feat: User-defined output from policy evaluation

api/public/cerbos/engine/v1/engine.proto

@@ -171,7 +171,7 @@ message OutputEntry {
     description: "Rule that matched to produce this output."
     example: "\"resource.expense.v1/acme#rule-001\""
   }];
-  string val = 2 [(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
+  google.protobuf.Value val = 2 [(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
     description: "Dynamic output, determined by user defined rule output."
     example: "\"some_string\""
   }];

internal/engine/evaluator.go

@@ -23,6 +23,7 @@
 	"github.com/google/cel-go/cel"
 	"go.uber.org/multierr"
 	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
+	"google.golang.org/protobuf/types/known/structpb"
 )
 
 var ErrPolicyNotExecutable = errors.New("policy not executable")
@@ -150,24 +151,20 @@
 		}
 
 		// evaluate each rule until all actions have a result
-		for i, rule := range p.Rules {
+		for _, rule := range p.Rules {
 			rctx := sctx.StartRule(rule.Name)
 
 			if rule.Output != nil {
 				octx := rctx.StartOutput(rule.Name)
 				output, err := rpe.evalParams.evaluateStrCELExpr(rule.Output.Checked, variables, input)
 				if err != nil {
 					octx.Skipped(err, "Error evaluating output")
 				}
 
-				ruleName := rule.Name
-				if ruleName == "" {
-					ruleName = fmt.Sprintf("rule-%03d", i)
-				}
 				result.Outputs = append(result.Outputs, &enginev1.OutputEntry{
-					Src: fmt.Sprintf("%s#%s", rpe.policy.Meta.Fqn, ruleName),
-					Val: output,
+					Src: namer.RuleFQN(rpe.policy.Meta, p.Scope, rule.Name),
+					Val: structpb.NewStringValue(output),
 				})
 			}
 
 			if !internal.SetIntersects(rule.Roles, effectiveRoles) && !internal.SetIntersects(rule.DerivedRoles, effectiveDerivedRoles) {
@@ -238,7 +235,7 @@
 				continue
 			}
 
-			for i, rule := range resourceRules.ActionRules {
+			for _, rule := range resourceRules.ActionRules {
 				matchedActions := util.FilterGlob(rule.Action, actionsToResolve)
 				for _, action := range matchedActions {
 					actx := rctx.StartAction(action)
@@ -257,20 +254,16 @@
 				}
 
 				if rule.Output != nil {
 					octx := rctx.StartOutput(rule.Name)
 					output, err := ppe.evalParams.evaluateStrCELExpr(rule.Output.Checked, variables, input)
 					if err != nil {
 						octx.Skipped(err, "Error evaluating output")
 					}
 
-					ruleName := rule.Name
-					if ruleName == "" {
-						ruleName = fmt.Sprintf("rule-%03d", i)
-					}
 					result.Outputs = append(result.Outputs, &enginev1.OutputEntry{
-						Src: fmt.Sprintf("%s#%s", ppe.policy.Meta.Fqn, ruleName),
-						Val: output,
+						Src: namer.RuleFQN(ppe.policy.Meta, p.Scope, rule.Name),
+						Val: structpb.NewStringValue(output),
 					})
 				}
 			}
 		}
@@ -396,22 +389,22 @@
 	return boolVal, nil
 }
 
 func (ep evalParams) evaluateStrCELExpr(expr *exprpb.CheckedExpr, variables map[string]any, input *enginev1.CheckInput) (string, error) {
 	val, err := ep.evaluateCELExpr(expr, variables, input)
 	if err != nil {
 		return "", err
 	}
 
 	if val == nil {
 		return "", nil
 	}
 
 	strVal, ok := val.(string)
 	if !ok {
 		return "", nil
 	}
 
 	return strVal, nil
 }
 
 func (ep evalParams) evaluateCELExpr(expr *exprpb.CheckedExpr, variables map[string]any, input *enginev1.CheckInput) (any, error) {

internal/namer/namer.go

@@ -12,6 +12,7 @@
 	"strings"
 
 	policyv1 "github.com/cerbos/cerbos/api/genpb/cerbos/policy/v1"
+	runtimev1 "github.com/cerbos/cerbos/api/genpb/cerbos/runtime/v1"
 	"github.com/cerbos/cerbos/internal/util"
 )
 
