mirror of
https://github.com/open-policy-agent/opa.git
synced 2026-08-12 19:32:48 -06:00
Sebastian Spaink
40dd2b90d2
Follow-up to #8900. Moves the gzip encoding and decoding config validation off the Go `validateAndInjectDefaults` methods and onto embedded Rego policies, injecting defaults and reporting value errors. Each config registers its recognized options via `config.RegisterConfigSpec` so unknown-option warnings live with the owning struct. Field type validation stays in the Go decode step. --------- Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>
46 lines
1.4 KiB
Rego
46 lines
1.4 KiB
Rego
# METADATA
|
|
# description: |
|
|
# Helpers shared by the embedded configuration validation policies. Compiled
|
|
# into every configpolicy.Policy, so a policy can import data.opa.config.util
|
|
# instead of carrying its own copy of these rules.
|
|
#
|
|
# The helpers read the raw configuration from input.config, the part of the
|
|
# input document every validation policy is given.
|
|
package opa.config.util
|
|
|
|
# METADATA
|
|
# description: the configured value at path, or null when the option is absent.
|
|
value(path) := object.get(input.config, path, null)
|
|
|
|
# METADATA
|
|
# description: |
|
|
# true when the option at path is missing or explicitly null, the cases where a
|
|
# default is injected, matching the pre-Rego behavior where a nil pointer was
|
|
# replaced with a default.
|
|
absent(path) if value(path) == null
|
|
|
|
# METADATA
|
|
# description: |
|
|
# true when the option at path is present but not an object. The shape of an
|
|
# option holding an object has to be checked in the policy rather than left to
|
|
# the Go unmarshal: the default patches would otherwise be merged over the bad
|
|
# value, silently replacing it with a well-formed object.
|
|
not_object(path) if {
|
|
v := value(path)
|
|
v != null
|
|
not is_object(v)
|
|
}
|
|
|
|
# METADATA
|
|
# description: true when the option at path is present but not a number above zero.
|
|
not_positive_number(path) if {
|
|
v := value(path)
|
|
v != null
|
|
not _positive_number(v)
|
|
}
|
|
|
|
_positive_number(v) if {
|
|
is_number(v)
|
|
v > 0
|
|
}
|