| 498 | } |
| 499 | |
| 500 | func TestRego_CustomBuiltin(t *testing.T) { |
| 501 | // Create a custom built-in for testing |
| 502 | require.NoError(t, builtins.Register(&ast.Builtin{ |
| 503 | Name: "test.restrictive_func", |
| 504 | Decl: types.NewFunction(types.Args(types.S), types.S), |
| 505 | }, func(_ topdown.BuiltinContext, _ []*ast.Term, iter func(*ast.Term) error) error { |
| 506 | return iter(ast.StringTerm("test_value")) |
| 507 | })) |
| 508 | |
| 509 | regoContent := []byte(`package test |
| 510 | import rego.v1 |
| 511 | |
| 512 | result := { |
| 513 | "violations": violations, |
| 514 | "skipped": false |
| 515 | } |
| 516 | |
| 517 | violations contains msg if { |
| 518 | val := test.restrictive_func("input") |
| 519 | val != "test_value" |
| 520 | msg := "Value mismatch" |
| 521 | }`) |
| 522 | |
| 523 | t.Run("custom restrictive builtin works in restrictive mode", func(t *testing.T) { |
| 524 | // Create engine |
| 525 | r := NewEngine() |
| 526 | policy := &engine.Policy{ |
| 527 | Name: "test", |
| 528 | Source: regoContent, |
| 529 | } |
| 530 | |
| 531 | result, err := r.Verify(context.TODO(), policy, []byte(`{"kind": "test"}`), nil) |
| 532 | require.NoError(t, err) |
| 533 | assert.False(t, result.Skipped) |
| 534 | assert.Len(t, result.Violations, 0) |
| 535 | }) |
| 536 | } |
| 537 | |
| 538 | func TestRego_InjectProjectMetadataIntoInput(t *testing.T) { |
| 539 | // Policy raises a violation per project field that is missing or unequal to |