Method CheckPolicy

policy/validate.go:226–365

(ctx context.Context, req *policysession.CheckPolicyRequest)

}

func (p *Policy) CheckPolicy(ctx context.Context, req *policysession.CheckPolicyRequest) (*policysession.DecisionResponse, *gwpb.ResolveSourceMetaRequest, error) {
	if req.Source == nil || req.Source.Source == nil {
		return nil, nil, errors.Errorf("no source info in request")
	}

	var platform *ocispecs.Platform
	if req.Platform != nil {
		pl, err := platformFromReq(req)
		if err != nil {
			return nil, nil, err
		}
		platform = pl
	} else {
		platform = p.opt.DefaultPlatform
	}

	inp, err := SourceToInput(ctx, p.opt.VerifierProvider, req.Source, platform, p.opt.Log)
	if err != nil {
		return nil, nil, errors.Wrap(err, "failed to build policy input")
	}

	baseOpts, closeRoot, err := p.regoBaseOpts()
	if err != nil {
		return nil, nil, err
	}
	defer closeRoot()

	p.log(logrus.InfoLevel, "checking policy for source %s", sourceName(req))

	for range maxResolveIterations {
		runInput := inp
		applyEnvWithDepth(&runInput, p.opt.Env, 0)

		runOpts := append([]func(*rego.Rego){}, baseOpts...)
		runOpts = append(runOpts, rego.Input(runInput))

		st := &state{Input: runInput}
		for _, f := range p.funcs {
			runOpts = append(runOpts, f.impl(st))
		}

		dt, err := json.MarshalIndent(runInput, "", "  ")
		if err != nil {
			return nil, nil, errors.Wrapf(err, "failed to marshal policy input")
		}
		p.log(logrus.DebugLevel, "policy input: %s", dt)

		unknowns := inp.Unknowns()
		if len(unknowns) > 0 {
			p.log(logrus.DebugLevel, "unknowns for policy evaluation: %+v", summarizeUnknownsForLog(unknowns))
			runOpts = append(runOpts, rego.Unknowns(unknowns))
		}
		r := rego.New(runOpts...)

		if len(unknowns) > 0 {
			pq, err := r.Partial(ctx)
			if err != nil {
				return nil, nil, err