@@ -217,6 +218,22 @@
 	return fmt.Sprintf("%s_rule-%03d", resource, idx)
 }
 
+// RuleFQN returns the FQN for the resource rule or principal resource action rule with scope granularity.
+func RuleFQN(rpsMeta any, scope, ruleName string) string {
+	var policyFqn string
+
+	switch m := rpsMeta.(type) {
+	case *runtimev1.RunnableResourcePolicySet_Metadata:
+		policyFqn = ResourcePolicyFQN(m.Resource, m.Version, scope)
+	case *runtimev1.RunnablePrincipalPolicySet_Metadata:
+		policyFqn = PrincipalPolicyFQN(m.Principal, m.Version, scope)
+	default:
+		panic(fmt.Errorf("unknown runnable policy set meta type %T", m))
+	}
+
+	return fmt.Sprintf("%s#%s", policyFqn, ruleName)
+}
+
 type PolicyCoords struct {
 	Kind    string
 	Name    string

internal/test/testdata/compile/any_role.yaml.golden

@@ -1,59 +1,59 @@
 {
-  "fqn":  "cerbos.resource.leave_request.v20210210",
-  "resourcePolicy":  {
-    "meta":  {
-      "fqn":  "cerbos.resource.leave_request.v20210210",
-      "resource":  "leave_request",
-      "version":  "20210210"
+  "fqn": "cerbos.resource.leave_request.v20210210",
+  "resourcePolicy": {
+    "meta": {
+      "fqn": "cerbos.resource.leave_request.v20210210",
+      "resource": "leave_request",
+      "version": "20210210"
     },
-    "policies":  [
+    "policies": [
       {
-        "derivedRoles":  {
-          "tester":  {
-            "name":  "tester",
-            "parentRoles":  {
-              "*":  {}
+        "derivedRoles": {
+          "tester": {
+            "name": "tester",
+            "parentRoles": {
+              "*": {}
             }
           }
         },
-        "rules":  [
+        "rules": [
           {
-            "name":  "wildcard",
-            "actions":  {
-              "*":  {}
+            "name": "wildcard",
+            "actions": {
+              "*": {}
             },
-            "roles":  {
-              "*":  {}
+            "roles": {
+              "*": {}
             },
-            "effect":  "EFFECT_ALLOW"
+            "effect": "EFFECT_ALLOW"
           },
           {
-            "name":  "rule-002",
-            "actions":  {
-              "create":  {}
+            "name": "rule-002",
+            "actions": {
+              "create": {}
             },
-            "derivedRoles":  {
-              "tester":  {}
+            "derivedRoles": {
+              "tester": {}
             },
-            "effect":  "EFFECT_ALLOW"
+            "effect": "EFFECT_ALLOW"
           }
         ],
-        "schemas":  {
-          "principalSchema":  {
-            "ref":  "cerbos:///complex_object.json"
+        "schemas": {
+          "principalSchema": {
+            "ref": "cerbos:///complex_object.json"
           },
-          "resourceSchema":  {
-            "ref":  "cerbos:///complex_object.json"
+          "resourceSchema": {
+            "ref": "cerbos:///complex_object.json"
           }
         }
       }
     ],
-    "schemas":  {
-      "principalSchema":  {
-        "ref":  "cerbos:///complex_object.json"
+    "schemas": {
+      "principalSchema": {
+        "ref": "cerbos:///complex_object.json"
       },
-      "resourceSchema":  {
-        "ref":  "cerbos:///complex_object.json"
+      "resourceSchema": {
+        "ref": "cerbos:///complex_object.json"
       }
     }
   }