mirror of
https://github.com/microsoft/regorus.git
synced 2026-08-05 02:16:11 +00:00
8f740e2f6f
Extend the Azure Policy parser to handle complete policyRule and
policyDefinition JSON structures, not just standalone constraints.
Policy rule parser (policy_rule.rs):
- Parse top-level { "if": ..., "then": ... } objects
- Extract effect kind (deny, audit, append, modify, etc.) into typed AST
- Parse "details" structurally when it is an object to pull out
existenceCondition as a first-class Constraint; fall back to opaque
JSON for non-object details (e.g. append array form)
- Detect duplicate/missing keys for "if", "then", "effect", "details"
Policy definition parser (policy_definition.rs):
- Handle both wrapped ARM envelope ({ "properties": { ... } }) and
unwrapped (properties-level keys at top level) forms
- Type-extract displayName, description, mode, metadata, parameters,
and policyRule; everything else goes into extra
- Parse parameter definitions with type, defaultValue, allowedValues,
and metadata; detect duplicate parameter names
- Duplicate key detection throughout
Grammar documentation (docs/azure-policy/azurepolicy.ebnf):
- Add formal EBNF grammar covering policy-rule, then-block,
constraints, conditions, all 19 operators, count expressions,
JSON values, and ARM template expressions
Test harness changes:
- Add parse_level field to YAML test cases: "constraint" (default),
"policy_rule", or "policy_definition"
- Un-skip three parse_errors cases that needed policy_rule-level parsing
- Add policy_rule.yaml with 12 cases covering all 9 effect kinds,
existenceCondition, parameterized effects, complex conditions, and
extra key handling
- Add policy_definition.yaml with wrapped, unwrapped, parameterized,
missing-policyRule, and duplicate-key error cases
198 lines
5.2 KiB
YAML
198 lines
5.2 KiB
YAML
# Copyright (c) Microsoft Corporation.
|
|
# Licensed under the MIT License.
|
|
|
|
# Policy Definition Test Suite
|
|
# Tests that full policy definition envelopes parse correctly via parse_policy_definition.
|
|
|
|
cases:
|
|
# =========================================================================
|
|
# Unwrapped form (properties-level keys directly)
|
|
# =========================================================================
|
|
|
|
- note: unwrapped_simple
|
|
parse_level: policy_definition
|
|
policy_rule: |
|
|
{
|
|
"displayName": "Deny VMs",
|
|
"description": "Deny creation of VMs",
|
|
"mode": "All",
|
|
"policyRule": {
|
|
"if": {
|
|
"field": "type",
|
|
"equals": "Microsoft.Compute/virtualMachines"
|
|
},
|
|
"then": {
|
|
"effect": "deny"
|
|
}
|
|
}
|
|
}
|
|
|
|
- note: unwrapped_with_parameters
|
|
parse_level: policy_definition
|
|
policy_rule: |
|
|
{
|
|
"displayName": "Allowed locations",
|
|
"mode": "Indexed",
|
|
"parameters": {
|
|
"allowedLocations": {
|
|
"type": "Array",
|
|
"metadata": {
|
|
"displayName": "Allowed locations",
|
|
"description": "The list of allowed locations."
|
|
}
|
|
}
|
|
},
|
|
"policyRule": {
|
|
"if": {
|
|
"not": {
|
|
"field": "location",
|
|
"in": "[parameters('allowedLocations')]"
|
|
}
|
|
},
|
|
"then": {
|
|
"effect": "deny"
|
|
}
|
|
}
|
|
}
|
|
|
|
# =========================================================================
|
|
# Wrapped form (ARM resource envelope)
|
|
# =========================================================================
|
|
|
|
- note: wrapped_arm_envelope
|
|
parse_level: policy_definition
|
|
policy_rule: |
|
|
{
|
|
"id": "/providers/Microsoft.Authorization/policyDefinitions/abc",
|
|
"name": "abc",
|
|
"type": "Microsoft.Authorization/policyDefinitions",
|
|
"properties": {
|
|
"displayName": "Test policy",
|
|
"policyRule": {
|
|
"if": {
|
|
"field": "type",
|
|
"equals": "Microsoft.Storage/storageAccounts"
|
|
},
|
|
"then": {
|
|
"effect": "audit"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
# =========================================================================
|
|
# Missing policyRule (should error)
|
|
# =========================================================================
|
|
|
|
- note: missing_policy_rule
|
|
parse_level: policy_definition
|
|
policy_rule: |
|
|
{
|
|
"displayName": "No rule here",
|
|
"mode": "All"
|
|
}
|
|
want_parse_error: true
|
|
|
|
# =========================================================================
|
|
# Duplicate keys (should error)
|
|
# =========================================================================
|
|
|
|
- note: wrapped_duplicate_properties_key
|
|
parse_level: policy_definition
|
|
policy_rule: |
|
|
{
|
|
"id": "/providers/Microsoft.Authorization/policyDefinitions/dup-properties",
|
|
"name": "dup-properties",
|
|
"type": "Microsoft.Authorization/policyDefinitions",
|
|
"properties": {
|
|
"displayName": "First properties block"
|
|
},
|
|
"properties": {
|
|
"policyRule": {
|
|
"if": {
|
|
"field": "type",
|
|
"equals": "Microsoft.Storage/storageAccounts"
|
|
},
|
|
"then": {
|
|
"effect": "audit"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
want_parse_error: true
|
|
|
|
- note: unwrapped_duplicate_policy_rule
|
|
parse_level: policy_definition
|
|
policy_rule: |
|
|
{
|
|
"displayName": "Duplicate policyRule",
|
|
"mode": "All",
|
|
"policyRule": {
|
|
"if": {
|
|
"field": "type",
|
|
"equals": "Microsoft.Compute/virtualMachines"
|
|
},
|
|
"then": {
|
|
"effect": "deny"
|
|
}
|
|
},
|
|
"policyRule": {
|
|
"if": {
|
|
"field": "type",
|
|
"equals": "Microsoft.Storage/storageAccounts"
|
|
},
|
|
"then": {
|
|
"effect": "audit"
|
|
}
|
|
}
|
|
}
|
|
want_parse_error: true
|
|
|
|
- note: wrapped_cross_scope_duplicate_key
|
|
parse_level: policy_definition
|
|
policy_rule: |
|
|
{
|
|
"displayName": "Outer displayName",
|
|
"properties": {
|
|
"displayName": "Inner displayName",
|
|
"policyRule": {
|
|
"if": {
|
|
"field": "type",
|
|
"equals": "Microsoft.Compute/virtualMachines"
|
|
},
|
|
"then": {
|
|
"effect": "deny"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
want_parse_error: true
|
|
|
|
- note: unwrapped_duplicate_parameter_name_case_insensitive
|
|
parse_level: policy_definition
|
|
policy_rule: |
|
|
{
|
|
"displayName": "Duplicate parameter names by casing",
|
|
"mode": "Indexed",
|
|
"parameters": {
|
|
"allowedLocations": {
|
|
"type": "Array"
|
|
},
|
|
"AllowedLocations": {
|
|
"type": "Array"
|
|
}
|
|
},
|
|
"policyRule": {
|
|
"if": {
|
|
"not": {
|
|
"field": "location",
|
|
"in": "[parameters('allowedLocations')]"
|
|
}
|
|
},
|
|
"then": {
|
|
"effect": "deny"
|
|
}
|
|
}
|
|
}
|
|
want_parse_error: true
|