From 500faefdc49c61198e8de59b8e9cacacf304576c Mon Sep 17 00:00:00 2001
From: Teemu Koponen <koponen@styra.com>
Date: Fri, 21 Feb 2020 15:24:45 -0800
Subject: [PATCH] bundle: Dedicate policy.wasm for the compiled policy.

Signed-off-by: Teemu Koponen <koponen@styra.com>
---
 bundle/bundle.go           | 23 ++++++++++++++++++++++-
 bundle/bundle_test.go      |  3 +++
 docs/content/management.md |  3 +++
 3 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/bundle/bundle.go b/bundle/bundle.go
index 614e575428..7e82a8127c 100644
--- a/bundle/bundle.go
+++ b/bundle/bundle.go
@@ -30,6 +30,7 @@ import (
 // Common file extensions and file names.
 const (
 	RegoExt      = ".rego"
+	WasmFile     = "/policy.wasm"
 	manifestExt  = ".manifest"
 	dataFile     = "data.json"
 	yamlDataFile = "data.yaml"
@@ -42,6 +43,7 @@ type Bundle struct {
 	Manifest Manifest
 	Data     map[string]interface{}
 	Modules  []ModuleFile
+	Wasm     []byte
 }
 
 // Manifest represents the manifest from a bundle. The manifest may contain
@@ -209,6 +211,9 @@ func (r *Reader) Read() (Bundle, error) {
 			}
 			bundle.Modules = append(bundle.Modules, mf)
 
+		} else if path == WasmFile {
+			bundle.Wasm = buf.Bytes()
+
 		} else if filepath.Base(path) == dataFile {
 			var value interface{}
 
@@ -302,6 +307,10 @@ func Write(w io.Writer, bundle Bundle) error {
 		}
 	}
 
+	if err := writeWasm(tw, bundle); err != nil {
+		return err
+	}
+
 	if err := writeManifest(tw, bundle); err != nil {
 		return err
 	}
@@ -313,6 +322,14 @@ func Write(w io.Writer, bundle Bundle) error {
 	return gw.Close()
 }
 
+func writeWasm(tw *tar.Writer, bundle Bundle) error {
+	if len(bundle.Wasm) == 0 {
+		return nil
+	}
+
+	return archive.WriteFile(tw, WasmFile, bundle.Wasm)
+}
+
 func writeManifest(tw *tar.Writer, bundle Bundle) error {
 
 	var buf bytes.Buffer
@@ -357,7 +374,11 @@ func (b Bundle) Equal(other Bundle) bool {
 			return false
 		}
 	}
-	return true
+	if (b.Wasm == nil && other.Wasm != nil) || (b.Wasm != nil && other.Wasm == nil) {
+		return false
+	}
+
+	return bytes.Equal(b.Wasm, other.Wasm)
 }
 
 func (b *Bundle) insert(key []string, value interface{}) error {
diff --git a/bundle/bundle_test.go b/bundle/bundle_test.go
index 394b80c83d..c7b576f7da 100644
--- a/bundle/bundle_test.go
+++ b/bundle/bundle_test.go
@@ -30,6 +30,7 @@ func testReadBundle(t *testing.T, baseDir string) {
 		{"/a/b/d/data.json", "true"},
 		{"/a/b/y/data.yaml", `foo: 1`},
 		{"/example/example.rego", `package example`},
+		{"/policy.wasm", `modules-compiled-as-wasm-binary`},
 		{"/data.json", `{"x": {"y": true}, "a": {"b": {"z": true}}}}`},
 	}
 
@@ -72,6 +73,7 @@ func testReadBundle(t *testing.T, baseDir string) {
 				Raw:    []byte(module),
 			},
 		},
+		Wasm: []byte("modules-compiled-as-wasm-binary"),
 	}
 
 	if !exp.Equal(bundle) {
@@ -268,6 +270,7 @@ func TestRoundtrip(t *testing.T) {
 				Raw:    []byte(`package foo.corge`),
 			},
 		},
+		Wasm: []byte("modules-compiled-as-wasm-binary"),
 		Manifest: Manifest{
 			Revision: "quickbrownfaux",
 		},
diff --git a/docs/content/management.md b/docs/content/management.md
index b2515ef981..cde1142cca 100644
--- a/docs/content/management.md
+++ b/docs/content/management.md
@@ -163,6 +163,9 @@ http/example/authz/authz.rego
 
 In this example, the bundle contains one policy file (`authz.rego`) and two
 data files (`roles/bindings/data.json` and `roles/permissions/data.json`).
+The bundle may also contain an optional wasm binary file (`policy.wasm`).
+It stores the WebAssembly compiled version of all the Rego policy files within
+the bundle.
 
 Bundle files may contain an optional `.manifest` file that stores bundle
 metadata. The file should contain a JSON serialized object, with the following