evaluator

type CELErrorLogLevel string

type CELErrors struct {
	// contains filtered or unexported fields
}

type CheckOpt func(*CheckOptions)

type CheckOptions struct {
	TracerSink tracer.Sink
	EvalParams EvalParams
}

type Conf struct {
	// Globals are environment-specific variables to be made available to policy conditions.
	Globals map[string]any `yaml:"globals" conf:",example={\"environment\": \"staging\"}"`
	// DefaultPolicyVersion defines what version to assume if the request does not specify one.
	DefaultPolicyVersion string `yaml:"defaultPolicyVersion" conf:",example=\"default\""`
	// DefaultScope defines what scope to assume if the request does not specify one.
	DefaultScope string `yaml:"defaultScope" conf:",example=\"\""`
	// CELErrorLogLevel is the level at which CEL runtime errors raised during policy evaluation are logged. Valid values are none, debug, info, warn (default) and error.
	CELErrorLogLevel CELErrorLogLevel `yaml:"celErrorLogLevel" conf:",example=warn"`
	// LenientScopeSearch configures the engine to ignore missing scopes and search upwards through the scope tree until it finds a usable policy.
	LenientScopeSearch bool `yaml:"lenientScopeSearch" conf:",example=false"`
	// StrictEvaluation denies the affected action when an error is raised during policy evaluation, instead of ignoring the erroring rule.
	StrictEvaluation bool `yaml:"strictEvaluation" conf:",example=false"`
	// PolicyLoaderTimeout is the timeout for loading policies from the policy store.
	PolicyLoaderTimeout time.Duration `yaml:"policyLoaderTimeout" conf:",example=2s"`
	NumWorkers          uint          `yaml:"numWorkers" conf:",ignore"`
}

type EvalParams struct {
	Globals              map[string]any
	NowFunc              conditions.NowFunc
	DefaultPolicyVersion string
	DefaultScope         string
	CELErrorLogLevel     CELErrorLogLevel
	LenientScopeSearch   bool
	StrictEvaluation     bool
}

type Evaluator interface {
	Check(context.Context, []*enginev1.CheckInput, ...CheckOpt) ([]*enginev1.CheckOutput, error)
	Plan(context.Context, *enginev1.PlanResourcesInput, ...CheckOpt) (*enginev1.PlanResourcesOutput, error)
}

type StrictEvaluationError struct {
	Err        error
	Expression string
}