policy: parse explanations in match blocks #948
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
seirl
force-pushed
the
policy_parser_explanation
branch
from
23442e7
to
c8b6a88
Compare
This adds a secondary output to every block, an "explanation" of why a value was returned. This can be structured or non-structured text. For now the parser is simply storing the value, but the compiler cannot process it yet.
seirl
force-pushed
the
policy_parser_explanation
branch
from
c8b6a88
to
7692f87
Compare
|
/gcbrun |
TristonianJones
approved these changes
May 29, 2024
oguzhand95
added a commit
to cerbos/cerbos
that referenced
this pull request
Aug 5, 2024
[](https://renovatebot.com) This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | Type | Update | |---|---|---|---|---|---|---|---| | [github.com/aws/aws-sdk-go](https://togithub.com/aws/aws-sdk-go) | `v1.55.3` -> `v1.55.5` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | require | patch | | [github.com/google/cel-go](https://togithub.com/google/cel-go) | `v0.20.1` -> `v0.21.0` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | require | minor | | [github.com/tidwall/gjson](https://togithub.com/tidwall/gjson) | `v1.17.1` -> `v1.17.3` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | require | patch | | [github.com/twmb/franz-go](https://togithub.com/twmb/franz-go) | `v1.17.0` -> `v1.17.1` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | require | patch | | [github.com/twmb/franz-go/pkg/kadm](https://togithub.com/twmb/franz-go) | `v1.12.0` -> `v1.13.0` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | require | minor | | [github.com/vektra/mockery/v2](https://togithub.com/vektra/mockery) | `v2.43.2` -> `v2.44.1` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | require | minor | | golang.org/x/sync | `v0.7.0` -> `v0.8.0` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | require | minor | | [google.golang.org/genproto/googleapis/api](https://togithub.com/googleapis/go-genproto) | `93522f1` -> `b1a4ccb` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | require | digest | | [google.golang.org/grpc/cmd/protoc-gen-go-grpc](https://togithub.com/grpc/grpc-go) | `v1.4.0` -> `v1.5.1` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | require | minor | --- ### Release Notes <details> <summary>aws/aws-sdk-go (github.com/aws/aws-sdk-go)</summary> ### [`v1.55.5`](https://togithub.com/aws/aws-sdk-go/blob/HEAD/CHANGELOG.md#Release-v1555-2024-07-30) [Compare Source](https://togithub.com/aws/aws-sdk-go/compare/v1.55.4...v1.55.5) \=== ##### Service Client Updates - `service/appstream`: Updates service API and documentation - Added support for Red Hat Enterprise Linux 8 on Amazon AppStream 2.0 - `service/autoscaling`: Updates service API and documentation - Increase the length limit for VPCZoneIdentifier from 2047 to 5000 - `service/codepipeline`: Updates service API, documentation, and paginators - AWS CodePipeline V2 type pipelines now support stage level conditions to enable development teams to safely release changes that meet quality and compliance requirements. - `service/elasticache`: Updates service documentation - Doc only update for changes to deletion API. - `service/elasticloadbalancing`: Updates service API - `service/eventbridge`: Updates service API - `service/logs`: Updates service API - Add v2 smoke tests and smithy smokeTests trait for SDK testing. - `service/models.lex.v2`: Updates service API and documentation - `service/rolesanywhere`: Updates service API and documentation - `service/tnb`: Updates service API and documentation - `service/workspaces`: Updates service documentation - Removing multi-session as it isn't supported for pools ### [`v1.55.4`](https://togithub.com/aws/aws-sdk-go/blob/HEAD/CHANGELOG.md#Release-v1554-2024-07-29) [Compare Source](https://togithub.com/aws/aws-sdk-go/compare/v1.55.3...v1.55.4) \=== ##### Service Client Updates - `service/elasticache`: Updates service documentation - Renaming full service name as it appears in developer documentation. - `service/memorydb`: Updates service API and documentation </details> <details> <summary>google/cel-go (github.com/google/cel-go)</summary> ### [`v0.21.0`](https://togithub.com/google/cel-go/releases/tag/v0.21.0) [Compare Source](https://togithub.com/google/cel-go/compare/v0.20.1...v0.21.0) #### Features - Math extensions update to include bitwise ops and floating point helpers \[[#​923](https://togithub.com/google/cel-go/issues/923)] - Better support custom types with custom type registries \[[#​931](https://togithub.com/google/cel-go/issues/931)] - repl: implement %parse \[[#​933](https://togithub.com/google/cel-go/issues/933)] - Fixed partial variables extended bug and split PartialVarsEnvExtended test into two \[[#​955](https://togithub.com/google/cel-go/issues/955)] - Added partial evaluations example \[[#​959](https://togithub.com/google/cel-go/issues/959)] - Enable conformance tests for extensions \[[#​930](https://togithub.com/google/cel-go/issues/930)] - Update cel-spec and enable optional_type conformance tests \[[#​919](https://togithub.com/google/cel-go/issues/919)] - Improve token representation in AST \[[#​932](https://togithub.com/google/cel-go/issues/932)] - Add function accessor to Env \[[#​978](https://togithub.com/google/cel-go/issues/978)] ##### CEL Policy Compiler Policies which use CEL often evolve to express complex logic using multiple statements and decision criteria. The CEL Policy Compiler provides an extensible format for parsing, compiling, and composing expression graphs. Below is a simple example which can easily be compiled to a single CEL expression. ```yaml name: "my-policy" rule: variables: - name: greeting expression: "'%s, %s!'" - name: people expression: > ['Tristan', 'Calla', 'Antoine', 'Jonathan', 'Sokwhan', 'Rebecca'] match: - condition: "request.user in variables.people" output: "variables.greeting.format(['hello', request.user])" - output: "variables.greeting.format(['goodbye', 'stranger'])" ``` - Simple Policy Compiler \[[#​924](https://togithub.com/google/cel-go/issues/924)] - Introduce protobuf message testing to policies \[[#​961](https://togithub.com/google/cel-go/issues/961)] - Generate policy explanations during compilation \[[#​977](https://togithub.com/google/cel-go/issues/977)] - Variable and nested rule limits \[[#​989](https://togithub.com/google/cel-go/issues/989)] - Improved support for nested rules [#​991](https://togithub.com/google/cel-go/issues/991)] #### Fixes - Delete dangling source info from macro expansion \[[#​934](https://togithub.com/google/cel-go/issues/934)] - Do not re-use ID twice in `exists_one` macro \[[#​935](https://togithub.com/google/cel-go/issues/935)] - Avoid iterating over the source multiple times during parse \[[#​936](https://togithub.com/google/cel-go/issues/936)] - Fix for working with byte arrays by \[[#​958](https://togithub.com/google/cel-go/issues/958)] - Stabilize macro id generation during optimization \[[#​962](https://togithub.com/google/cel-go/issues/962)] - String formatting panic fix for non-literal format strings \[[#​987](https://togithub.com/google/cel-go/issues/987)] - Add nil checking for wrapperspb's types \[[#​960](https://togithub.com/google/cel-go/issues/960)] - Prevent self-append for `Issues` \[[#​988](https://togithub.com/google/cel-go/issues/988)] - Use bytes interface value for zero native type struct fields instead of dynamic list \[[#​981](https://togithub.com/google/cel-go/issues/981)] ##### Presence Test Semantics The following two changes identified an issue where presence test was unexpectedly being performed over a scalar type and evaluating to `absent` rather than erroring. It is strongly advised to set the flag `cel.EnableErrorOnBadPresenceTest(true)` to avoid a logical correctness issue. - Fix presence test to produce an error when it's not a map or a message \[[#​922](https://togithub.com/google/cel-go/issues/922)] - Update the presence testing fix to be opt-out \[[#​939](https://togithub.com/google/cel-go/issues/939)] ##### Deprecation Cleanup - Remove the deprecated protobuf function and type declarations \[[#​921](https://togithub.com/google/cel-go/issues/921)] #### New Contributors - [@​testwill](https://togithub.com/testwill) made their first contribution in [google/cel-go#911 - [@​patrickpichler](https://togithub.com/patrickpichler) made their first contribution in [google/cel-go#941 - [@​seirl](https://togithub.com/seirl) made their first contribution in [google/cel-go#948 - [@​jduraniglesias](https://togithub.com/jduraniglesias) made their first contribution in [google/cel-go#955 - [@​goccy](https://togithub.com/goccy) made their first contribution in [google/cel-go#960 **Full Changelog**: google/cel-go@v0.20.1...v0.21.0 </details> <details> <summary>tidwall/gjson (github.com/tidwall/gjson)</summary> ### [`v1.17.3`](https://togithub.com/tidwall/gjson/compare/v1.17.2...v1.17.3) [Compare Source](https://togithub.com/tidwall/gjson/compare/v1.17.2...v1.17.3) ### [`v1.17.2`](https://togithub.com/tidwall/gjson/compare/v1.17.1...v1.17.2) [Compare