Ergo CLI and Rust engine 0.4.0

New

• ergo_policy_engine::SPEC is public. It is the version of the spec the engine implements, the text a policy's ergo_spec and a report's ergo use, so a program that builds policies for the engine can write the version from it.

Changed

• A from line with more than one name needs every to read a list, and every works on a child subject, as in ergo.rego 0.6.0 and spec 0.6. A line that ends at text, a number or true or false gives that value as a subject, the subjects of a line must be of one type, every reads one list per name, a name it reads as a list must be one in every item, every deployment is written wrong, and a list before named by each of says to use a child subject. A failure for mixed types, or for a name that is a list in some items only, lists the items it names in failed_items, and a child subject of such a line is still read under each parent. Reports change as spec/CHANGELOG.md says.
• Names resolve where spec 0.6 says, as in ergo.rego 0.6.0: a bare name on the right of the phrase after every or some reads the subject's field, whose and that read the value the path ends at, pr.author reads the subject's field inside a relative clause, and the right side of a some or every condition in a from line reads the candidate. Reports change for policies that write these, see spec/CHANGELOG.md. This version follows spec 0.6, so a policy says ergo_spec: v0.6.
• As spec 0.6 also says: pr named by k and pr[0] are allowed inside a relative clause; a whose that compares a field with itself says write pr.x; distinct no longer makes a bare name on the right written wrong; a sum of whose whose, or the right side of its that, reads a name of the value it adds is written wrong; a named by on the right of every or some reads the subject's key whatever the path starts at, $params and $input included; named by pr.k takes the key from the subject inside a relative clause, after any path; a root name in a whose or on the right of every or some is read once, up front, so a problem with it fails the row even on an empty list; a whose that compares a field with itself gives no advice when the subject's name needs double quotes; and messages name a value past the list after its item and a colon, list every item a count of or sum of couldn't read, say a root name no item can use once, and a root name's problem inside a relative clause once with no item, and an item of its own list once, like item 2 of $params.envs is null, which isn't an object, name a named by key that can't be read, and write the item's path in full when a name on the right is spelled the same.
• As spec 0.6 and ergo.rego 0.6.0 say, contains and does not contain read one value and never walk a list on their right side, the list after named by each of never walks a list, a message names text, a number or a list that stops the read of its keys, and a right side that walks a list names the value where the read stopped when another item holds a list there. tags contains $input.k followed by "" on an input that is a list fails as not_an_object, as in ergo.rego, where it read each item of the input and passed. $refs list such a path, and the keys of named by each of, as written with the value null, as in ergo.rego. Reports change as spec/CHANGELOG.md says.
• As spec 0.6 and ergo.rego 0.6.0 say, every, some, count of, sum of, a for item without a position and the right side of the phrases that take a list read each item of a list a path starts at, whether it is the subject, a part, a for alias or $input, and so does a second for item that starts at an alias holding a list. A check that also reads the subject's own field outside those still fails as not_an_object, once. A path from $input whose first step is a key or a named by fails as not_an_object on an input that is a list, where it failed as unusable, and says $input is [...], which isn't an object. A for item that isn't an object is named by its value, where it said is null. A check that can't use a param or a named by key no longer says the list it reads isn't an object, and a root name inside a whose that isn't a list, or that is missing or null in an item of the subject, is said once, with no item.
• A path that meets null partway along fails as null, where it failed as absent, and the message names the step that is null, as in ergo.rego and spec 0.6: c.z is 1 with c null says c is null, and pl.z is 1 with the part pl null says pl is null. The same goes for $input, $params, a parent's field, a for alias and a position on a null subject, alias or $input. A key read from a field right after the null still decides. A whose condition on a from line reads the same way, so its $applies row fails as null, while a from line that walks through the null, like every prs.c.z, still fails $min_subjects as absent. A key read from a field after the null is named too, after the step, like s is null; p is 3, which isn't text.
• A requirement on a child subject checks the ids of every ancestor of its subject too, on $unique_ancestor_ids rows, as in ergo.rego 0.6.0 and spec 0.6. Reports of every requirement on a child subject change, see spec/CHANGELOG.md.
• A name under a for line that doesn't depend on the item, a field of the subject or of a part, $params or $input with or without a path, or an alias of an earlier line, is read once, before any item, as in ergo.rego and spec 0.6 (for.roots). When a compare or is in phrase reads it as a value, a problem with it fails the check on an empty list too, with or without , if any,, and the message names it once with no item in front, whatever its cause, then the empty list if it is one, then what each item says on its own, z is missing; item 1 of xs: m.v is 1. A $params or $input read alone is such a name too, and failed_items lists every item that failed, also when a name is said once. A root in a whose on the for line no longer hides what an item says on its own, whichever clause comes first: every xs whose k is in pr.z and whose v is 1 as m with pr.z holding "s" says pr.z is "s", which isn't a list; item 2 of xs: v is "x", which isn't a number, where it said only pr.z is "s", which isn't a list. A list on a later line that doesn't depend on the item is said before the items' problems. A named by key read from the item under null params says what missing params say. In a count of or sum of, a $params or $input name that is missing or null is named before the others, like $params.l is missing; pr.l is missing for count of xs whose w is in pr.l and whose v is in $params.l is 0, where it said pr.l is missing; $params.l is missing. The report no longer depends on the order the whose clauses are written in. Reports change for policies that write these, see spec/CHANGELOG.md.
• Under a for line, is, count of, sum of and a named by key read a root once, before any item, as in ergo.rego and spec 0.6 (for.roots). A root that is missing, null or of the wrong type fails the check on an empty list too, and is named once with no item in front: z is 1 with z holding "s" says z is "s", which isn't a number, count of z is 1 says z is "s", which isn't a list or an object, and m.t named by z is 1 with z holding 3 says z is 3, which isn't text, where it said it for each item. A key the row can't read is named before what each item says on its own. An object that count of or sum of reads fails on an empty list too, with z is {"a": 1}, which isn't a list, with or without a whose, as it does with items. A count of or sum of root is said once with items, where it was said for each item: count of z is at least m.v with z holding "s" says z is "s", which isn't a list or an object. A sentence that reads two roots isn't said again after them, and a root named before an item's own problem counts towards the cause, so zz is 3, which isn't text; item 1 of ws: w[0] named by zz is missing fails as unusable, not absent. A name that depends on the item and can't be read, like i.t holding "s" in every items as i, every $params.l whose v is at least i.t as x, makes the cause unusable where a missing or null item of $params.l gave absent or null, with the same message. The names of one sentence are said worst cause first and then by name. Reports change for policies that write these.
• A ref on the right of is in, is not in, contains, contains all of and the other phrases that take a list or patterns is listed in the row's inputs after the field, as in ergo.rego 0.6.0 and spec 0.6 (path.right_inputs), and a violation lists a ref its row lists already once. The rows of every, some and count of list such a ref from $input where they list the right side of is at least, but not one from $params, and a for line's own row lists one from either. A ref with named by after these phrases is listed in those rows as it is after is at least, like $input.m named by k and k in every xs.n is in $input.m named by k, where it was left out, or listed in full in a whose where ergo.rego lists $input.m. Changes the report of every such check.

