Skip to content

Commit 41c5775

Browse files
lmolkovalmolkova
authored
Convert before_resolution policies into after_resolution (#3102)
1 parent 4100747 commit 41c5775

14 files changed

+212
-163
lines changed

‎policies/metric_brief_format.rego‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
package before_resolution
1+
package after_resolution
22
import rego.v1
33

44
# This file enforces formatting policy for metric briefs.
@@ -27,6 +27,6 @@ deny contains metric_brief_violation(description, group.id) if {
2727
# Allow empty briefs - only check non-empty ones
2828
trimmed_brief != ""
2929
not endswith(trimmed_brief, ".")
30-
30+
3131
description := sprintf("Non-empty metric brief '%s' must end with a period (.).", [trimmed_brief])
3232
}

‎policies/registry.rego‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
package before_resolution
1+
package after_resolution
22
import rego.v1
33

44
# This file enforces policies requiring all attributes to be defined within
@@ -29,11 +29,11 @@ deny contains attr_registry_violation(description, group.id, "") if {
2929

3030
# Any group that is NOT in the attribute registry that has an attribute id is
3131
# in violation of not using the attribute registry.
32-
deny contains attr_registry_violation(description, group.id, attr.id) if {
32+
deny contains attr_registry_violation(description, group.id, attr.name) if {
3333
group := input.groups[_]
3434
not startswith(group.id, "registry.")
3535
attr := group.attributes[_]
36-
attr.id != null
36+
attr.name != null
3737

3838
attr_name := get_attribute_name(attr, group)
3939

@@ -57,7 +57,7 @@ deny contains attr_registry_violation(description, group.id, attr.ref) if {
5757
}
5858

5959
# We don't allow attribute definitions to have requirement_level
60-
deny contains attr_registry_violation(description, group.id, attr.id) if {
60+
deny contains attr_registry_violation(description, group.id, attr.name) if {
6161
group := input.groups[_]
6262
startswith(group.id, "registry.")
6363

@@ -67,15 +67,15 @@ deny contains attr_registry_violation(description, group.id, attr.id) if {
6767
attr.requirement_level != "recommended"
6868

6969
# TODO (https://github.com/open-telemetry/weaver/issues/279): provide other violation properties once weaver supports it.
70-
description := sprintf("Attribute definition '%s' has requirement_level set to %s. Only attribute references can set requirement_level.", [attr.id, attr.requirement_level])
70+
description := sprintf("Attribute definition '%s' has requirement_level set to %s. Only attribute references can set requirement_level.", [attr.name, attr.requirement_level])
7171
}
7272

7373
# We require attribute definitions to have stability
74-
deny contains attr_registry_violation(description, group.id, attr.id) if {
74+
deny contains attr_registry_violation(description, group.id, attr.name) if {
7575
group := input.groups[_]
7676
attr := group.attributes[_]
7777
not attr.stability
78-
description := sprintf("Attribute definition '%s' does not contain stability field. All attribute definitions must include stability level.", [attr.id])
78+
description := sprintf("Attribute definition '%s' does not contain stability field. All attribute definitions must include stability level.", [attr.name])
7979
}
8080

8181
# We require span, metrics, events, resources definitions to have stability
@@ -90,7 +90,7 @@ deny contains attr_registry_violation(description, group.id, "") if {
9090
}
9191

9292
# check that member ids do not collide within the same attribute
93-
deny contains attr_registry_violation(description, group.id, attr.id) if {
93+
deny contains attr_registry_violation(description, group.id, attr.name) if {
9494
group := input.groups[_]
9595
startswith(group.id, "registry.")
9696

@@ -100,11 +100,11 @@ deny contains attr_registry_violation(description, group.id, attr.id) if {
100100
collisions := [n | n := attr.type.members[_].id; n == member.id ]
101101
count(collisions) > 1
102102

103-
description := sprintf("Member with id '%s' is already defined on the attribute '%s' in the group '%s'. Member id must be unique.", [member.id, attr.id, group.id])
103+
description := sprintf("Member with id '%s' is already defined on the attribute '%s' in the group '%s'. Member id must be unique.", [member.id, attr.name, group.id])
104104
}
105105

106106
# check that member values do not collide within the same attribute
107-
deny contains attr_registry_violation(description, group.id, attr.id) if {
107+
deny contains attr_registry_violation(description, group.id, attr.name) if {
108108
group := input.groups[_]
109109
startswith(group.id, "registry.")
110110
attr := group.attributes[_]
@@ -118,11 +118,11 @@ deny contains attr_registry_violation(description, group.id, attr.id) if {
118118
]
119119
count(collisions) > 1
120120

