Pomerium Policy Language

[calebdoxsey]

Summary

Implement the Pomerium Policy Language. The Pomerium Policy Language is a DSL for constructing rego scripts. A subsequent PR will convert our existing policy into PPL and then into Rego.

Checklist

• reference any related issues
• updated docs
• updated unit tests
• updated UPGRADING.md
• add appropriate tag (improvement / bug / etc)
• ready for review

[codeclimate]

Code Climate has analyzed commit 42739f0 and detected 0 issues on this pull request.

View more on Code Climate.

[wasaga]

given that any of this functions may panic, maybe a better approach would be to have those snippets in var section so that they'll all be evaluated on start.

var (
    Session = ast.MustParseRule(`
get_session(id) = v {
	v := get_databroker_record("type.googleapis.com/user.ServiceAccount", id)
} else = v {
	v := get_databroker_record("type.googleapis.com/session.Session", id)
} else = v {
	v := {}
}
`)
)

[calebdoxsey]

We modify the rules sometimes, so this would result in inadvertent data sharing.