MatchesEvaluation evaluates the matches_evaluation rule in a rego policy. Creates an input object with expected parameters and policy violations.
(ctx context.Context, policy *engine.Policy, violations []string, expectedParams map[string]string)
| 398 | // MatchesEvaluation evaluates the matches_evaluation rule in a rego policy. |
| 399 | // Creates an input object with expected parameters and policy violations. |
| 400 | func (r *Engine) MatchesEvaluation(ctx context.Context, policy *engine.Policy, violations []string, expectedParams map[string]string) (bool, error) { |
| 401 | policyString := string(policy.Source) |
| 402 | parsedModule, err := ast.ParseModule(policy.Name, policyString) |
| 403 | if err != nil { |
| 404 | return false, fmt.Errorf("failed to parse rego policy: %w", err) |
| 405 | } |
| 406 | |
| 407 | // Create input expected parameters and policy violations |
| 408 | inputMap := make(map[string]interface{}) |
| 409 | if expectedParams == nil { |
| 410 | inputMap[expectedArgs] = map[string]string{} |
| 411 | } else { |
| 412 | inputMap[expectedArgs] = expectedParams |
| 413 | } |
| 414 | if violations == nil { |
| 415 | inputMap[violationsResult] = []string{} |
| 416 | } else { |
| 417 | inputMap[violationsResult] = violations |
| 418 | } |
| 419 | decodedInput := r.injectProjectMetadata(inputMap) |
| 420 | |
| 421 | // Evaluate matches_evaluation rule |
| 422 | matchesEvaluation, found, err := r.evaluateMatchingRule(ctx, getRuleName(parsedModule.Package.Path, matchesEvaluationRule), parsedModule, decodedInput) |
| 423 | if err != nil { |
| 424 | return false, err |
| 425 | } |
| 426 | if !found { |
| 427 | // Rule not found, defaults to true |
| 428 | return true, nil |
| 429 | } |
| 430 | |
| 431 | return matchesEvaluation, nil |
| 432 | } |
| 433 | |
| 434 | // Evaluates a single rule and returns its boolean result |
| 435 | func (r *Engine) evaluateMatchingRule(ctx context.Context, ruleName string, parsedModule *ast.Module, decodedInput interface{}) (result bool, found bool, err error) { |