-
Notifications
You must be signed in to change notification settings - Fork 30
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
And two new rules: - custom-has-key-construct - custom-in-construct Signed-off-by: Anders Eknert <anders@styra.com>
- Loading branch information
1 parent
b57ac0e
commit 2d3d89c
Showing
8 changed files
with
317 additions
and
28 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| package regal.rules.idiomatic.common_test | ||
|
|
||
| import future.keywords.if | ||
|
|
||
| import data.regal.ast | ||
| import data.regal.config | ||
| import data.regal.rules.idiomatic | ||
|
|
||
| report(snippet) := report if { | ||
| # regal ignore:external-reference | ||
| report := idiomatic.report with input as ast.policy(snippet) | ||
| with config.for_rule as {"level": "error"} | ||
| } |
56 changes: 56 additions & 0 deletions
56
bundle/regal/rules/idiomatic/custom_has_key_construct.rego
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,56 @@ | ||
| package regal.rules.idiomatic | ||
|
|
||
| import future.keywords.contains | ||
| import future.keywords.if | ||
| import future.keywords.in | ||
|
|
||
| import data.regal.ast | ||
| import data.regal.config | ||
| import data.regal.result | ||
|
|
||
| # METADATA | ||
| # title: custom-has-key-construct | ||
| # description: Custom function may be replaced by `in` and `object.keys` | ||
| # related_resources: | ||
| # - description: documentation | ||
| # ref: $baseUrl/$category/custom-has-key-construct | ||
| # custom: | ||
| # category: idiomatic | ||
| report contains violation if { | ||
| config.for_rule(rego.metadata.rule()).level != "ignore" | ||
|
|
||
| some rule in input.rules | ||
| rule.head.args | ||
|
|
||
| arg_names := [arg.value | some arg in rule.head.args] | ||
|
|
||
| count(rule.body) == 1 | ||
|
|
||
| terms := rule.body[0].terms | ||
|
|
||
| terms[0].value[0].type == "var" | ||
| terms[0].value[0].value == "eq" | ||
|
|
||
| [var, ref] := normalize_eq_terms(terms) | ||
|
|
||
| ref.value[0].type == "var" | ||
| ref.value[0].value in arg_names | ||
| ref.value[1].type == "var" | ||
| ref.value[1].value in arg_names | ||
|
|
||
| violation := result.fail(rego.metadata.rule(), result.location(rule.head)) | ||
| } | ||
|
|
||
| # METADATA | ||
| # description: Normalize var to always always be on the left hand side | ||
| normalize_eq_terms(terms) := [terms[1], terms[2]] if { | ||
| terms[1].type == "var" | ||
| terms[1].value == "$0" | ||
| terms[2].type == "ref" | ||
| } | ||
|
|
||
| normalize_eq_terms(terms) := [terms[2], terms[1]] if { | ||
| terms[1].type == "ref" | ||
| terms[2].type == "var" | ||
| terms[2].value == "$0" | ||
| } |
25 changes: 25 additions & 0 deletions
25
bundle/regal/rules/idiomatic/custom_has_key_construct_test.rego
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| package regal.rules.idiomatic_test | ||
|
|
||
| import future.keywords.if | ||
|
|
||
| import data.regal.ast | ||
| import data.regal.config | ||
| import data.regal.rules.idiomatic | ||
| import data.regal.rules.idiomatic.common_test.report | ||
|
|
||
| test_fail_unnecessary_construct_in if { | ||
| r := report(`has_key(name, coll) { | ||
| _ = coll[name] | ||
| }`) | ||
| r == {{ | ||
| "category": "idiomatic", | ||
| "description": "Custom function may be replaced by `in` and `object.keys`", | ||
| "level": "error", | ||
| "location": {"col": 1, "file": "policy.rego", "row": 3, "text": "has_key(name, coll) {"}, | ||
| "related_resources": [{ | ||
| "description": "documentation", | ||
| "ref": config.docs.resolve_url("$baseUrl/$category/custom-has-key-construct", "idiomatic"), | ||
| }], | ||
| "title": "custom-has-key-construct", | ||
| }} | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,58 @@ | ||
| package regal.rules.idiomatic | ||
|
|
||
| import future.keywords.contains | ||
| import future.keywords.if | ||
| import future.keywords.in | ||
|
|
||
| import data.regal.ast | ||
| import data.regal.config | ||
| import data.regal.result | ||
|
|
||
| # METADATA | ||
| # title: custom-in-construct | ||
| # description: Custom function may be replaced by `in` keyword | ||
| # related_resources: | ||
| # - description: documentation | ||
| # ref: $baseUrl/$category/custom-in-construct | ||
| # custom: | ||
| # category: idiomatic | ||
| report contains violation if { | ||
| config.for_rule(rego.metadata.rule()).level != "ignore" | ||
|
|
||
| some rule in input.rules | ||
| rule.head.args | ||
|
|
||
| arg_names := [arg.value | some arg in rule.head.args] | ||
|
|
||
| # while there could be more convoluted ways of doing this | ||
| # we'll settle for the likely most common case (`item == coll[_]`) | ||
| count(rule.body) == 1 | ||
|
|
||
| terms := rule.body[0].terms | ||
|
|
||
| terms[0].value[0].type == "var" | ||
| terms[0].value[0].value in {"eq", "equal"} | ||
|
|
||
| [var, ref] := normalize_eq_terms(terms) | ||
|
|
||
| var.value in arg_names | ||
| ref.value[0].value in arg_names | ||
| ref.value[1].type == "var" | ||
