Method evaluateMatchingRule

pkg/policies/engine/rego/rego.go:435–463

Evaluates a single rule and returns its boolean result

(ctx context.Context, ruleName string, parsedModule *ast.Module, decodedInput interface{})

// Evaluates a single rule and returns its boolean result
func (r *Engine) evaluateMatchingRule(ctx context.Context, ruleName string, parsedModule *ast.Module, decodedInput interface{}) (result bool, found bool, err error) {
	// Add input
	regoInput := rego.Input(decodedInput)

	// Add module
	regoFunc := rego.ParsedModule(parsedModule)
	options := []func(r *rego.Rego){regoInput, regoFunc, rego.Capabilities(r.Capabilities())}

	if r.operatingMode == EnvironmentModeRestrictive {
		options = append(options, rego.StrictBuiltinErrors(true))
	}

	res, err := queryRego(ctx, ruleName, options...)
	if err != nil {
		return false, false, err
	}

	// Parse the boolean result
	for _, exp := range res {
		for _, val := range exp.Expressions {
			if boolResult, ok := val.Value.(bool); ok {
				return boolResult, true, nil
			}
		}
	}

	// Rule not found or returns non bool value
	return false, false, nil
}