ergo.rego 0.4.0

New

• Every phrase that lacked an opposite has one, as spec 0.4 says: does not start with, does not end with, is not a <type>, is not a non-empty string, is not between, is not <value> within <number>, does not equal <field> within <number>, contains some of and does not contain all of, plus is alphabetically on or before and is alphabetically on or after. Each fails as its opposite does when a field is missing, null or of the wrong type. A sentence like x is not 3 within 1 was written wrong before and reads now, after a count of, a sum of, a plus or an elapsed time too (count of x is not 3 within 1), and a compare with ne can have a within. In a comparison of plain paths and written values, and in the pieces of followed by, a path that names its key by a field now lists the field right after the path in a row's inputs, as spec 0.4 says: m named by p is q shows m named by p, p, q, where it showed m named by p, q, p. So does a count of, a sum of, an elapsed time and a plus: count of m named by p is q shows count of m named by p, m named by p[], p, q, where p came last. When the path before the field can't be read, the cause comes from that path and not from the field, so $params.m named by p is q with no m in the params fails as absent when p is null, where it failed as null, and rows.w named by p is q with rows a list fails as unusable. An every, some, count of or sum of walks a list before the field, so every rows.w named by p is q fails as the field says when rows is a list. When rows is null, it now fails as null whatever p holds, a missing p included, where a missing p failed as absent, and failed_items names rows, where it was empty when p couldn't be read, as every rows.w.k is q does.
• Text can be joined on the right side with followed by, as spec 0.4 says: rego.version is tag.version followed by "-dev", rego.spec is "v" followed by tag.version. It takes written strings and fields. Nothing that read before changes.

Changed

• This version follows spec 0.4, so a policy says ergo_spec: v0.4, and the report's ergo follows. One that says v0.3 is written wrong, with unsupported version v0.3, expected v0.4.
• The report's engine name is ergo-rego, where it was ergo.rego. Every report changes in that field only, and the hash leaves engine out, so hashes stay the same. A compiled policy made by an older copy says ergo.rego, so ergo.report reads it as one from another engine, and the message says expected ergo-rego. Compile the policy again.
• A from that starts at the input with a named by step is written as it is, whatever follows it, in the $min_subjects and $unique_ids expressions, so every $input named by $params.k is no longer count(matching(every )). A subject that narrows a subject read with every takes its flat list of subjects and filters it, where ergo.rego dropped the every and found none. An input that reads the item's own field named like a parent subject keeps its dot, like .art.k. Reports change for such policies.
• A policy with no requirement, because requirements is missing, null, not an object or empty, gets Ergo's own requirement $policy with a failing $well_formed row that says what is wrong, where its report had no row and ergo.violations returned [] while compliant was false. A requirement called $policy is written wrong. Reports change for such policies.
• A name that starts with $ is written wrong, whether it names a subject, a requirement, a check, an any_of option or a part, with a name can't start with $, where only a check named like one of Ergo's own rows was (name reserved), $input and $params as subject names (a subject can't be named $input), and a part called $dollar (invalid alias). Reports change for such policies. A check with such a name has no entry in requirements any more.
• A name that starts or ends with a space or an invisible character (Unicode White_Space or general category Cf, like U+200B or U+FEFF) is written wrong too, with a name can't start or end with a space or an invisible character, for a subject, a requirement, a check, an any_of option and a part. Reports change for such policies.
• An empty name, "", is written wrong too, whether it names a requirement, a check, an any_of option or a part, with a name can't be empty. Reports change for such policies: a "" was read before.
• The docs are split by engine. README.md is short and the same for both engines, OPA.md holds how to install and run ergo.rego and the parts of REFERENCE.md that only it has (OPA, Wasm, numbers, ergo.compile), and REFERENCE.md describes only the language.
• The $well_formed row lists the problems of fields, parts and checks sorted by name as the report writes it, quotes and escapes included, by code point, where parts were sorted by the raw name. Reports change for parts with names that need quoting, and a require that is written wrong is listed second in the $well_formed row.
• An own field named like a part of the subject or like a for alias keeps its dot in the name of an input, like .cov.pct, and so does the list a count of, sum of or a walk reads, like .art.xs[]. Reports change for such policies: they were named cov.pct and art.xs[]. The failed_items of a walk or a for line keep the dot too.
• A key read from $params or $input, after named by or in brackets, has to be a string, as spec 0.4 says. A number used to read that item of a list, so m named by $input.k is 1 with k holding 1 and m holding [5, 1] passed by reading 1, and commits[$params.n] read a commit. It fails as unusable now, and so does a boolean. An object, a list or null failed as absent in a followed by piece, an every, a some, a count of, a sum of, a for line and a field after sorted by on a for line, and fails as unusable, or null for null, now, as it did in a plain comparison. Reports change for such policies.
• A from line like scans named by $params.env named by each of $params.k gave $min_subjects the list's cause when both env and k couldn't be read. The ref before the list decides now, as subjects.sentence says: env holding 1 or an object gives unusable whatever k holds. Reports change for such policies, in the cause only.

Fixed

• A for line whose check reads a path with a named by field, like row.w named by p is "xy" under every rows as row, stopped the whole report with eval_conflict_error when an item wasn't an object and p was null or a number. The row fails as not_an_object now, with the item in failed_items, as in the Rust engine.
• A later for item whose path is named by an alias of an earlier one, like every ks as k, every m named by k as x, failed as absent when the alias held an object, a list, a number or null. It fails as unusable now, and as null when the alias holds null, as for.named_by says and as the Rust engine does. So does every rows as r, every r.xs named by r.k as x, where the key after named by is the one word r, the whole row. Reports change for such policies, in the cause only: none of them passed.
• some vals is m named by k under every ks as k stopped the whole report with eval_conflict_error when k held anything but a string, and so did every, is in and the other comparisons where an every or some reads a path named by a for alias on the right. The row fails as unusable now, or as null when the alias holds null, as in the Rust engine. Reports change for such policies: they have rows where there was an error.