docs: add endswith and replace built-in examples (#8991)

Adds playground examples for `endswith` (approved file extensions) and
`replace` (strip a fixed prefix before allowlist check) on the string
built-ins page.

Part of #3786

---------

Signed-off-by: Dean Chen <862469039@qq.com>

docs/docs/policy-reference/_examples/strings/endswith/file-extension/config.json

@@ -0,0 +1,6 @@
+{
+  "showInput": true,
+  "showData": false,
+  "showTitles": false,
+  "titleSize": 4
+}

docs/docs/policy-reference/_examples/strings/endswith/file-extension/data.json

@@ -0,0 +1 @@
+{}

docs/docs/policy-reference/_examples/strings/endswith/file-extension/input.json

@@ -0,0 +1,3 @@
+{
+  "filename": "report.exe"
+}

docs/docs/policy-reference/_examples/strings/endswith/file-extension/intro.md

@@ -0,0 +1,7 @@
+<!-- markdownlint-disable MD041 -->
+
+`endswith` checks whether a string ends with a given suffix. Use it for file
+extensions, email domains, or other trailing markers where `contains` would
+match in the wrong place.
+
+This example denies filenames that do not end with `.json` or `.yaml`.

docs/docs/policy-reference/_examples/strings/endswith/file-extension/output.json

@@ -0,0 +1,5 @@
+{
+  "deny": [
+    "disallowed ext: report.exe"
+  ]
+}

docs/docs/policy-reference/_examples/strings/endswith/file-extension/policy.rego

@@ -0,0 +1,8 @@
+package play
+
+deny contains $"disallowed ext: {input.filename}" if {
+	not _valid_file_ext
+}
+
+_valid_file_ext if endswith(input.filename, ".json")
+_valid_file_ext if endswith(input.filename, ".yaml")

docs/docs/policy-reference/_examples/strings/endswith/file-extension/title.txt

@@ -0,0 +1 @@
+Allow only approved file extensions

docs/docs/policy-reference/_examples/strings/replace/redact-token/config.json

@@ -0,0 +1,6 @@
+{
+  "showInput": true,
+  "showData": false,
+  "showTitles": false,
+  "titleSize": 4
+}

docs/docs/policy-reference/_examples/strings/replace/redact-token/data.json

@@ -0,0 +1 @@
+{}

docs/docs/policy-reference/_examples/strings/replace/redact-token/input.json

@@ -0,0 +1,5 @@
+{
+  "headers": {
+    "authorization": "Bearer abc123xyz"
+  }
+}

docs/docs/policy-reference/_examples/strings/replace/redact-token/intro.md

@@ -0,0 +1,5 @@
+<!-- markdownlint-disable MD041 -->
+
+When a policy builds a user-facing error, it can accidentally include a
+sensitive header value. `replace` redacts that substring before the message
+goes back to the caller.

docs/docs/policy-reference/_examples/strings/replace/redact-token/output.json

@@ -0,0 +1,3 @@
+{
+  "safe_message": "upstream rejected request with [REDACTED]"
+}

docs/docs/policy-reference/_examples/strings/replace/redact-token/policy.rego

@@ -0,0 +1,8 @@
+package play
+
+# Message that would leak a confidential header, then redacted for the caller.
+safe_message := replace(
+	sprintf("upstream rejected request with %s", [input.headers.authorization]),
+	input.headers.authorization,
+	"[REDACTED]",
+)

docs/docs/policy-reference/_examples/strings/replace/redact-token/title.txt

@@ -0,0 +1 @@
+Redact a confidential header from a user-facing message

docs/docs/policy-reference/builtins/strings.mdx

@@ -78,3 +78,17 @@ path, hostname, or other structured string needs to be broken into parts.
 formatting when values may arrive in mixed case.
 
 <PlaygroundExample dir={require.context('../_examples/strings/lower/normalize-role')} />
+
+### `endswith`
+
+`endswith` reports whether a string ends with a given suffix. Use this function to valid matches at the ends of string values (file extensions, email domains, path suffixes etc.).
+
+<PlaygroundExample dir={require.context('../_examples/strings/endswith/file-extension')} />
+
+### `replace`
+
+`replace` returns a string with every occurrence of a substring swapped for
+another. A common policy use is redacting sensitive values.
+
+<PlaygroundExample dir={require.context('../_examples/strings/replace/redact-token')} />
+