Fixes #24380: Rename policy_mode to policy_mode_override

policies/rudder-commons/src/lib.rs

@@ -309,7 +309,7 @@ impl PolicyMode {
         String::deserialize(deserializer).and_then(|string| match string.as_ref() {
             "enforce" => Ok(Some(PolicyMode::Enforce)),
             "audit" => Ok(Some(PolicyMode::Audit)),
-            "default" => Ok(None),
+            "none" => Ok(None),
             _ => Err(Error::custom(format!(
                 "Could not parse policy mode '{}'",
                 string

policies/rudderc/docs/src/syntax.md

@@ -109,10 +109,10 @@ Blocks contains:
 * `tags` (optional): Optional key-value tags.
 * `items`: A list of items (block or method call). Cannot be empty.
 * `condition` (optional): A condition expression for the whole block. `true` is an always defined (default), `false` is never defined.
-* `policy_mode` (optional):
-  * `default`(default): Inherit policy mode from parent container
-  * `enforce`: Force the policy mode of all items within the block in enforce mode.
-  * `audit`: Force the policy mode of all items within the block in audit mode.
+* `policy_mode_override` (optional):
+  * `none`(default): Use the policy mode from parent container (or directive if no override)
+  * `enforce`: Force the policy mode of all items within the block to enforce mode.
+  * `audit`: Force the policy mode of all items within the block to audit mode.
 * `reporting` (optional):
   * `mode`
     * `weighted` (default)
@@ -122,6 +122,15 @@ Blocks contains:
     * `disabled`: No reporting
   * `id` (required with `focus` mode): id of the method to focus reporting on.
 
+<div class="warning">
+Setting <code class="hljs">policy_mode_override</code> to <code class="hljs">enforce</code> will <strong>bypass the audit mode</strong>, so it must only be used
+for actions that <strong>do not modify the system</strong> and are required for proper audit mode operation (e.g.
+writing a temporary file to compare its content with the system).
+</div>
+
+<div class="warning">Policy mode effective value will always be the most closest override layer, meanning that an overridden policy mode on a method call
+will always prevail over directives and blocks values.</div>
+
 ```yaml
 items:
   - name: "Ensure telnet-server absence"
@@ -135,9 +144,6 @@ items:
       - ...
 ```
 
-<div class="warning">Policy mode effective value will always be taken from the latest override layer. Meaning that a forced policy mode on a method call
-will always prevail over directives and blocks ones.</div>
-
 ## Methods
 
 Methods contains:
@@ -148,15 +154,21 @@ Methods contains:
 * `tags` (optional): Optional key-value tags.
 * `params`: Key-Value dictionary of parameters for the method.
 * `condition` (optional): A condition expression for the method. `true` is an always defined (default), `false` is never defined.
-* `policy_mode` (optional):
-  * `default`(default): Inherit policy mode from parent container
+* `policy_mode_override` (optional):
+  * `none` (default): Inherit policy mode from parent container (ore directive if no override)
   * `enforce`: Force the policy mode to enforce mode.
   * `audit`: Force the policy mode to audit mode.
 * `reporting` (optional)
   * `mode`
     * `enabled` (default): Normal reporting
     * `disabled`: No reporting
 
+<div class="warning">
+Setting <code class="hljs">policy_mode_override</code> to <code class="hljs">enforce</code> will <strong>bypass the audit mode</strong>, so it must only be used
+for actions that <strong>do not modify the system</strong> and are required for proper audit mode operation (e.g.
+writing a temporary file to compare its content with the system).
+</div>
+
 The methods are documented in the next section of this documentation, sorted by category.
 
 Example:

policies/rudderc/src/backends/unix.rs

@@ -83,7 +83,7 @@ impl Backend for Unix {
                 ItemKind::Block(r) => {
                     let mut calls: Vec<(Promise, Option<Bundle>)> = vec![];
                     if let Some(x) = dry_run_mode::push_policy_mode(
-                        r.policy_mode,
+                        r.policy_mode_override,
                         format!("push_policy_mode_for_block_{}", r.id),
                     ) {
                         calls.push((x, None))
@@ -96,7 +96,7 @@ impl Backend for Unix {
                         )?);
                     }
                     if let Some(x) = dry_run_mode::pop_policy_mode(
-                        r.policy_mode,
+                        r.policy_mode_override,
                         format!("pop_policy_mode_for_block_{}", r.id),
                     ) {
                         calls.push((x, None))

policies/rudderc/src/backends/unix/ncf/method_call.rs

@@ -106,8 +106,8 @@ pub fn method_call(
         info.bundle_name
     );
 
