All packages, except for `cmd` and `internal`, have been moved into a new `v1` root package.

Old packages are kept for backwards-compatibility reasons. All contained code is replaced with simple type aliases and proxy functions to `v1` implementations.

Old packages default to the Rego v0 syntax, new `v1` packages default to the Rego v1 syntax.

Signed-off-by: Johan Fylling <johan.dev@fylling.se>
This commit is contained in:
Johan Fylling
2024-11-21 17:30:02 +01:00
parent 7bb6dbe36b
commit a179a24c48
337 changed files with 15549 additions and 629 deletions
+71
View File
@@ -0,0 +1,71 @@
// Copyright 2017 The OPA Authors. All rights reserved.
// Use of this source code is governed by an Apache2
// license that can be found in the LICENSE file.
// Package authorizer provides authorization handlers to the server.
package authorizer
import (
"context"
"net/http"
"github.com/open-policy-agent/opa/ast"
"github.com/open-policy-agent/opa/storage"
"github.com/open-policy-agent/opa/topdown/cache"
"github.com/open-policy-agent/opa/topdown/print"
v1 "github.com/open-policy-agent/opa/v1/server/authorizer"
)
// Basic provides policy-based authorization over incoming requests.
type Basic = v1.Basic
// Runtime returns an argument that sets the runtime on the authorizer.
func Runtime(term *ast.Term) func(*Basic) {
return v1.Runtime(term)
}
// Decision returns an argument that sets the path of the authorization decision
// to query.
func Decision(ref func() ast.Ref) func(*Basic) {
return v1.Decision(ref)
}
// PrintHook sets the object to use for handling print statement outputs.
func PrintHook(printHook print.Hook) func(*Basic) {
return v1.PrintHook(printHook)
}
// EnablePrintStatements enables print() calls. If this option is not provided,
// print() calls will be erased from the policy. This option only applies to
// queries and policies that passed as raw strings, i.e., this function will not
// have any affect if the caller supplies the ast.Compiler instance.
func EnablePrintStatements(yes bool) func(r *Basic) {
return v1.EnablePrintStatements(yes)
}
// InterQueryCache enables the inter-query cache on the authorizer
func InterQueryCache(interQueryCache cache.InterQueryCache) func(*Basic) {
return v1.InterQueryCache(interQueryCache)
}
// InterQueryValueCache enables the inter-query value cache on the authorizer
func InterQueryValueCache(interQueryValueCache cache.InterQueryValueCache) func(*Basic) {
return v1.InterQueryValueCache(interQueryValueCache)
}
// NewBasic returns a new Basic object.
func NewBasic(inner http.Handler, compiler func() *ast.Compiler, store storage.Store, opts ...func(*Basic)) http.Handler {
return v1.NewBasic(inner, compiler, store, opts...)
}
// SetBodyOnContext adds the parsed input value to the context. This function is only
// exposed for test purposes.
func SetBodyOnContext(ctx context.Context, x interface{}) context.Context {
return v1.SetBodyOnContext(ctx, x)
}
// GetBodyOnContext returns the parsed input from the request context if it exists.
// The authorizer saves the parsed input on the context when it runs.
func GetBodyOnContext(ctx context.Context) (interface{}, bool) {
return v1.GetBodyOnContext(ctx)
}
+8
View File
@@ -0,0 +1,8 @@
// Copyright 2016 The OPA Authors. All rights reserved.
// Use of this source code is governed by an Apache2
// license that can be found in the LICENSE file.
// Deprecated: This package is intended for older projects transitioning from OPA v0.x and will remain for the lifetime of OPA v1.x, but its use is not recommended.
// For newer features and behaviours, such as defaulting to the Rego v1 syntax, use the corresponding components in the [github.com/open-policy-agent/opa/v1] package instead.
// See https://www.openpolicyagent.org/docs/latest/v0-compatibility/ for more information.
package authorizer
+15
View File
@@ -0,0 +1,15 @@
// Copyright 2017 The OPA Authors. All rights reserved.
// Use of this source code is governed by an Apache2
// license that can be found in the LICENSE file.
package server
import (
v1 "github.com/open-policy-agent/opa/v1/server"
)
// Info contains information describing a policy decision.
type Info = v1.Info
// BundleInfo contains information describing a bundle.
type BundleInfo = v1.BundleInfo
+10
View File
@@ -0,0 +1,10 @@
// Copyright 2016 The OPA Authors. All rights reserved.