Fixed

• The checks block of the report matches ergo.rego in three places. A $refs entry for a path that reads through a list of params, like $params[0].v, points at where the read stopped, $params:/0, where it pointed at $params:. A check written wrong because it has a field no check has, like zz or a for next to an any_of, keeps the words it was written with in its expression, is one of $params.z, and has no $refs, where it printed is in and listed the refs. A failed assertion of a for check lists the alias before the path through it, ok and then ok.fs[].k, where it listed the path first.
• The $applies check has $refs for each $params or $input path the conditions of a from line read, like $params.i in things whose x.y named by $params.i does not exist, as ergo.rego and spec 0.6 say, where it had none.
• A count of or sum of whose path runs into an item that isn't an object says so, like item 1 of xs: m is "s", which isn't an object, as ergo.rego does, where it said m.v is null, which isn't a number.
• A root name that a whose, or the phrase after every or some, reads as a list and that isn't one, like $params.q or pr.z in count of xs whose v is in pr.z is 0, fails as unusable and names itself, like pr.z is "s", which isn't a list, on an empty list too, as ergo.rego does, where the check passed. On a for item the message no longer puts an item in front, like item 1 of xs: pr.z is "s", which isn't a list. Every root name in a relative clause that fails is named, whatever its cause, in the order the sentence reads them and in front of what the items say, as in ergo.rego, where it named the first one with the row's cause, and a check's own row that fails as absent or null names a missing or null side read from the subject too, like c.z is missing, and d is null. A list in the middle of a subject's field on the right of every or some, like c.z with c a list, fails before any item and with no item in front, where it passed on an empty list. A walk whose ref step can't be read names its path and then each root its phrase can't read, like xs named by $params.k is missing; q is missing, where it named only the path. A root of the wrong type for any other phrase, like pr.z after is at least, fails the same way on an empty list too, with no item in front, as ergo.rego does. A root in a sentence under a for line is named once, with no item, and a root that reads the alias of the first item in the second item fails on an empty list too, like item 1 of ys: m.q is "s", which isn't a list, where it blamed item 1 of xs. A count of names a missing or null $params or $input root first, sorted, as ergo.rego does.
• A part that holds a list, like pl in m.v is in pl.z under every xs as m with has: {pl: c} and c holding [{"z": 1}], fails the for check as unusable with pl is [{"z": 1}], which isn't an object, as ergo.rego and spec 0.6 say, where it failed as value with [] and passed with [{"z": 1}]. count of xs whose v is in pl.z is 0 is read the same way. When the params aren't an object, a for line that picks tied items fails as ambiguous, not unusable, and a tie under a whose that reads the first item's name is named instead of for ... is false.
• require: some on a child subject needs a passing subject under each parent, as spec 0.6 and ergo.rego 0.6.0 say. Failing subjects under a parent that has a passing one are not violations and not counted in causes.