Function LoadPolicyScriptsFromSpec

pkg/policies/policies.go:991–1033

LoadPolicyScriptsFromSpec loads all policy script that matches a given material type. It matches if: * the policy kind is unspecified, meaning that it was forced by name selector * the policy kind is specified, and it's equal to the material type

(policy *v1.Policy, kind v1.CraftingSchema_Material_MaterialType, basePath string)

// * the policy kind is unspecified, meaning that it was forced by name selector
// * the policy kind is specified, and it's equal to the material type
func LoadPolicyScriptsFromSpec(policy *v1.Policy, kind v1.CraftingSchema_Material_MaterialType, basePath string) ([]*engine.Policy, error) {
	scripts := make([]*engine.Policy, 0)

	if policy.GetSpec().GetSource() != nil {
		script, err := loadLegacyPolicyScript(policy.GetSpec(), basePath)
		if err != nil {
			return nil, fmt.Errorf("failed to load policy script: %w", err)
		}

		// Inject boilerplate only for Rego policies, not WASM
		if engine.DetectPolicyType(script) == engine.PolicyTypeRego {
			script, err = rego.InjectBoilerplate(script, policy.GetMetadata().GetName())
			if err != nil {
				return nil, fmt.Errorf("failed to inject boilerplate: %w", err)
			}
		}

		scripts = append(scripts, &engine.Policy{Source: script, Name: policy.GetMetadata().GetName()})
	} else {
		// multi-kind policies
		specs := policy.GetSpec().GetPolicies()
		for _, spec := range specs {
			if spec.GetKind() == v1.CraftingSchema_Material_MATERIAL_TYPE_UNSPECIFIED || spec.GetKind() == kind {
				script, err := loadPolicyScript(spec, basePath)
				if err != nil {
					return nil, fmt.Errorf("failed to load policy script: %w", err)
				}

				// Inject boilerplate only for Rego policies, not WASM
				if engine.DetectPolicyType(script) == engine.PolicyTypeRego {
					script, err = rego.InjectBoilerplate(script, policy.GetMetadata().GetName())
					if err != nil {
						return nil, fmt.Errorf("failed to inject boilerplate: %w", err)
					}
				}

				scripts = append(scripts, &engine.Policy{Source: script, Name: policy.GetMetadata().GetName()})
			}
		}
	}

	return scripts, nil
}

// decodeIfBase64Wasm checks if content is base64-encoded WASM and decodes it.
// Returns the original content if it's not base64 or not WASM after decoding.