// Use of this source code is governed by an Apache2
// license that can be found in the LICENSE file.
// Package server contains the policy engine's server handlers.
//
// Deprecated: This package is intended for older projects transitioning from OPA v0.x and will remain for the lifetime of OPA v1.x, but its use is not recommended.
// For newer features and behaviours, such as defaulting to the Rego v1 syntax, use the corresponding components in the [github.com/open-policy-agent/opa/v1] package instead.
// See https://www.openpolicyagent.org/docs/latest/v0-compatibility/ for more information.
package server
+10
View File
@@ -0,0 +1,10 @@
// Copyright 2021 The OPA Authors. All rights reserved.
// Use of this source code is governed by an Apache2
// license that can be found in the LICENSE file.
//go:build opa_wasm
// +build opa_wasm
package server
import _ "github.com/open-policy-agent/opa/v1/features/wasm"
+20
View File
@@ -0,0 +1,20 @@
package handlers
import (
"net/http"
v1 "github.com/open-policy-agent/opa/v1/server/handlers"
)
// This handler applies only for data and compile endpoints, for selected HTTP methods
//
// If the client asked for a gzip response, this handler will buffer the response and
// wait until it reached a certain threshold. If the threshold is not hit, the uncompressed response is sent
//
// If a gzip response is not asked by the client, it'll send the uncompressed response
//
// The threshold and the gzip compression level can be modified from server's configuration
func CompressHandler(handler http.Handler, gzipMinLength int, gzipCompressionLevel int) http.Handler {
return v1.CompressHandler(handler, gzipMinLength, gzipCompressionLevel)
}
+19
View File
@@ -0,0 +1,19 @@
package handlers
import (
"net/http"
v1 "github.com/open-policy-agent/opa/v1/server/handlers"
)
// This handler provides hard limits on the size of the request body, for both
// the raw body content, and also for the decompressed size when gzip
// compression is used.
//
// The Content-Length restriction happens here in the handler, but the
// decompressed size limit is enforced later, in `util.ReadMaybeCompressedBody`.
// The handler passes the gzip size limits down to that function through the
// request context whenever gzip encoding is present.
func DecodingLimitsHandler(handler http.Handler, maxLength, gzipMaxLength int64) http.Handler {
return v1.DecodingLimitsHandler(handler, maxLength, gzipMaxLength)
}
+8
View File
@@ -0,0 +1,8 @@
// Copyright 2016 The OPA Authors. All rights reserved.
// Use of this source code is governed by an Apache2
// license that can be found in the LICENSE file.
// Deprecated: This package is intended for older projects transitioning from OPA v0.x and will remain for the lifetime of OPA v1.x, but its use is not recommended.
// For newer features and behaviours, such as defaulting to the Rego v1 syntax, use the corresponding components in the [github.com/open-policy-agent/opa/v1] package instead.
// See https://www.openpolicyagent.org/docs/latest/v0-compatibility/ for more information.
package handlers
+18
View File
@@ -0,0 +1,18 @@
package identifier
import (
"crypto/x509"
"net/http"
v1 "github.com/open-policy-agent/opa/v1/server/identifier"
)
// ClientCertificates returns the ClientCertificates of the caller associated with ctx.
func ClientCertificates(r *http.Request) ([]*x509.Certificate, bool) {
return v1.ClientCertificates(r)
}
// SetClientCertificates returns a new http.Request with the ClientCertificates set to v.
func SetClientCertificates(r *http.Request, v []*x509.Certificate) *http.Request {
return v1.SetClientCertificates(r, v)
}
+8
View File
@@ -0,0 +1,8 @@
// Copyright 2016 The OPA Authors. All rights reserved.
// Use of this source code is governed by an Apache2
// license that can be found in the LICENSE file.
// Deprecated: This package is intended for older projects transitioning from OPA v0.x and will remain for the lifetime of OPA v1.x, but its use is not recommended.
// For newer features and behaviours, such as defaulting to the Rego v1 syntax, use the corresponding components in the [github.com/open-policy-agent/opa/v1] package instead.
