`contains` provides an alternative way to declare partial sets:
p contains x {
x := { "foo": "bar"
}
which is the same as
p[x] {
x := { "foo": "bar"
}
The keyword is enabled by importing `future.keywords.contains`, and
when it _is enabled_, the format will be used for all partial sets in
that file for pretty-printing.
`if` is a new keyword allowing for more readable rule definitions:
The syntax is
NAME [if] { EXPR [EXPR...] }
and the is a shorthand allows dropping the braces around the expression
if there is only one:
NAME if EXPR
For example, this allows expressions like
allow if not deny
f(xs) if every x in xs { x != "foo" }
The one exception here are partial sets: they cannot use `if` UNLESS
they use `contains`:
p[x] { x := "foo" } # valid
p contains x { x := "bar" } # valid
p contains x if { x := "bar" } # valid
p[x] if { x := "foo" } # invalid
This is because we want to interpret that differently (as an object
rule defining `p.foo = true`) in the near future.
The formatter works in the same way: if `future.keywords.if` is imported, it
will be used where it can be used.
We don't want to be too eager when it comes to introducing syntactic sugar.
So this will be rewritten, because head and body expression are on the same
line:
p := 5 if { time.day_of_week() == "Monday" }
# => p := 5 if time.day_of_week() == "Monday"
but this won't:
p := 5 if {
time.day_of_week() == "Monday"
}
The rationale here is that if the policy author decided that they want this on
an extra line, we won't mess with it.
This also sidesteps the need to check if both the head and the single body
expression have a comment.
This change includes various docs updates. Notable exceptions are the GK docs,
since it will take a while for these keywords to be come available there; and
the frontpage: merging a PR would update the frontpage immediately, and we
don't want to show something there that isn't available in the latest release.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
This commit vendors in github.com/vektah/gqlparser, and provides the
implementation for the following graphql built-ins:
- graphql.parse
- graphql.parse_and_verify
- graphql.parse_query
- graphql.parse_schema
- graphql.is_valid
The test suite is comprised of the classic "Star Wars" examples from the
official GraphQL docs, along with a host of syntax examples ported over
from the underlying GraphQL parser's test suite.
AST objects returned by the parse_x APIs are currently pruned for brevity.
Fixes#4283
Signed-off-by: Philip Conrad <philipaconrad@gmail.com>
This commit adds support for named argument declarations for built-in
functions as well as additional metadata/annotations on built-in
functions (e.g., descriptions, categories, etc.) This commit allows us
to generate a data file (builtin_metadata.json) that other tools can
consume to improve the Rego authoring experience.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
Co-authored-by: Torin Sandall <torinsandall@gmail.com>
This function works on all base decimal and binary SI units of the set:
m, K/Ki, M/Mi, G/Gi, T/Ti, P/Pi, and E/Ei
Note: Unlike `units.parse_bytes`, this function is case sensitive.
Fixes open-policy-agent#1802.
Signed-off-by: Philip Conrad <philipaconrad@gmail.com>
There are no default prefixes in IPv6, so if an IPv6 without a prefix is fed into
net.cidr_merge, we'll return a non-halt error now.
Before, we'd fail in various ways if a prefix-less IPv6 was fed into
`net.cidr_merge`. With only one, we'd return `[ "<nil>" ]`, with two,
we'd panic.
Fixes#4596.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
New functions:
* rego.metadata.chain(): returns the chain of metadata, starting from the active rule, going outward
* rego.metadata.rule(): returns the metadata for the active rule
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
This is similar to what we currently do for application/json responses, or when
force_json_decode is set to true: We parse the result, and according to how it's
configured, cache either the serialised or deserialised content.
Now, we'll also take care of yaml-related content-types, application/yaml and
application/x-yaml; and enable forcing yaml-decoding via force_yaml_decode.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
This commit extends the go and wasm implementations of object.get to
allow a key to also be an array.
When passed an array, each element in the array will be used as a key in
turn. This allows values at deeply nested paths to be extracted from
objects.
It also supports getting indexes of nested arrays.
The functionality was originally inspired by Ruby's Hash.dig function:
https://ruby-doc.org/core-2.3.0_preview1/Hash.html#method-i-dig however
we opted to include the behavior in object.get instead after being
uncertain 'dig' was a commonly understood name.
Signed-off-by: Charlie Egan <charlieegan3@users.noreply.github.com>
This new built-in functionality allows callers to find all reachable
paths in a graph based on an array or set of root nodes. See the
updates to policy-reference.md for more details and usage information.
Signed-off-by: Justin Lindh <justin.lindh@webfilings.com>
wasm: Add support for WASM and simple tests.
internal: Add opa_json_is_valid to map of wasm built-ins.
docs: Indicate that WASM support is now available for json.is_valid.
