Method Capabilities

pkg/policies/engine/rego/rego.go:304–341

Capabilities returns the capabilities of the environment based on the mode of operation defaulting to EnvironmentModeRestrictive if not provided.

()

// Capabilities returns the capabilities of the environment based on the mode of operation
// defaulting to EnvironmentModeRestrictive if not provided.
func (r *Engine) Capabilities() *ast.Capabilities {
	capabilities := ast.CapabilitiesForThisVersion()
	var enabledBuiltin []*ast.Builtin

	switch r.operatingMode {
	case EnvironmentModeRestrictive:
		// Copy all builtins functions
		localBuiltIns := make(map[string]*ast.Builtin, len(ast.BuiltinMap))
		maps.Copy(localBuiltIns, ast.BuiltinMap)

		// remove custom builtins self-declared non-restrictive
		for k, builtin := range localBuiltIns {
			if slices.Contains(builtin.Categories, builtins.NonRestrictiveBuiltin) {
				delete(localBuiltIns, k)
			}
		}

		// Remove not allowed builtins
		for _, notAllowed := range builtinFuncNotAllowed {
			delete(localBuiltIns, notAllowed.Name)
		}

		// Convert map to slice
		enabledBuiltin = make([]*ast.Builtin, 0, len(localBuiltIns))
		for _, builtin := range localBuiltIns {
			enabledBuiltin = append(enabledBuiltin, builtin)
		}

		// Allow specific network domains
		capabilities.AllowNet = r.AllowedHostnames

	case EnvironmentModePermissive:
		enabledBuiltin = capabilities.Builtins
	}

	capabilities.Builtins = enabledBuiltin
	return capabilities
}

func regoResultSetToRawResults(res rego.ResultSet) map[string]interface{} {
	raw := make(map[string]interface{})