", "net"]
|
|
base64 = ["dep:data-encoding"]
|
|
base64url = ["dep:data-encoding"]
|
|
coverage = []
|
|
hex = ["dep:data-encoding"]
|
|
http = []
|
|
glob = ["dep:globset"]
|
|
graph = []
|
|
jsonschema = ["dep:jsonschema"]
|
|
mimalloc = ["dep:mimalloc"]
|
|
net = ["dep:ipnet"]
|
|
no_std = ["lazy_static/spin_no_std"]
|
|
opa-runtime = []
|
|
regex = ["dep:regex"]
|
|
rvm = ["dep:postcard", "dep:indexmap"]
|
|
semver = ["dep:semver"]
|
|
allocator-memory-limits = ["std", "mimalloc", "mimalloc/allocator-memory-limits"]
|
|
std = ["rand/std", "rand/std_rng", "serde_json/std", "msvc_spectre_libs" ]
|
|
time = ["dep:chrono", "dep:chrono-tz"]
|
|
uuid = ["dep:uuid"]
|
|
urlquery = ["dep:url"]
|
|
yaml = ["serde_yaml"]
|
|
full-opa = [
|
|
"base64",
|
|
"base64url",
|
|
"coverage",
|
|
"glob",
|
|
"graph",
|
|
"hex",
|
|
"http",
|
|
"jsonschema",
|
|
"allocator-memory-limits",
|
|
"mimalloc",
|
|
"net",
|
|
"opa-runtime",
|
|
"regex",
|
|
"semver",
|
|
"std",
|
|
"time",
|
|
"uuid",
|
|
"urlquery",
|
|
"yaml",
|
|
|
|
#"rego-extensions"
|
|
]
|
|
|
|
# Features that can be used in no_std environments.
|
|
# Note that: the spin_no_std feature in lazy_static must be specified.
|
|
opa-no-std = [
|
|
"arc",
|
|
"base64",
|
|
"base64url",
|
|
"coverage",
|
|
"graph",
|
|
"hex",
|
|
"no_std",
|
|
"opa-runtime",
|
|
"regex",
|
|
"semver",
|
|
# Configure lazy_static to use spinlocks.
|
|
"lazy_static/spin_no_std"
|
|
]
|
|
|
|
# Rego language extensions
|
|
rego-extensions = []
|
|
|
|
# This feature enables some testing utils for OPA tests.
|
|
opa-testutil = []
|
|
rand = ["dep:rand"]
|
|
|
|
[dependencies]
|
|
anyhow = { version = "1.0.45", default-features = false }
|
|
serde = {version = "1.0.150", default-features = false, features = ["derive", "rc", "alloc"] }
|
|
serde_json = { version = "1.0.89", default-features = false, features = ["alloc"] }
|
|
lazy_static = { version = "1.4.0", default-features = false }
|
|
thiserror = { version = "2.0", default-features = false }
|
|
|
|
data-encoding = { version = "2.8.0", optional = true, default-features=false, features = ["alloc"] }
|
|
num-bigint = { version = "0.4", default-features = false }
|
|
num-traits = { version = "0.2", default-features = false }
|
|
spin = { version = "0.9.8", default-features = false, features = ["mutex", "spin_mutex"] }
|
|
|
|
globset = { version = "0.4.16", features = ["simd-accel"], default-features = false, optional = true }
|
|
regex = {version = "1.11.1", optional = true, default-features = false }
|
|
semver = {version = "1.0.25", optional = true, default-features = false }
|
|
url = { version = "2.5.4", optional = true }
|
|
uuid = { version = "1.15.1", default-features = false, features = ["v4", "fast-rng"], optional = true }
|
|
jsonschema = { version = "0.30.0", default-features = false, optional = true }
|
|
chrono = { version = "0.4.40", optional = true }
|
|
chrono-tz = { version = "0.10.1", optional = true }
|
|
ipnet = { version = "2.11.0", optional = true, default-features = false }
|
|
|
|
serde_yaml = {version = "0.9.16", default-features = false, optional = true }
|
|
# Specify thread_rng for in order to use random_range
|
|
rand = { version = "0.9.0", default-features = false, features = ["thread_rng"], optional = true }
|
|
|
|
# Causes the project to link with the Spectre-mitigated CRT and libs.
|
|
msvc_spectre_libs = { version = "0.1", features = ["error"], optional = true }
|
|
dashmap = { version = "6.1", default-features = false, optional = true }
|
|
mimalloc = { package = "regorus-mimalloc", path = "mimalloc", version = "2.2.6", optional = true }
|
|
|
|
# rvm related deps
|
|
indexmap = { version = "2.12.1", default-features = false, features = ["serde"], optional = true }
|
|
postcard = { version = "1.1.3", default-features = false, features = ["alloc"], optional = true }
|
|
|
|
[dev-dependencies]
|
|
anyhow = "1.0.45"
|
|
cfg-if = "1.0.0"
|
|
clap = { version = "4.5.53", features = ["derive"] }
|
|
prettydiff = { version = "0.9.0", default-features = false }
|
|
serde_yaml = "0.9.16"
|
|
test-generator = "0.3.1"
|
|
walkdir = "2.3.2"
|
|
criterion = { version = "0.8" }
|
|
|
|
num_cpus = "1.16"
|
|
|
|
[build-dependencies]
|
|
anyhow = "1.0"
|
|
|
|
[profile.release]
|
|
debug = true
|
|
lto = true
|
|
codegen-units = 1
|
|
|
|
[[test]]
|
|
name="opa"
|
|
harness=false
|
|
test=false
|
|
required-features = ["full-opa"]
|
|
|
|
[[test]]
|
|
name="aci"
|
|
harness=false
|
|
test=false
|
|
|
|
[[test]]
|
|
name="kata"
|
|
harness=false
|
|
test=false
|
|
|
|
[[bench]]
|
|
name = "regorus_benchmark"
|
|
harness = false
|
|
|
|
[[bench]]
|
|
name = "schema_validation_benchmark"
|
|
harness = false
|
|
required-features = ["azure_policy"]
|
|
|
|
[[bench]]
|
|
name = "engine_evaluation_benchmark"
|
|
path = "benches/evaluation/engine_evaluation_benchmark.rs"
|
|
harness = false
|
|
|
|
[[bench]]
|
|
name = "compiled_policy_evaluation_benchmark"
|
|
path = "benches/evaluation/compiled_policy_evaluation_benchmark.rs"
|
|
harness = false
|
|
|
|
[[bench]]
|
|
name = "aci_benchmark"
|
|
harness = false
|
|
|
|
[[bench]]
|
|
name = "rvm_benchmark"
|
|
harness = false
|
|
required-features = ["rvm"]
|
|
|
|
[[example]]
|
|
name="regorus"
|
|
harness=false
|
|
test=false
|
|
doctest=false
|
|
|
|
[package.metadata.docs.rs]
|
|
# To build locally:
|
|
# RUSTDOCFLAGS="--cfg docsrs" cargo +nightly doc --all-features --no-deps
|
|
all-features = true
|
|
rustdoc-args = ["--cfg", "docsrs"]
|