121-
description := sprintf("Member with value '%s' (id '%s') is already defined on the attribute '%s' in the group '%s'. Member value must be unique.", [member.value, member.id, attr.id, group.id])
121+
description := sprintf("Member with value '%s' (id '%s') is already defined on the attribute '%s' in the group '%s'. Member value must be unique.", [member.value, member.id, attr.name, group.id])
122122
}
123123

124124
# check that member const names do not collide within the same attribute
125-
deny contains attr_registry_violation(description, group.id, attr.id) if {
125+
deny contains attr_registry_violation(description, group.id, attr.name) if {
126126
group := input.groups[_]
127127
startswith(group.id, "registry.")
128128
attr := group.attributes[_]
@@ -138,11 +138,11 @@ deny contains attr_registry_violation(description, group.id, attr.id) if {
138138
]
139139
count(collisions) > 1
140140

141-
description := sprintf("Member with const name '%s' (id '%s'), is already defined on the attribute '%s' in the group '%s'. Member const names must be unique.", [const_name, member.id, attr.id, group.id])
141+
description := sprintf("Member with const name '%s' (id '%s'), is already defined on the attribute '%s' in the group '%s'. Member const names must be unique.", [const_name, member.id, attr.name, group.id])
142142
}
143143

144144
get_attribute_name(attr, group) := name if {
145-
full_name := concat(".", [group.prefix, attr.id])
145+
full_name := concat(".", [group.prefix, attr.name])
146146

147147
# if there was no prefix, we have a leading dot
148148
name := trim(full_name, ".")

‎policies/yaml_schema.rego‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
1-
package before_resolution
1+
package after_resolution
22
import rego.v1
33

44
# checks attribute name format
55
deny contains yaml_schema_violation(description, group.id, name) if {
66
group := input.groups[_]
77
attr := group.attributes[_]
8-
name := attr.id
8+
name := attr.name
99

1010
not regex.match(name_regex, name)
1111

@@ -16,7 +16,7 @@ deny contains yaml_schema_violation(description, group.id, name) if {
1616
deny contains yaml_schema_violation(description, group.id, name) if {
1717
group := input.groups[_]
1818
attr := group.attributes[_]
19-
name := attr.id
19+
name := attr.name
2020

2121
# some deprecated attributes have no namespace and need to be ignored
2222
not attr.deprecated
@@ -125,7 +125,7 @@ deny contains yaml_schema_violation(description, group.id, name) if {
125125
deny contains yaml_schema_violation(description, group.id, attr_name) if {
126126
group := input.groups[_]
127127
attr := group.attributes[_]
128-
attr_name := attr.id
128+
attr_name := attr.name
129129
name := attr.type.members[_].id
130130

131131
not regex.match(name_regex, name)
@@ -169,19 +169,19 @@ deny contains yaml_schema_violation(description, group.id, "") if {
169169
}
170170

171171
# brief is required on attributes
172-
deny contains yaml_schema_violation(description, group.id, attr.id) if {
172+
deny contains yaml_schema_violation(description, group.id, attr.name) if {
173173
group := input.groups[_]
174174
attr := group.attributes[_]
175-
property_or_null(attr, "brief") == null
175+
is_empty_or_null(attr, "brief")
176176

177-
description := sprintf("Attribute id '%s' in group '%s' is invalid. Attributes must have a brief.", [attr.id, group.id])
177+
description := sprintf("Attribute id '%s' in group '%s' is invalid. Attributes must have a brief.", [attr.name, group.id])
178178
}
179179

180180
# brief is required on groups (except attribute groups)
181181
deny contains yaml_schema_violation(description, group.id, "") if {
182182
group := input.groups[_]
183183
group.type != "attribute_group"
184-
property_or_null(group, "brief") == null
184+
is_empty_or_null(group, "brief")
185185

186186
description := sprintf("Group id '%s' is invalid. Groups must have a brief.", [group.id])
187187
}
@@ -204,7 +204,7 @@ has_namespace_regex := "^[a-z0-9_]+\\.([a-z0-9._]+)+$"
204204

205205
invalid_name_helper := "must consist of lowercase alphanumeric characters separated by '_' and '.'"
206206

207-
property_or_null(obj, property) := obj[property] if {
208-
obj[property]
209-
obj[property] != ""
210-
} else := null
207+
is_empty_or_null(obj, property) if {
208+
prop := object.get(obj, property, null)
209+
{prop == null, prop == ""}[_]
210+
}

‎policies_test/attribute_name_collisions_test.rego‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -3,37 +3,37 @@ import future.keywords
33

