feat: Add support for future keyword (#217)

Also add e2e tests that prove future works.

Signed-off-by: Will Beason <willbeason@google.com>

constraint/pkg/client/clienttest/templates.go

@@ -17,6 +17,7 @@ const (
 	KindCheckData        = "CheckData"
 	KindRuntimeError     = "RuntimeError"
 	KindForbidDuplicates = "ForbidDuplicates"
+	KindFuture           = "Future"
 )
 
 // ModuleAllow defines a Rego package which allows all objects it reviews.
@@ -264,3 +265,34 @@ func TemplateForbidDuplicates() *templates.ConstraintTemplate {
 
 	return ct
 }
+
+const moduleFuture = `
+package foo
+
+import future.keywords.in
+
+violation[{"msg": msg}] {
+  some n in ["1", "2"]
+  n == input.review.object.data
+  msg := "bad data"
+}
+`
+
+func TemplateFuture() *templates.ConstraintTemplate {
+	ct := &templates.ConstraintTemplate{}
+
+	ct.SetName("future")
+	ct.Spec.CRD.Spec.Names.Kind = KindFuture
+	ct.Spec.CRD.Spec.Validation = &templates.Validation{
+		OpenAPIV3Schema: &apiextensions.JSONSchemaProps{
+			Type: "object",
+		},
+	}
+
+	ct.Spec.Targets = []templates.Target{{
+		Target: handlertest.TargetName,
+		Rego:   moduleFuture,
+	}}
+
+	return ct
+}

constraint/pkg/client/e2e_test.go

@@ -321,7 +321,7 @@ func TestClient_Review(t *testing.T) {
 				Target:            "foo2",
 				Msg:               "denied",
 				Constraint:        cts.MakeConstraint(t, cts.MockTemplate, "bar"),
-				EnforcementAction: "deny",
+				EnforcementAction: constraints.EnforcementActionDeny,
 			}},
 		},
 		{
@@ -360,9 +360,42 @@ func TestClient_Review(t *testing.T) {
 				Target:            handlertest.TargetName,
 				Msg:               "duplicate data bar",
 				Constraint:        cts.MakeConstraint(t, clienttest.KindForbidDuplicates, "constraint"),
-				EnforcementAction: "deny",
+				EnforcementAction: constraints.EnforcementActionDeny,
 			}},
 		},
+		{
+			name:       "deny future",
+			namespaces: nil,
+			targets:    []handler.TargetHandler{&handlertest.Handler{}},
+			templates: []*templates.ConstraintTemplate{
+				clienttest.TemplateFuture(),
+			},
+			constraints: []*unstructured.Unstructured{
+				cts.MakeConstraint(t, clienttest.KindFuture, "constraint"),
+			},
+			inventory: nil,
+			toReview:  handlertest.NewReview("", "foo", "1"),
+			wantResults: []*types.Result{{
+				Target:            handlertest.TargetName,
+				Msg:               "bad data",
+				Constraint:        cts.MakeConstraint(t, clienttest.KindFuture, "constraint"),
+				EnforcementAction: constraints.EnforcementActionDeny,
+			}},
+		},
+		{
+			name:       "allow future",
+			namespaces: nil,
+			targets:    []handler.TargetHandler{&handlertest.Handler{}},
+			templates: []*templates.ConstraintTemplate{
+				clienttest.TemplateFuture(),
+			},
+			constraints: []*unstructured.Unstructured{
+				cts.MakeConstraint(t, clienttest.KindFuture, "constraint"),
+			},
+			inventory:   nil,
+			toReview:    handlertest.NewReview("", "foo", "3"),
+			wantResults: nil,
+		},
 	}
 
 	for _, tt := range tests {

constraint/pkg/regorewriter/ast_helpers.go

@@ -10,6 +10,7 @@ import (
 var (
 	dataVarTerm    = ast.VarTerm("data")
 	inputRefPrefix = ast.MustParseRef("input")
+	futureVarTerm  = ast.VarTerm("future")
 )
 
 // isDataRef returns true if the ast.Ref is referring to the "data" document.
@@ -22,6 +23,15 @@ func isDataRef(ref ast.Ref) bool {
 	return firstTerm.Equal(dataVarTerm)
 }
 
+func isFutureRef(ref ast.Ref) bool {
+	if len(ref) == 0 {
+		return false
+	}
+
+	firstTerm := ref[0]
+	return firstTerm.Equal(futureVarTerm)
+}
+
 // isSubRef returns true if sub is contained within base.
 func isSubRef(base, sub ast.Ref) bool {
 	glog.V(vLogDetail).Infof("Subref check %s %s", base, sub)

constraint/pkg/regorewriter/regorewriter.go

@@ -280,7 +280,7 @@ func (r *RegoRewriter) checkImport(i *ast.Import) error {
 	}
 
 	if isSubRef(inputRefPrefix, importRef) {
-		return fmt.Errorf("%w: bad import", ErrInvalidImport)
+		return fmt.Errorf("%w: cannot import input: %q", ErrInvalidImport, importRef)
 	}
 
 	for _, libPrefix := range r.allowedLibPrefixes {
@@ -289,7 +289,11 @@ func (r *RegoRewriter) checkImport(i *ast.Import) error {
 		}
 	}
 
-	return fmt.Errorf("%w: bad import", ErrInvalidImport)
+	if isFutureRef(importRef) {
+		return nil
+	}
+
+	return fmt.Errorf("%w: bad import: %q", ErrInvalidImport, importRef)
 }
 
 // checkDataReferences checks that all data references are directed to allowed lib prefixes or