Fixes#4140
Signed-off-by: Kristian Svalland <kristian.svalland@gmail.com>
The function `array.reverse` takes an array as an argument, and returns an array with a reversed order of elements.
The function `strings.reverse` takes a string as an argument, and returns a string with a reversed order of unicode code points.
WASM support is included for both built-ins.
Fixes#3736
Signed-off-by: Kristian Svalland <kristian.svalland@gmail.com>
* topdown: Fixing nanos int overflow issue for time.* built-in functions
The go Time.UnixNano() function result is undefined for dates that
cannot fit into an int64 when converted to Unix time in nanoseconds.
Updating built-in functions to return error if date is too low/high.
Fixes: #4098
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
Add crypto.hmac.* built-in functions for the MD5, SHA-1, SHA-256 and SHA-512 hashing algorithms.
Add documentation for how to contribute new built-in functions.
Fixes: #1740
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
Now that we support urlquery.decode_object the associated issue can
closed with this fix of the description (i.e., don't use the term
"serialize" in this context.)
Fixes#1592
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Since the golang stdlib function doesn't do any caching, we add the result
to the BuiltinContext.Cache so it's cached, and consistent, within a single
policy evaluation.
There is no decision made here about using netgo or netcgo: we're following
suit wrt how golang expects you to do it: From my understanding, using the
OS means for DNS resolution is the preferred way: it gives you per-host
caching, and it allows the user to affect how DNS resolution works in many
ways.
This means the same logic that applies to all other places where we resolve
domain names into addresses (notably `http.send`) applies to this built-in,
too.
Also:
* workflow/pull_request: don't fail-fast for matrix jobs
Even if one platform fails it would be interesting to see what happens
on the others.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
* website: bump hugo, updated templates
For some reason, the "and" trick to step around undefined values no longer
worked. So now, we're wrapping {{ if }} conditionals instead: the outer one
checks that the value is defined, the inner one asserts something on its
value.
* live-blocks/preprocess: add wrapper div, remove newline
Somewhere between 0.55 and the most recent version, Hugo stopped emitting
that div on purpose for languages it didn't know.
Since we depend on it for further processing, we're adding it back.
Also, a trailing newline for code elements was introduced, and that broke
our codemirrors integration -- every code entry would be folllowed by an
empty line. Now, we're removing that in the same preprocess step.
* website: fix info|danger blocks
* website/config: trust markdown to include html
Fixes#3787.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
This will help users for JWT signing using RSA key, because currently
OPA only accepts RSA key in the JWK format.
Fixes: #3765
Signed-off-by: cris-he <cruztiempo@hotmail.com>
This commit adds a new parameter to http.send to
control how items are added to the inter-query cache.
Currently two modes are supported which allow users
to decide if they prefer cache memory conservation or low
latency during cache lookups.
Fixes#3599
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
This commit combines a few improvements to the rand.intn
implementation:
* Zero and negative integers do not cause an error. In most cases, we
try to make built-in functions return sensible results (rather than
halting evaluation or being undefined.) In this case, it's easy
enough to handle zero and negative integers.
* Use the built-in context seed to generate the source for the rand
call. This helps ensure that rand.intn calls can be reproduced and
ensures that (by default) numbers genreated by rand.intn differ
across runs.
* Use dedicated cache key type instead of overloading uuidCachingKey.
* Add test coverage for caching, partial eval, etc.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
This allows users to supply a certificate chain and verify that the leaf
certificate has a path back to the supplied root.
Fixes#3601.
Signed-off-by: James Alseth <james@jalseth.me>
This commit changes the default of `tls_use_system_certs`
parameter for `http.send` from `false` to `true`
Fixes#2271
Signed-off-by: Olamide Omolola <omololaolamidex@gmail.com>
Fixup to commit 5c213e5
Signed-off-by: Olamide Omolola <omololaolamidex@gmail.com>
Fixed variables name changes as suggested by @anderseknert
Signed-off-by: Olamide Omolola <omololaolamidex@gmail.com>
Amended test as suggested by @srenatus
Signed-off-by: Olamide Omolola <omololaolamidex@gmail.com>
This built-in function makes it possible to get the absolute
difference between to unix timestamps (nanoseconds since epoch)
on the format [year, month, day, hour, minute, second].
Fixes: #3348
Signed-off-by: Andre Håland <andre.haland@gmail.com>
Since there are better ways of doing what they do and they tend to confuse
people new to Rego we'll hide these from the policy reference for now. Will
eventually be deprecated and removed with issue #2437.
Signed-off-by: Anders Eknert <anders@eknert.com>
Stephan Renatus