Function loadPolicyScript

pkg/policies/policies.go:1102–1140

(spec *v1.PolicySpecV2, basePath string)

}

func loadPolicyScript(spec *v1.PolicySpecV2, basePath string) ([]byte, error) {
	var content []byte
	var err error
	switch source := spec.GetSource().(type) {
	case *v1.PolicySpecV2_Embedded:
		content = []byte(source.Embedded)
	case *v1.PolicySpecV2_Ref:
		// New ref field with relative URL resolution
		scriptPath, err := resolveReference(source.Ref, basePath)
		if err != nil {
			return nil, fmt.Errorf("resolving policy reference: %w", err)
		}
		content, err = blob.LoadFileOrURL(scriptPath)
		if err != nil {
			return nil, fmt.Errorf("loading policy content: %w", err)
		}
	case *v1.PolicySpecV2_Path:
		// Deprecated: kept for backward compatibility
		var scriptPath string
		// If the path is a URL, use it directly. Otherwise, resolve it relative to basePath
		if isURLPath(source.Path) {
			scriptPath = source.Path
		} else {
			// path relative to policy folder
			scriptPath = filepath.Join(filepath.Dir(basePath), source.Path)
		}
		content, err = blob.LoadFileOrURL(scriptPath)
		if err != nil {
			return nil, fmt.Errorf("loading policy content: %w", err)
		}
	default:
		return nil, fmt.Errorf("policy spec is empty")
	}

	// Decode base64 if this is a base64-encoded WASM policy
	content = decodeIfBase64Wasm(content)

	return content, nil
}

func loadLegacyPolicyScript(spec *v1.PolicySpec, basePath string) ([]byte, error) {
	// legacy policies