// See https://www.openpolicyagent.org/docs/latest/v0-compatibility/ for more information.
package identifier
+22
View File
@@ -0,0 +1,22 @@
// Copyright 2017 The OPA Authors. All rights reserved.
// Use of this source code is governed by an Apache2
// license that can be found in the LICENSE file.
// Package identifier provides handlers for associating identity information with incoming requests.
package identifier
import (
"net/http"
v1 "github.com/open-policy-agent/opa/v1/server/identifier"
)
// Identity returns the identity of the caller associated with ctx.
func Identity(r *http.Request) (string, bool) {
return v1.Identity(r)
}
// SetIdentity returns a new http.Request with the identity set to v.
func SetIdentity(r *http.Request, v string) *http.Request {
return v1.SetIdentity(r, v)
}
+19
View File
@@ -0,0 +1,19 @@
// Copyright 2019 The OPA Authors. All rights reserved.
// Use of this source code is governed by an Apache2
// license that can be found in the LICENSE file.
package identifier
import (
"net/http"
v1 "github.com/open-policy-agent/opa/v1/server/identifier"
)
// TLSBased extracts the CN of the client's TLS ceritificate
type TLSBased = v1.TLSBased
// NewTLSBased returns a new TLSBased object.
func NewTLSBased(inner http.Handler) *TLSBased {
return v1.NewTLSBased(inner)
}
+15
View File
@@ -0,0 +1,15 @@
package identifier
import (
"net/http"
v1 "github.com/open-policy-agent/opa/v1/server/identifier"
)
// TokenBased extracts Bearer tokens from the request.
type TokenBased = v1.TokenBased
// NewTokenBased returns a new TokenBased object.
func NewTokenBased(inner http.Handler) *TokenBased {
return v1.NewTokenBased(inner)
}
+65
View File
@@ -0,0 +1,65 @@
// Copyright 2016 The OPA Authors. All rights reserved.
// Use of this source code is governed by an Apache2
// license that can be found in the LICENSE file.
package server
import (
v1 "github.com/open-policy-agent/opa/v1/server"
)
// AuthenticationScheme enumerates the supported authentication schemes. The
// authentication scheme determines how client identities are established.
type AuthenticationScheme = v1.AuthenticationScheme
// Set of supported authentication schemes.
const (
AuthenticationOff = v1.AuthenticationOff
AuthenticationToken = v1.AuthenticationToken
AuthenticationTLS = v1.AuthenticationTLS
)
// AuthorizationScheme enumerates the supported authorization schemes. The authorization
// scheme determines how access to OPA is controlled.
type AuthorizationScheme = v1.AuthorizationScheme
// Set of supported authorization schemes.
const (
AuthorizationOff = v1.AuthorizationOff
AuthorizationBasic = v1.AuthorizationBasic
)
// Set of handlers for use in the "handler" dimension of the duration metric.
const (
PromHandlerV0Data = v1.PromHandlerV0Data
PromHandlerV1Data = v1.PromHandlerV1Data
PromHandlerV1Query = v1.PromHandlerV1Query
PromHandlerV1Policies = v1.PromHandlerV1Policies
PromHandlerV1Compile = v1.PromHandlerV1Compile
PromHandlerV1Config = v1.PromHandlerV1Config
PromHandlerV1Status = v1.PromHandlerV1Status
PromHandlerIndex = v1.PromHandlerIndex
PromHandlerCatch = v1.PromHandlerCatch
PromHandlerHealth = v1.PromHandlerHealth
PromHandlerAPIAuthz = v1.PromHandlerAPIAuthz
)
// Server represents an instance of OPA running in server mode.
type Server = v1.Server
// Metrics defines the interface that the server requires for recording HTTP
// handler metrics.
type Metrics = v1.Metrics
// TLSConfig represents the TLS configuration for the server.
// This configuration is used to configure file watchers to reload each file as it
// changes on disk.
type TLSConfig = v1.TLSConfig
// Loop will contain all the calls from the server that we'll be listening on.
type Loop = v1.Loop
// New returns a new Server.
func New() *Server {
return v1.New()
}
+8
View File
@@ -0,0 +1,8 @@
// Copyright 2016 The OPA Authors. All rights reserved.
// Use of this source code is governed by an Apache2
// license that can be found in the LICENSE file.
