build(deps): bump github.com/open-policy-agent/opa from 0.64.1 to 0.65.0

Bumps [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) from 0.64.1 to 0.65.0.
- [Release notes](https://github.com/open-policy-agent/opa/releases)
- [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-policy-agent/opa/compare/v0.64.1...v0.65.0)

---
updated-dependencies:
- dependency-name: github.com/open-policy-agent/opa
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

vendor/github.com/open-policy-agent/opa/ast/annotations.go

@@ -509,6 +509,34 @@ func (a *Annotations) toObject() (*Object, *Error) {
 	return &obj, nil
 }
 
+func attachRuleAnnotations(mod *Module) {
+	// make a copy of the annotations
+	cpy := make([]*Annotations, len(mod.Annotations))
+	for i, a := range mod.Annotations {
+		cpy[i] = a.Copy(a.node)
+	}
+
+	for _, rule := range mod.Rules {
+		var j int
+		var found bool
+		for i, a := range cpy {
+			if rule.Ref().Equal(a.GetTargetPath()) {
+				if a.Scope == annotationScopeDocument {
+					rule.Annotations = append(rule.Annotations, a)
+				} else if a.Scope == annotationScopeRule && rule.Loc().Row > a.Location.Row {
+					j = i
+					found = true
+					rule.Annotations = append(rule.Annotations, a)
+				}
+			}
+		}
+
+		if found && j < len(cpy) {
+			cpy = append(cpy[:j], cpy[j+1:]...)
+		}
+	}
+}
+
 func attachAnnotationsNodes(mod *Module) Errors {
 	var errs Errors
 

vendor/github.com/open-policy-agent/opa/ast/compile.go

@@ -2196,6 +2196,8 @@ func (c *Compiler) parseMetadataBlocks() {
 				for _, err := range errs {
 					c.err(err)
 				}
+
+				attachRuleAnnotations(mod)
 			}
 		}
 	}

vendor/github.com/open-policy-agent/opa/ast/parser_ext.go

@@ -713,6 +713,8 @@ func parseModule(filename string, stmts []Statement, comments []*Comment, regoCo
 		return nil, errs
 	}
 
+	attachRuleAnnotations(mod)
+
 	return mod, nil
 }
 

vendor/github.com/open-policy-agent/opa/ast/policy.go

@@ -185,11 +185,12 @@ type (
 	// Rule represents a rule as defined in the language. Rules define the
 	// content of documents that represent policy decisions.
 	Rule struct {
-		Default  bool      `json:"default,omitempty"`
-		Head     *Head     `json:"head"`
-		Body     Body      `json:"body"`
-		Else     *Rule     `json:"else,omitempty"`
-		Location *Location `json:"location,omitempty"`
+		Default     bool           `json:"default,omitempty"`
+		Head        *Head          `json:"head"`
+		Body        Body           `json:"body"`
+		Else        *Rule          `json:"else,omitempty"`
+		Location    *Location      `json:"location,omitempty"`
+		Annotations []*Annotations `json:"annotations,omitempty"`
 
 		// Module is a pointer to the module containing this rule. If the rule
 		// was NOT created while parsing/constructing a module, this should be
@@ -309,8 +310,8 @@ func (mod *Module) Copy() *Module {
 	nodes[mod.Package] = cpy.Package
 
 	cpy.Annotations = make([]*Annotations, len(mod.Annotations))
-	for i := range mod.Annotations {
-		cpy.Annotations[i] = mod.Annotations[i].Copy(nodes[mod.Annotations[i].node])
+	for i, a := range mod.Annotations {
+		cpy.Annotations[i] = a.Copy(nodes[a.node])
 	}
 
 	cpy.Comments = make([]*Comment, len(mod.Comments))
@@ -663,6 +664,11 @@ func (rule *Rule) Compare(other *Rule) int {
 	if cmp := rule.Body.Compare(other.Body); cmp != 0 {
 		return cmp
 	}
+
+	if cmp := annotationsCompare(rule.Annotations, other.Annotations); cmp != 0 {
+		return cmp
+	}
+
 	return rule.Else.Compare(other.Else)
 }
 
@@ -671,6 +677,12 @@ func (rule *Rule) Copy() *Rule {
 	cpy := *rule
 	cpy.Head = rule.Head.Copy()
 	cpy.Body = rule.Body.Copy()
+
+	cpy.Annotations = make([]*Annotations, len(rule.Annotations))
+	for i, a := range rule.Annotations {
+		cpy.Annotations[i] = a.Copy(&cpy)
+	}
+
 	if cpy.Else != nil {
 		cpy.Else = rule.Else.Copy()
 	}
@@ -763,6 +775,10 @@ func (rule *Rule) MarshalJSON() ([]byte, error) {
 		}
 	}
 