Source](https://togithub.com/tidwall/gjson/compare/v1.17.1...v1.17.2) </details> <details> <summary>twmb/franz-go (github.com/twmb/franz-go)</summary> ### [`v1.17.1`](https://togithub.com/twmb/franz-go/blob/HEAD/CHANGELOG.md#v1171) [Compare Source](https://togithub.com/twmb/franz-go/compare/v1.17.0...v1.17.1) \=== This patch release fixes four bugs (two are fixed in one commit), contains two internal improvements, and adds two other minor changes. #### Bug fixes - If you were using the `MaxBufferedBytes` option and ever hit the max, odds are likely that you would experience a deadlock eventually. That has been fixed. - If you ever produced a record with no topic field and without using `DefaultProduceTopic`, or if you produced a transactional record while not in a transaction, AND if the client was at the maximum buffered records, odds are you would eventually deadlock. This has been fixed. - It was previously not possible to set lz4 compression levels. - There was a data race on a boolean field if a produce request was being written at the same time a metadata update happened, *and* if the metadata update has an error on the topic or partition that is actively being written. Note that the race was unlikely and if you experienced it, you would have noticed an OutOfOrderSequenceNumber error. See [this comment](https://togithub.com/twmb/franz-go/pull/781#issuecomment-2248563542) for more details. #### Improvements - Canceling the context you pass to `Produce` now propagates in two more areas: the initial `InitProducerID` request that occurs the first time you produce, and if the client is internally backing off due to a produce request failure. Note that there is no guarantee on *which* context is used for cancelation if you produce many records, and the client does *not* allow canceling if it is currently unsafe to do so. However, this does mean that if your cluster is somewhat down such that `InitProducerID` is failing on your new client, you can now actually cause the `Produce` to quit. See [this comment](https://togithub.com/twmb/franz-go/issues/769#issuecomment-2235707417) for what it means for a record to be "safe" to fail. - The client now ignores aborted records while consuming only if you have configured `FetchIsolationLevel(ReadCommitted())`. Previously, the client relied entirely on the `FetchResponse` `AbortedTransactions` field, but it's possible that brokers could send aborted transactions even when not using read committed. Specifically, this was a behavior difference in Redpanda, and the KIP that introduced transactions and all relevant documents do not mention what the broker behavior actually should be here. Redpanda itself was also changed to not send aborted transactions when using read committed, but we may as well improve franz-go as well. - Decompression now better reuses buffers under the hood, reducing allocations. - Brokers that return preferred replicas to fetch from now causes an info level log in the client. #### Relevant commits - [`305d8dc`](https://togithub.com/twmb/franz-go/commit/305d8dc) kgo: allow record ctx cancelation to propagate a bit more - [`24fbb0f`](https://togithub.com/twmb/franz-go/commit/24fbb0f) **bugfix** kgo: fix deadlock in Produce when using MaxBufferedBytes - [`1827add`](https://togithub.com/twmb/franz-go/commit/1827add) **bugfix** kgo sink: fix read/write race for recBatch.canFailFromLoadErrs - [`d7ea2c3`](https://togithub.com/twmb/franz-go/commit/d7ea2c3) **bugfix** fix setting lz4 compression levels (thanks [@​asg0451](https://togithub.com/asg0451)!) - [`5809dec`](https://togithub.com/twmb/franz-go/commit/5809dec) optimise: use byteBuffer pool in decompression (thanks [@​kalbhor](https://togithub.com/kalbhor)!) - [`cda897d`](https://togithub.com/twmb/franz-go/commit/cda897d) kgo: add log for preferred replicas - [`e62b402`](https://togithub.com/twmb/franz-go/commit/e62b402) **improvement** kgo sink: do not back off on certain edge case - [`9e32bf9`](https://togithub.com/twmb/franz-go/commit/9e32bf9) kgo: ignore aborted txns if using `READ_UNCOMMITTED` </details> <details> <summary>vektra/mockery (github.com/vektra/mockery/v2)</summary> ### [`v2.44.1`](https://togithub.com/vektra/mockery/releases/tag/v2.44.1) [Compare Source](https://togithub.com/vektra/mockery/compare/v2.44.0...v2.44.1) ##### Changelog - [`c6d2a9e`](https://togithub.com/vektra/mockery/commit/c6d2a9e) Fix release workflow - Fixes [#​769](https://togithub.com/vektra/mockery/issues/769) : Mock files getting created in disk when