| ref.value[1].value == "$0" | ||
|
|
||
| violation := result.fail(rego.metadata.rule(), result.location(rule.head)) | ||
| } | ||
|
|
||
| # METADATA | ||
| # description: Normalize var to always always be on the left hand side | ||
| normalize_eq_terms(terms) := [terms[1], terms[2]] if { | ||
| terms[1].type == "var" | ||
| terms[2].type == "ref" | ||
| terms[2].value[0].type == "var" | ||
| } | ||
|
|
||
| normalize_eq_terms(terms) := [terms[2], terms[1]] if { | ||
| terms[1].type == "ref" | ||
| terms[1].value[0].type == "var" | ||
| terms[2].type == "var" | ||
| } |
40 changes: 40 additions & 0 deletions
40
bundle/regal/rules/idiomatic/custom_in_construct_test.rego
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,40 @@ | ||
| package regal.rules.idiomatic_test | ||
|
|
||
| import future.keywords.if | ||
|
|
||
| import data.regal.ast | ||
| import data.regal.config | ||
| import data.regal.rules.idiomatic | ||
| import data.regal.rules.idiomatic.common_test.report | ||
|
|
||
| test_fail_unnecessary_construct_in if { | ||
| r := report(`has(item, coll) { | ||
| item == coll[_] | ||
| }`) | ||
| r == {{ | ||
| "category": "idiomatic", | ||
| "description": "Custom function may be replaced by `in` keyword", | ||
| "level": "error", | ||
| "location": {"col": 1, "file": "policy.rego", "row": 3, "text": "has(item, coll) {"}, | ||
| "related_resources": [{ | ||
| "description": "documentation", | ||
| "ref": config.docs.resolve_url("$baseUrl/$category/custom-in-construct", "idiomatic"), | ||
| }], | ||
| "title": "custom-in-construct", | ||
| }} | ||
| } | ||
|
|
||
| test_fail_unnecessary_construct_in_reversed if { | ||
| r := report(`has(item, coll) { coll[_] == item }`) | ||
| r == {{ | ||
| "category": "idiomatic", | ||
| "description": "Custom function may be replaced by `in` keyword", | ||
| "level": "error", | ||
| "location": {"col": 1, "file": "policy.rego", "row": 3, "text": "has(item, coll) { coll[_] == item }"}, | ||
| "related_resources": [{ | ||
| "description": "documentation", | ||
| "ref": config.docs.resolve_url("$baseUrl/$category/custom-in-construct", "idiomatic"), | ||
| }], | ||
| "title": "custom-in-construct", | ||
| }} | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,47 @@ | ||
| # custom-has-key-construct | ||
|
|
||
| **Summary**: Custom function may be replaced by `in` and `object.keys` | ||
|
|
||
| **Category**: Idiomatic | ||
|
|
||
| **Avoid** | ||
| ```rego | ||
| package policy | ||
| import future.keywords.if | ||
| mfa if has_key(input.claims, "mfa") | ||
| has_key(map, key) if { | ||
| _ = map[key] | ||
| } | ||
| ``` | ||
|
|
||
| **Prefer** | ||
| ```rego | ||
| package policy | ||
| import future.keywords.if | ||
| import future.keywords.in | ||
| allow if "admin" in input.user.roles | ||
| ``` | ||
|
|
||
| ## Rationale | ||
|
|
||
| The `in` keyword was introduced in OPA version X.XX. Prior to that, it was a common practice to create a custom helper | ||
| function that would iterate over values of an array in order to check if it contained a provided value. Since the | ||
| introduction of the `in` keyword, this is no longer necessary. The `in` keyword additionally supports sets and maps as | ||
| the collection type, so using it consistently is recommended. | ||
|
|
||
| ## Configuration Options | ||
|
|
||
| This linter rule provides the following configuration options: | ||
|
|
||
| ```yaml | ||
| rules: | ||
| idiomatic: | ||
| custom-in-construct: | ||
| # one of "error", "warning", "ignore" | ||
| level: error | ||
| ``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,49 @@ | ||
| # custom-in-construct | ||
|
|
||
| **Summary**: Custom function may be replaced by `in` keyword | ||
|
|
||
| **Category**: Idiomatic | ||
|
|
||
| **Avoid** | ||
| ```rego | ||
| package policy | ||
| import future.keywords.if | ||
| allow if has_value(input.user.roles, "admin") | ||
| # This custom function was commonly seen before the introduction | ||
| # of the `in` keyword. Avoid it now. | ||
| has_value(arr, item) if { | ||
| item == arr[_] | ||
| } | ||
| ``` | ||
|
|
||
| **Prefer** | ||
| ```rego | ||
| package policy | ||
| import future.keywords.if | ||
| import future.keywords.in | ||
| allow if "admin" in input.user.roles | ||
| ``` | ||
|
|
||
| ## Rationale | ||
|
|
||
| The `in` keyword was introduced in OPA version X.XX. Prior to that, it was a common practice to create a custom helper | ||
| function that would iterate over values of an array in order to check if it contained a provided value. Since the | ||
| introduction of the `in` keyword, this is no longer necessary. The `in` keyword additionally supports sets and maps as | ||
| the collection type, so using it consistently is recommended. | ||
|
|
||
| ## Configuration Options | ||
|
|
||
| This linter rule provides the following configuration options: | ||
|
|
||
| ```yaml | ||
| rules: | ||
| idiomatic: | ||
| custom-in-construct: | ||
| # one of "error", "warning", "ignore" | ||
| level: error | ||
| ``` |