// Deprecated: This package is intended for older projects transitioning from OPA v0.x and will remain for the lifetime of OPA v1.x, but its use is not recommended.
// For newer features and behaviours, such as defaulting to the Rego v1 syntax, use the corresponding components in the [github.com/open-policy-agent/opa/v1] package instead.
// See https://www.openpolicyagent.org/docs/latest/v0-compatibility/ for more information.
package types
+245
View File
@@ -0,0 +1,245 @@
// Copyright 2016 The OPA Authors. All rights reserved.
// Use of this source code is governed by an Apache2
// license that can be found in the LICENSE file.
// Package types contains request/response types and codes for the server.
package types
import (
"github.com/open-policy-agent/opa/ast"
"github.com/open-policy-agent/opa/topdown"
v1 "github.com/open-policy-agent/opa/v1/server/types"
)
// Error codes returned by OPA's REST API.
const (
CodeInternal = v1.CodeInternal
CodeEvaluation = v1.CodeEvaluation
CodeUnauthorized = v1.CodeUnauthorized
CodeInvalidParameter = v1.CodeInvalidParameter
CodeInvalidOperation = v1.CodeInvalidOperation
CodeResourceNotFound = v1.CodeResourceNotFound
CodeResourceConflict = v1.CodeResourceConflict
CodeUndefinedDocument = v1.CodeUndefinedDocument
)
// ErrorV1 models an error response sent to the client.
type ErrorV1 = v1.ErrorV1
// NewErrorV1 returns a new ErrorV1 object.
func NewErrorV1(code, f string, a ...interface{}) *ErrorV1 {
return v1.NewErrorV1(code, f, a...)
}
// Messages included in error responses.
const (
MsgCompileModuleError = v1.MsgCompileModuleError
MsgParseQueryError = v1.MsgParseQueryError
MsgCompileQueryError = v1.MsgCompileQueryError
MsgEvaluationError = v1.MsgEvaluationError
MsgUnauthorizedUndefinedError = v1.MsgUnauthorizedUndefinedError
MsgUnauthorizedError = v1.MsgUnauthorizedError
MsgUndefinedError = v1.MsgUndefinedError
MsgMissingError = v1.MsgMissingError
MsgFoundUndefinedError = v1.MsgFoundUndefinedError
MsgPluginConfigError = v1.MsgPluginConfigError
MsgDecodingLimitError = v1.MsgDecodingLimitError
MsgDecodingGzipLimitError = v1.MsgDecodingGzipLimitError
)
// PatchV1 models a single patch operation against a document.
type PatchV1 = v1.PatchV1
// PolicyListResponseV1 models the response message for the Policy API list operation.
type PolicyListResponseV1 = v1.PolicyListResponseV1
// PolicyGetResponseV1 models the response message for the Policy API get operation.
type PolicyGetResponseV1 = v1.PolicyGetResponseV1
// PolicyPutResponseV1 models the response message for the Policy API put operation.
type PolicyPutResponseV1 = v1.PolicyPutResponseV1
// PolicyDeleteResponseV1 models the response message for the Policy API delete operation.
type PolicyDeleteResponseV1 = v1.PolicyDeleteResponseV1
// PolicyV1 models a policy module in OPA.
type PolicyV1 = v1.PolicyV1
// ProvenanceV1 models a collection of build/version information.
type ProvenanceV1 = v1.ProvenanceV1
// ProvenanceBundleV1 models a bundle at some point in time
type ProvenanceBundleV1 = v1.ProvenanceBundleV1
// DataRequestV1 models the request message for Data API POST operations.
type DataRequestV1 = v1.DataRequestV1
// DataResponseV1 models the response message for Data API read operations.
type DataResponseV1 = v1.DataResponseV1
// Warning models DataResponse warnings
type Warning = v1.Warning
// Warning Codes
const CodeAPIUsageWarn = v1.CodeAPIUsageWarn
// Warning Messages
const MsgInputKeyMissing = v1.MsgInputKeyMissing
// NewWarning returns a new Warning object
func NewWarning(code, message string) *Warning {
return v1.NewWarning(code, message)
}
// MetricsV1 models a collection of performance metrics.
type MetricsV1 = v1.MetricsV1
// QueryResponseV1 models the response message for Query API operations.
type QueryResponseV1 = v1.QueryResponseV1
// AdhocQueryResultSetV1 models the result of a Query API query.
