mirror of
https://github.com/open-policy-agent/opa.git
synced 2026-08-12 19:32:48 -06:00
Torin Sandall
b2f5e70fcd
In the past, topdown would bind set[x] to true. This resulted in confusion when people attempted to write joins with set elements. With this change, topdown treats sets like objects/arrays, except that set[x] is bound to x. This allows users to write queries that dereference sets just like objects and arrays. Also, fix handling of self-joins where previously a recursive binding could be added. The "self-join" test case was added to cover this. Fixes #243
79 lines
1.8 KiB
Go
79 lines
1.8 KiB
Go
// Copyright 2017 The OPA Authors. All rights reserved.
|
|
// Use of this source code is governed by an Apache2
|
|
// license that can be found in the LICENSE file.
|
|
|
|
package topdown
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
"github.com/open-policy-agent/opa/ast"
|
|
)
|
|
|
|
// Error is the error type returned by the Eval and Query functions when
|
|
// an evaluation error occurs.
|
|
type Error struct {
|
|
Code int
|
|
Message string
|
|
Location *ast.Location
|
|
}
|
|
|
|
const (
|
|
|
|
// InternalErr represents an unknown evaluation error.
|
|
InternalErr = iota
|
|
|
|
// ConflictErr indicates a conflict was encountered during evaluation. For
|
|
// instance, a conflict occurs if a rule produces multiple, differing values
|
|
// for the same key in an object. Conflict errors indicate the policy does
|
|
// not account for the data loaded into the policy engine.
|
|
ConflictErr = iota
|
|
|
|
// TypeErr indicates evaluation stopped because an expression was applied to
|
|
// a value of an inappropriate type.
|
|
TypeErr = iota
|
|
)
|
|
|
|
func (e *Error) Error() string {
|
|
|
|
msg := fmt.Sprintf("evaluation error (code: %v): %v", e.Code, e.Message)
|
|
|
|
if e.Location != nil {
|
|
msg = e.Location.String() + ": " + msg
|
|
}
|
|
|
|
return msg
|
|
}
|
|
|
|
func completeDocConflictErr(loc *ast.Location) error {
|
|
return &Error{
|
|
Code: ConflictErr,
|
|
Location: loc,
|
|
Message: "completely defined rules must produce exactly one value",
|
|
}
|
|
}
|
|
|
|
func objectDocKeyConflictErr(loc *ast.Location) error {
|
|
return &Error{
|
|
Code: ConflictErr,
|
|
Location: loc,
|
|
Message: "partial rule definitions must produce exactly one value per object key",
|
|
}
|
|
}
|
|
|
|
func unsupportedBuiltinErr(loc *ast.Location) error {
|
|
return &Error{
|
|
Code: InternalErr,
|
|
Location: loc,
|
|
Message: "unsupported built-in",
|
|
}
|
|
}
|
|
|
|
func objectDocKeyTypeErr(loc *ast.Location) error {
|
|
return &Error{
|
|
Code: TypeErr,
|
|
Location: loc,
|
|
Message: "partial rule definitions must produce string values for object keys",
|
|
}
|
|
}
|