-    let push_policy_mode = dry_run_mode::push_policy_mode(m.policy_mode, unique.clone());
-    let pop_policy_mode = dry_run_mode::pop_policy_mode(m.policy_mode, unique.clone());
+    let push_policy_mode = dry_run_mode::push_policy_mode(m.policy_mode_override, unique.clone());
+    let pop_policy_mode = dry_run_mode::pop_policy_mode(m.policy_mode_override, unique.clone());
     let incall_condition = "${method_call_condition}".to_string();
 
     let mut promises = match (&condition, is_supported) {

policies/rudderc/src/backends/windows.rs

@@ -157,7 +157,7 @@ struct WindowsMethod {
     args: Vec<(String, String, Escaping)>,
     name: String,
     is_supported: bool,
-    policy_mode: Option<PolicyMode>,
+    policy_mode_override: Option<PolicyMode>,
 }
 
 fn method_call(
@@ -211,14 +211,14 @@ fn method_call(
         args,
         name: filters::dsc_case(&m.info.as_ref().unwrap().bundle_name).unwrap(),
         is_supported,
-        policy_mode: if let Some(x) = policy_mode_context {
-            if m.policy_mode.is_none() {
+        policy_mode_override: if let Some(x) = policy_mode_context {
+            if m.policy_mode_override.is_none() {
                 Some(x)
             } else {
-                m.policy_mode
+                m.policy_mode_override
             }
         } else {
-            m.policy_mode
+            m.policy_mode_override
         },
     })
 }
@@ -246,7 +246,7 @@ impl Windows {
                         calls.extend(resolve_module(
                             inner,
                             context.and(&r.condition),
-                            r.policy_mode,
+                            r.policy_mode_override,
                         )?);
                     }
                     Ok(calls)

policies/rudderc/src/ir/technique.rs

@@ -325,7 +325,7 @@ pub struct DeserItem {
     pub module: Option<String>,
     #[serde(deserialize_with = "PolicyMode::from_string")]
     #[serde(default)]
-    pub policy_mode: Option<PolicyMode>,
+    pub policy_mode_override: Option<PolicyMode>,
 }
 
 // Variant of Technique for first level of deserialization
@@ -390,7 +390,7 @@ impl DeserItem {
                     &self.name, &self.id
                 ))?,
                 info: None,
-                policy_mode: self.policy_mode,
+                policy_mode_override: self.policy_mode_override,
             })),
             (true, false, _, false) => {
                 bail!("Method {} ({}) requires params", self.name, self.id)
@@ -406,7 +406,7 @@ impl DeserItem {
                     "Module {} ({}) has an unexpected reporting mode",
                     self.name, self.id
                 ))?,
-                policy_mode: self.policy_mode,
+                policy_mode_override: self.policy_mode_override,
             })),
             (false, true, _, false) => {
                 bail!("Module {} ({}) requires params", self.name, self.id)
@@ -426,7 +426,7 @@ impl DeserItem {
                     .into_iter()
                     .map(|i| i.into_kind().unwrap())
                     .collect(),
-                policy_mode: self.policy_mode,
+                policy_mode_override: self.policy_mode_override,
             })),
             (false, false, false, false) => {
                 bail!("Block {} ({}) requires items", self.name, self.id)
@@ -473,7 +473,7 @@ pub struct Block {
     pub reporting: BlockReporting,
     #[serde(default)]
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub policy_mode: Option<PolicyMode>,
+    pub policy_mode_override: Option<PolicyMode>,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq, Serialize)]
@@ -493,7 +493,7 @@ pub struct Module {
     pub reporting: LeafReporting,
     #[serde(default)]
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub policy_mode: Option<PolicyMode>,
+    pub policy_mode_override: Option<PolicyMode>,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq, Serialize)]
@@ -516,7 +516,7 @@ pub struct Method {
     pub info: Option<&'static MethodInfo>,
     #[serde(default)]
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub policy_mode: Option<PolicyMode>,
+    pub policy_mode_override: Option<PolicyMode>,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq, Default, Serialize, Deserialize)]

policies/rudderc/src/technique.schema.json

@@ -281,7 +281,7 @@
       "enum": [
         "audit",
         "enforce",
-        "default"
+        "none"
       ]
     },
     "methodReportingMode": {
@@ -386,7 +386,7 @@
           "title": "method call tags",
           "$ref": "#/$defs/tags"
         },
-        "policy_mode": {
+        "policy_mode_override": {
           "title": "method call policy mode override",
           "$ref": "#/$defs/policyMode"
         },
@@ -455,7 +455,7 @@
           "title": "block call tags",
           "$ref": "#/$defs/tags"
         },
-        "policy_mode": {
+        "policy_mode_override": {
           "title": "block call policy mode",
           "$ref": "#/$defs/policyMode"
         },
@@ -495,4 +495,4 @@
       ]
     }
   }
-}
+}