type AdhocQueryResultSetV1 = v1.AdhocQueryResultSetV1
// ExplainModeV1 defines supported values for the "explain" query parameter.
type ExplainModeV1 = v1.ExplainModeV1
// Explanation mode enumeration.
const (
ExplainOffV1 ExplainModeV1 = v1.ExplainOffV1
ExplainFullV1 ExplainModeV1 = v1.ExplainFullV1
ExplainNotesV1 ExplainModeV1 = v1.ExplainNotesV1
ExplainFailsV1 ExplainModeV1 = v1.ExplainFailsV1
ExplainDebugV1 ExplainModeV1 = v1.ExplainDebugV1
)
// TraceV1 models the trace result returned for queries that include the
// "explain" parameter.
type TraceV1 = v1.TraceV1
// TraceV1Raw models the trace result returned for queries that include the
// "explain" parameter. The trace is modelled as series of trace events that
// identify the expression, local term bindings, query hierarchy, etc.
type TraceV1Raw = v1.TraceV1Raw
// TraceV1Pretty models the trace result returned for queries that include the "explain"
// parameter. The trace is modelled as a human readable array of strings representing the
// evaluation of the query.
type TraceV1Pretty = v1.TraceV1Pretty
// NewTraceV1 returns a new TraceV1 object.
func NewTraceV1(trace []*topdown.Event, pretty bool) (result TraceV1, err error) {
return v1.NewTraceV1(trace, pretty)
}
// TraceEventV1 represents a step in the query evaluation process.
type TraceEventV1 = v1.TraceEventV1
// BindingsV1 represents a set of term bindings.
type BindingsV1 = v1.BindingsV1
// BindingV1 represents a single term binding.
type BindingV1 = v1.BindingV1
// NewBindingsV1 returns a new BindingsV1 object.
func NewBindingsV1(locals *ast.ValueMap) (result []*BindingV1) {
return v1.NewBindingsV1(locals)
}
// CompileRequestV1 models the request message for Compile API operations.
type CompileRequestV1 = v1.CompileRequestV1
// CompileResponseV1 models the response message for Compile API operations.
type CompileResponseV1 = v1.CompileResponseV1
// PartialEvaluationResultV1 represents the output of partial evaluation and is
// included in Compile API responses.
type PartialEvaluationResultV1 = v1.PartialEvaluationResultV1
// QueryRequestV1 models the request message for Query API operations.
type QueryRequestV1 = v1.QueryRequestV1
// ConfigResponseV1 models the response message for Config API operations.
type ConfigResponseV1 = v1.ConfigResponseV1
// StatusResponseV1 models the response message for Status API (pull) operations.
type StatusResponseV1 = v1.StatusResponseV1
// HealthResponseV1 models the response message for Health API operations.
type HealthResponseV1 = v1.HealthResponseV1
const (
// ParamQueryV1 defines the name of the HTTP URL parameter that specifies
// values for the request query.
ParamQueryV1 = v1.ParamQueryV1
// ParamInputV1 defines the name of the HTTP URL parameter that specifies
// values for the "input" document.
ParamInputV1 = v1.ParamInputV1
// ParamPrettyV1 defines the name of the HTTP URL parameter that indicates
// the client wants to receive a pretty-printed version of the response.
ParamPrettyV1 = v1.ParamPrettyV1
// ParamExplainV1 defines the name of the HTTP URL parameter that indicates the
// client wants to receive explanations in addition to the result.
ParamExplainV1 = v1.ParamExplainV1
// ParamMetricsV1 defines the name of the HTTP URL parameter that indicates
// the client wants to receive performance metrics in addition to the
// result.
ParamMetricsV1 = v1.ParamMetricsV1
// ParamInstrumentV1 defines the name of the HTTP URL parameter that
// indicates the client wants to receive instrumentation data for
// diagnosing performance issues.
ParamInstrumentV1 = v1.ParamInstrumentV1
// ParamProvenanceV1 defines the name of the HTTP URL parameter that indicates
// the client wants build and version information in addition to the result.
ParamProvenanceV1 = v1.ParamProvenanceV1
// ParamBundleActivationV1 defines the name of the HTTP URL parameter that
// indicates the client wants to include bundle activation in the results
// of the health API.