dry-run is enabled by [@​snopan](https://togithub.com/snopan) in [vektra/mockery#789 - chore: fix typos and style by [@​ccoVeille](https://togithub.com/ccoVeille) in [vektra/mockery#794 - Allow types defined as instantiated generic interfaces to generate mocks by [@​LandonTClipp](https://togithub.com/LandonTClipp) in [vektra/mockery#790 ### [`v2.44.0`](https://togithub.com/vektra/mockery/compare/v2.43.2...v2.44.0) [Compare Source](https://togithub.com/vektra/mockery/compare/v2.43.2...v2.44.0) </details> <details> <summary>grpc/grpc-go (google.golang.org/grpc/cmd/protoc-gen-go-grpc)</summary> ### [`v1.5.1`](https://togithub.com/grpc/grpc-go/releases/tag/v1.5.1): Release 1.5.1 [Compare Source](https://togithub.com/grpc/grpc-go/compare/v1.5.0...v1.5.1) - Do not create new addrConn when connection error happens ([#​1369](https://togithub.com/grpc/grpc-go/issues/1369)) ### [`v1.5.0`](https://togithub.com/grpc/grpc-go/releases/tag/v1.5.0): Release 1.5.0 [Compare Source](https://togithub.com/grpc/grpc-go/compare/v1.4.0...v1.5.0) ### Performance - BDP estimation and window update. ([#​1310](https://togithub.com/grpc/grpc-go/issues/1310)) - Do not flush NewStream header on client side for unary RPCs and streaming RPCs with requests. ([#​1343](https://togithub.com/grpc/grpc-go/issues/1343)) - Change objects in recvBuffer queue from interface to concrete type to reduce allocs ([#​1029](https://togithub.com/grpc/grpc-go/issues/1029)) - Don't create new reader in recvMsg ([#​940](https://togithub.com/grpc/grpc-go/issues/940)) ### API change - Add support for grpc.SupportPackageIsVersion3 back ([#​1331](https://togithub.com/grpc/grpc-go/issues/1331)) - Add Severity and VerboseLevel to grpclog. ([#​922](https://togithub.com/grpc/grpc-go/issues/922)) ### Behavior change - Transport errors should be coded Unavailable instead of internal. ([#​1307](https://togithub.com/grpc/grpc-go/issues/1307)) - Catch invalid use of Server.RegisterService after Register.Serve ([#​828](https://togithub.com/grpc/grpc-go/issues/828)) ### Bug fixes - Fix deadlock of roundrobin balancer ([#​1353](https://togithub.com/grpc/grpc-go/issues/1353)) - Use log severity and verbosity level ([#​1340](https://togithub.com/grpc/grpc-go/issues/1340)) - Protect bytesSent and bytesReceived with mutex to avoid datarace ([#​1318](https://togithub.com/grpc/grpc-go/issues/1318)) - Support IPv6 addresses in grpclb ([#​1303](https://togithub.com/grpc/grpc-go/issues/1303)) - Return header in Stream.Header() if available ([#​1281](https://togithub.com/grpc/grpc-go/issues/1281)) - Fix error handling on Stream deletion ([#​1275](https://togithub.com/grpc/grpc-go/issues/1275)) ### Documentation - Add documentation to deprecate WithTimeout dial option ([#​1333](https://togithub.com/grpc/grpc-go/issues/1333)) - Specify characters allowed in metadata keys ([#​1299](https://togithub.com/grpc/grpc-go/issues/1299)) - Update LICENSE to Apache 2 ([#​1290](https://togithub.com/grpc/grpc-go/issues/1290)) - Update the path of guide ([#​950](https://togithub.com/grpc/grpc-go/issues/950)) ### Testing - latency: sleep in Write when BDP is exceeded to avoid buffer bloat ([#​1330](https://togithub.com/grpc/grpc-go/issues/1330)) - Replace 127.0.0.1 with localhost for ipv6 only environment ([#​1306](https://togithub.com/grpc/grpc-go/issues/1306)) - Create latency package for realistically simulating network latency ([#​1286](https://togithub.com/grpc/grpc-go/issues/1286)) - Use subtests for the benchmark_test and add it into the Makefile ([#​1278](https://togithub.com/grpc/grpc-go/issues/1278)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://togithub.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View the [repository job log](https://developer.mend.io/github/cerbos/cerbos). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy40NDAuNyIsInVwZGF0ZWRJblZlciI6IjM3LjQ0MC43IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJhcmVhL2RlcGVuZGVuY2llcyIsImJvdHMiLCJraW5kL2Nob3JlIl19--> --------- Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Signed-off-by: Oğuzhan Durgun <oguzhandurgun95@gmail.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Oğuzhan Durgun <oguzhandurgun95@gmail.com>
](https://renovatebot.com){kind=link}
This pull request was closed.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This adds a secondary output to every block, an "explanation" of why a value was returned. This can be structured or non-structured text. For now the parser is simply storing the value, but the compiler cannot process it yet.