44
test_fails_on_const_name_collision if {
55
collision := {"groups": [
6-
{"id": "test1", "attributes": [{"name": "foo.bar.baz"}]},
7-
{"id": "test2", "attributes": [{"name": "foo.bar_baz"}]}
6+
{"id": "test1", "attributes": [{"name": "foo.bar.baz", "stability": "development", "brief": "brief."}]},
7+
{"id": "test2", "attributes": [{"name": "foo.bar_baz", "stability": "development", "brief": "brief."}]}
88
]}
99
# each attribute counts as a collision, so there are 2 collisions
1010
count(deny) == 2 with input as collision
1111
}
1212

1313
test_fails_on_namespace_collision if {
1414
collision := {"groups": [
15-
{"id": "test1", "attributes": [{"name": "foo.bar.baz"}]},
16-
{"id": "test2", "attributes": [{"name": "foo.bar"}]}
15+
{"id": "test1", "attributes": [{"name": "foo.bar.baz", "stability": "development", "brief": "brief."}]},
16+
{"id": "test2", "attributes": [{"name": "foo.bar", "stability": "development", "brief": "brief."}]}
1717
]}
1818
count(deny) == 1 with input as collision
1919
}
2020

2121
test_does_not_fail_on_deprecated_namespace_collision if {
2222
collision := {"groups": [
23-
{"id": "test1", "attributes": [{"name": "test.namespace.id"}]},
24-
{"id": "test2", "attributes": [{"name": "test.namespace", "deprecated": {"reason" : "obsoleted"}}]},
23+
{"id": "test1", "attributes": [{"name": "test.namespace.id", "stability": "development", "brief": "brief."}]},
24+
{"id": "test2", "attributes": [{"name": "test.namespace", "stability": "development", "brief": "brief.", "deprecated": {"reason" : "obsoleted"}}]},
2525

26-
{"id": "test3", "attributes": [{"name": "another_test.namespace.id", "deprecated": {"reason" : "renamed", "renamed_to": "another_test.namespace"}}]},
27-
{"id": "test4", "attributes": [{"name": "another_test.namespace"}]},
26+
{"id": "test3", "attributes": [{"name": "another_test.namespace.id", "stability": "development", "brief": "brief.", "deprecated": {"reason" : "renamed", "renamed_to": "another_test.namespace"}}]},
27+
{"id": "test4", "attributes": [{"name": "another_test.namespace", "stability": "development", "brief": "brief."}]},
2828
]}
2929
count(deny) == 0 with input as collision
3030
}
3131

3232
test_does_not_fail_on_excluded_name_collision if {
3333
collision := {"groups": [
34-
{"id": "test1", "attributes": [{"name": "test1.namespace.id"}, {"name": "test1.namespace_id", "annotations": {"code_generation": {"exclude": true}}}]},
34+
{"id": "test1", "attributes": [{"name": "test1.namespace.id", "stability": "development", "brief": "brief."}, {"name": "test1.namespace_id", "stability": "development", "brief": "brief.", "annotations": {"code_generation": {"exclude": true}}}]},
3535

36-
{"id": "test2", "attributes": [{"name": "test2.namespace_id"}, {"name": "test2.namespace.id", "annotations": {"code_generation": {"exclude": true}}}]},
36+
{"id": "test2", "attributes": [{"name": "test2.namespace_id", "stability": "development", "brief": "brief."}, {"name": "test2.namespace.id", "stability": "development", "brief": "brief.", "annotations": {"code_generation": {"exclude": true}}}]},
3737
]}
3838
count(deny) == 0 with input as collision
3939
}

‎policies_test/attribute_types_test.rego‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,12 @@ test_fails_on_complex_attribute if {
99
count(deny) == 1 with input as {"groups": [{ "id": concat(".", [group_type, "attr"]),
1010
"type": group_type,
1111
"stability": "development",
12+
"brief": "brief.",
1213
"attributes": [{
1314
"name": "test.any",
1415
"stability": "development",
15-
"type": attribute_type
16+
"type": attribute_type,
17+
"brief": "brief.",
1618
}]}]}
1719
}
1820
}
@@ -27,10 +29,12 @@ test_pass_on_complex_attribute if {
2729
count(deny) == 0 with input as {"groups": [{ "id": concat(".", [group_type, "attr"]),
2830
"type": group_type,
2931
"stability": "development",
32+
"brief": "brief.",
3033
"attributes": [{
3134
"name": "test.any",
3235
"stability": "development",
33-
"type": attribute_type
36+
"type": attribute_type,
37+
"brief": "brief.",
3438
}]}]}
3539
}
3640
}

0 commit comments

Comments
 (0)