// Deprecated: Use ParamBundlesActivationV1 instead.
ParamBundleActivationV1 = v1.ParamBundleActivationV1
// ParamBundlesActivationV1 defines the name of the HTTP URL parameter that
// indicates the client wants to include bundle activation in the results
// of the health API.
ParamBundlesActivationV1 = v1.ParamBundlesActivationV1
// ParamPluginsV1 defines the name of the HTTP URL parameter that
// indicates the client wants to include bundle status in the results
// of the health API.
ParamPluginsV1 = v1.ParamPluginsV1
// ParamExcludePluginV1 defines the name of the HTTP URL parameter that
// indicates the client wants to exclude plugin status in the results
// of the health API for the specified plugin(s)
ParamExcludePluginV1 = v1.ParamExcludePluginV1
// ParamStrictBuiltinErrors names the HTTP URL parameter that indicates the client
// wants built-in function errors to be treated as fatal.
ParamStrictBuiltinErrors = v1.ParamStrictBuiltinErrors
)
// BadRequestErr represents an error condition raised if the caller passes
// invalid parameters.
type BadRequestErr = v1.BadRequestErr
// BadPatchOperationErr returns BadRequestErr indicating the patch operation was
// invalid.
func BadPatchOperationErr(op string) error {
return v1.BadPatchOperationErr(op)
}
// BadPatchPathErr returns BadRequestErr indicating the patch path was invalid.
func BadPatchPathErr(path string) error {
return v1.BadPatchPathErr(path)
}
// IsBadRequest returns true if err is a BadRequestErr.
func IsBadRequest(err error) bool {
return v1.IsBadRequest(err)
}
+8
View File
@@ -0,0 +1,8 @@
// Copyright 2016 The OPA Authors. All rights reserved.
// Use of this source code is governed by an Apache2
// license that can be found in the LICENSE file.
// Deprecated: This package is intended for older projects transitioning from OPA v0.x and will remain for the lifetime of OPA v1.x, but its use is not recommended.
// For newer features and behaviours, such as defaulting to the Rego v1 syntax, use the corresponding components in the [github.com/open-policy-agent/opa/v1] package instead.
// See https://www.openpolicyagent.org/docs/latest/v0-compatibility/ for more information.
package writer
+56
View File
@@ -0,0 +1,56 @@
// Copyright 2017 The OPA Authors. All rights reserved.
// Use of this source code is governed by an Apache2
// license that can be found in the LICENSE file.
// Package writer contains utilities for writing responses in the server.
package writer
import (
"net/http"
"github.com/open-policy-agent/opa/v1/server/types"
v1 "github.com/open-policy-agent/opa/v1/server/writer"
)
// HTTPStatus is used to set a specific status code
// Adapted from https://stackoverflow.com/questions/27711154/what-response-code-to-return-on-a-non-supported-http-method-on-rest
func HTTPStatus(code int) http.HandlerFunc {
return v1.HTTPStatus(code)
}
// ErrorAuto writes a response with status and code set automatically based on
// the type of err.
func ErrorAuto(w http.ResponseWriter, err error) {
v1.ErrorAuto(w, err)
}
// ErrorString writes a response with specified status, code, and message set to
// the err's string representation.
func ErrorString(w http.ResponseWriter, status int, code string, err error) {
v1.ErrorString(w, status, code, err)
}
// Error writes a response with specified status and error response.
func Error(w http.ResponseWriter, status int, err *types.ErrorV1) {
v1.Error(w, status, err)
}
// JSON writes a response with the specified status code and object. The object
// will be JSON serialized.
// Deprecated: This method is problematic when using a non-200 status `code`: if
// encoding the payload fails, it'll print "superfluous call to WriteHeader()"
// logs.
func JSON(w http.ResponseWriter, code int, v interface{}, pretty bool) {
v1.JSON(w, code, v, pretty)
}
// JSONOK is a helper for status "200 OK" responses
func JSONOK(w http.ResponseWriter, v interface{}, pretty bool) {
v1.JSONOK(w, v, pretty)
}
// Bytes writes a response with the specified status code and bytes.
// Deprecated: Unused in OPA, will be removed in the future.
func Bytes(w http.ResponseWriter, code int, bs []byte) {
v1.Bytes(w, code, bs)
}