zift 0.2.2

Scan codebases for embedded authorization logic and generate Policy as Code (Rego/OPA today)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118

use regorus::Engine;

/// Result of validating a Rego policy string.
#[derive(Debug)]
pub struct ValidationResult {
    pub valid: bool,
    pub error: Option<String>,
}

/// Validate that a Rego policy string is syntactically correct.
pub fn validate_rego(policy: &str) -> ValidationResult {
    let mut engine = Engine::new();
    match engine.add_policy("validate.rego".into(), policy.into()) {
        Ok(_) => ValidationResult {
            valid: true,
            error: None,
        },
        Err(e) => ValidationResult {
            valid: false,
            error: Some(e.to_string()),
        },
    }
}

/// Validate a Rego template by rendering it with placeholder values and checking syntax.
/// Templates may contain `{{var}}` placeholders — we substitute them with dummy values
/// to produce parseable Rego.
pub fn validate_template(template: &str) -> ValidationResult {
    // Replace "{{var}}" (quoted placeholder) with a quoted string, then
    // replace any remaining bare {{var}} with a bare identifier.
    // This matters because bare placeholders may appear in identifier positions
    // (e.g. input.user.{{attribute}}) where a quoted string would be invalid Rego.
    let re_quoted = regex::Regex::new(r#"["']\{\{(\w+)\}\}["']"#).unwrap();
    let rendered = re_quoted
        .replace_all(template, "\"placeholder\"")
        .to_string();
    let re_bare = regex::Regex::new(r"\{\{(\w+)\}\}").unwrap();
    let rendered = re_bare
        .replace_all(&rendered, "placeholder_value")
        .to_string();

    // Wrap in a minimal package to form a complete Rego module
    let full_policy = format!("package validate_template\n\nimport rego.v1\n\n{rendered}");
    validate_rego(&full_policy)
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn valid_policy() {
        let policy = r#"
package test

import rego.v1

default allow := false

allow if {
    input.user.role == "admin"
}
"#;
        let result = validate_rego(policy);
        assert!(result.valid, "expected valid, got: {:?}", result.error);
    }

    #[test]
    fn invalid_policy() {
        let policy = r#"
package test

import rego.v1

default allow := false

allow if {
    input.user.role ==
}
"#;
        let result = validate_rego(policy);
        assert!(!result.valid);
        assert!(result.error.is_some());
    }

    #[test]
    fn valid_template() {
        let template = r#"default allow := false

allow if {
    input.user.role == "{{role_value}}"
}"#;
        let result = validate_template(template);
        assert!(result.valid, "expected valid, got: {:?}", result.error);
    }

    #[test]
    fn valid_template_with_identifier_placeholder() {
        let template = r#"default allow := false

allow if {
    input.user.{{attribute}} == "{{value}}"
}"#;
        let result = validate_template(template);
        assert!(result.valid, "expected valid, got: {:?}", result.error);
    }

    #[test]
    fn valid_template_with_set() {
        let template = r#"default allow := false

allow if {
    input.user.role in {"{{role_value}}"}
}"#;
        let result = validate_template(template);
        assert!(result.valid, "expected valid, got: {:?}", result.error);
    }
}