policies/rudderc/templates/technique.ps1.askama

@@ -32,7 +32,7 @@ function {{ id|dsc_case }} {
         ClassPrefix = ([Rudder.Condition]::canonify(("{{ m.class_prefix }}_" + $componentKey)))
         ComponentKey = $componentKey
         ComponentName = "{{ m.component_name|escape_double_quotes }}"
-        PolicyMode = {{ m.policy_mode|policy_mode_fmt }}
+        PolicyMode = {{ m.policy_mode_override|policy_mode_fmt }}
         ReportId = $reportId
         DisableReporting = ${{ m.disable_reporting }}
         TechniqueName = $techniqueName
@@ -47,7 +47,7 @@ function {{ id|dsc_case }} {
                 {{- arg.0 }} = {{ arg|parameter_fmt }}
             {% endfor %}
         }
-        $call = {{ m.name|dsc_case }} @methodParams -PolicyMode {{ m.policy_mode|policy_mode_fmt }}
+        $call = {{ m.name|dsc_case }} @methodParams -PolicyMode {{ m.policy_mode_override|policy_mode_fmt }}
         $methodContext = Compute-Method-Call @reportParams -MethodCall $call
         $localContext.merge($methodContext)
     } else {
@@ -59,7 +59,7 @@ function {{ id|dsc_case }} {
             {{- arg.0 }} = {{ arg|parameter_fmt }}
         {% endfor %}
     }
-    $call = {{ m.name|dsc_case }} @methodParams -PolicyMode {{ m.policy_mode|policy_mode_fmt }}
+    $call = {{ m.name|dsc_case }} @methodParams -PolicyMode {{ m.policy_mode_override|policy_mode_fmt }}
     $methodContext = Compute-Method-Call @reportParams -MethodCall $call
     $localContext.merge($methodContext)
     {% endmatch %}

policies/rudderc/tests/cases/general/policy_mode/technique.yml

@@ -10,7 +10,7 @@ items:
       path: /tmp/1
       lines: "foobar"
       enforce: "true"
-    policy_mode: audit
+    policy_mode_override: audit
   - id: 1eedce7b-3441-4251-bdd6-706fda3ec7a8
     name: 'In omit mode'
     method: file_content
@@ -25,18 +25,18 @@ items:
       path: /tmp/1
       lines: "foobar"
       enforce: "true"
-    policy_mode: enforce
+    policy_mode_override: enforce
   - id: 1d809592-808e-4177-8351-8b7b7769af69
     name: 'In default mode'
     method: file_content
     params:
       path: /tmp/1
       lines: "foobar"
       enforce: "true"
-    policy_mode: default
+    policy_mode_override: none
   - id: 57f54359-2b2e-49f9-ab61-a77705615302
     name: "A block in audit mode"
-    policy_mode: audit
+    policy_mode_override: audit
     items:
       - id: ea274579-40fc-4545-b384-8d5576a7c69b
         name: 'Resolve to audit'
@@ -45,26 +45,26 @@ items:
           path: /tmp/1
           lines: "foobar"
           enforce: "true"
-        policy_mode: audit
+        policy_mode_override: audit
       - id: 85659b7e-968c-458c-b566-c90108c50833
         name: 'Resolve to enforce'
         method: file_content
         params:
           path: /tmp/1
           lines: "foobar"
           enforce: "true"
-        policy_mode: enforce
+        policy_mode_override: enforce
       - id: d8def455-cd43-441f-8dba-1ebae3a29389
         name: 'Resolve to audit'
         method: file_content
         params:
           path: /tmp/1
           lines: "foobar"
           enforce: "true"
-        policy_mode: default
+        policy_mode_override: none
   - id: 1ff82fc2-38fc-4324-92ab-3de5fafcdc14
     name: "A block in enforce mode"
-    policy_mode: enforce
+    policy_mode_override: enforce
     items:
       - id: f9417d97-3a18-4db6-85c3-72e28618bff1
         name: 'Resolve to audit'
@@ -73,30 +73,30 @@ items:
           path: /tmp/1
           lines: "foobar"
           enforce: "true"
-        policy_mode: audit
+        policy_mode_override: audit
       - id: c4b4faa1-85e5-4922-b713-c198bf99226e
         name: 'Resolve to enforce'
         method: file_content
         params:
           path: /tmp/1
           lines: "foobar"
           enforce: "true"
-        policy_mode: enforce
+        policy_mode_override: enforce
       - id: cce62a59-bd17-4858-ba06-6ae41f39b15a
         name: 'Resolve to enforce'
         method: file_content
         params:
           path: /tmp/1
           lines: "foobar"
           enforce: "true"
-        policy_mode: default
+        policy_mode_override: none
   - id: 7def389a-78d2-4104-b6fc-19c74f14fe93
     name: "An audit block"
-    policy_mode: enforce
+    policy_mode_override: enforce
     items:
       - id: 9fca6ca8-ccaa-4688-a5fc-e2a0d9d60165
         name: 'A nested block in audit'
-        policy_mode: audit
+        policy_mode_override: audit
         items:
           - id: 0a4299dd-0902-48b2-85ee-13dfe6fc3af6
             name: 'Resolve to audit'
@@ -105,12 +105,12 @@ items:
               path: /tmp/1
               lines: "foobar"
               enforce: "true"
-            policy_mode: default
+            policy_mode_override: none
       - id: 3b8352df-1329-4956-a019-bb9c072bc830
         name: 'Resolve to enforce'
         method: file_content
         params:
           path: /tmp/1
           lines: "foobar"
           enforce: "true"
-        policy_mode: default
+        policy_mode_override: none