+	if len(rule.Annotations) != 0 {
+		data["annotations"] = rule.Annotations
+	}
+
 	return json.Marshal(data)
 }
 

vendor/github.com/open-policy-agent/opa/internal/compiler/wasm/wasm.go

@@ -1139,6 +1139,17 @@ func (c *Compiler) compileBlock(block *ir.Block) ([]instruction.Instruction, err
 				instrs = append(instrs, instruction.Br{Index: 0})
 				break
 			}
+		case *ir.IsSetStmt:
+			if loc, ok := stmt.Source.Value.(ir.Local); ok {
+				instrs = append(instrs, instruction.GetLocal{Index: c.local(loc)})
+				instrs = append(instrs, instruction.Call{Index: c.function(opaValueType)})
+				instrs = append(instrs, instruction.I32Const{Value: opaTypeSet})
+				instrs = append(instrs, instruction.I32Ne{})
+				instrs = append(instrs, instruction.BrIf{Index: 0})
+			} else {
+				instrs = append(instrs, instruction.Br{Index: 0})
+				break
+			}
 		case *ir.IsUndefinedStmt:
 			instrs = append(instrs, instruction.GetLocal{Index: c.local(stmt.Source)})
 			instrs = append(instrs, instruction.I32Const{Value: 0})

vendor/github.com/open-policy-agent/opa/internal/planner/planner.go

@@ -893,6 +893,40 @@ func (p *Planner) planExprEvery(e *ast.Expr, iter planiter) error {
 	})
 
 	err := p.planTerm(every.Domain, func() error {
+		// Assert that the domain is a collection type:
+		// block outer
+		//   block a
+		//     isArray
+		//     br 1: break outer, and continue
+		//   block b
+		//     isObject
+		//     br 1: break outer, and continue
+		//   block c
+		//     isSet
+		//     br 1: break outer, and continue
+		//   br 1: invalid domain, break every
+
+		aBlock := &ir.Block{}
+		p.appendStmtToBlock(&ir.IsArrayStmt{Source: p.ltarget}, aBlock)
+		p.appendStmtToBlock(&ir.BreakStmt{Index: 1}, aBlock)
+
+		bBlock := &ir.Block{}
+		p.appendStmtToBlock(&ir.IsObjectStmt{Source: p.ltarget}, bBlock)
+		p.appendStmtToBlock(&ir.BreakStmt{Index: 1}, bBlock)
+
+		cBlock := &ir.Block{}
+		p.appendStmtToBlock(&ir.IsSetStmt{Source: p.ltarget}, cBlock)
+		p.appendStmtToBlock(&ir.BreakStmt{Index: 1}, cBlock)
+
+		outerBlock := &ir.BlockStmt{Blocks: []*ir.Block{
+			{
+				Stmts: []ir.Stmt{
+					&ir.BlockStmt{Blocks: []*ir.Block{aBlock, bBlock, cBlock}},
+					&ir.BreakStmt{Index: 1}},
+			},
+		}}
+		p.appendStmt(outerBlock)
+
 		return p.planScan(every.Key, func(ir.Local) error {
 			p.appendStmt(&ir.ResetLocalStmt{
 				Target: cond1,

vendor/github.com/open-policy-agent/opa/internal/providers/aws/util.go

@@ -8,7 +8,7 @@ import (
 	"github.com/open-policy-agent/opa/logging"
 )
 
-// DoRequestWithClient is a convenience function to get the body of an http response with
+// DoRequestWithClient is a convenience function to get the body of a http response with
 // appropriate error-handling boilerplate and logging.
 func DoRequestWithClient(req *http.Request, client *http.Client, desc string, logger logging.Logger) ([]byte, error) {
 	resp, err := client.Do(req)
@@ -24,22 +24,16 @@ func DoRequestWithClient(req *http.Request, client *http.Client, desc string, lo
 		"headers": resp.Header,
 	}).Debug("Received response from " + desc + " service.")
 
-	if resp.StatusCode != 200 {
-		if logger.GetLevel() == logging.Debug {
-			body, err := io.ReadAll(resp.Body)
-			if err == nil {
-				logger.Debug("Error response with response body: %s", body)
-			}
-		}
-		// could be 404 for role that's not available, but cover all the bases
-		return nil, errors.New(desc + " HTTP request returned unexpected status: " + resp.Status)
-	}
-
 	body, err := io.ReadAll(resp.Body)
 	if err != nil {
 		// deal with problems reading the body, whatever those might be
 		return nil, errors.New(desc + " HTTP response body could not be read: " + err.Error())
 	}
 
+	if resp.StatusCode != 200 {
+		logger.Debug("Error response with response body: %s", body)
+		// could be 404 for role that's not available, but cover all the bases
+		return nil, errors.New(desc + " HTTP request returned unexpected status: " + resp.Status)
+	}
 	return body, nil
 }

vendor/github.com/open-policy-agent/opa/ir/ir.go

@@ -364,6 +364,13 @@ type IsObjectStmt struct {
 	Location
 }
 
+// IsSetStmt represents a dynamic type check on a local variable.
+type IsSetStmt struct {
+	Source Operand `json:"source"`
+
+	Location
+}
+
 // IsDefinedStmt represents a check of whether a local variable is defined.
 type IsDefinedStmt struct {
 	Source Local `json:"source"`

vendor/github.com/open-policy-agent/opa/logging/logging.go

@@ -3,6 +3,7 @@ package logging
 import (
 	"context"
 	"io"
+	"net/http"
 
 	"github.com/sirupsen/logrus"
 )
@@ -210,10 +211,15 @@ const reqCtxKey = requestContextKey("request-context-key")
 // RequestContext represents the request context used to store data
 // related to the request that could be used on logs.
 type RequestContext struct {
-	ClientAddr string
-	ReqID      uint64
-	ReqMethod  string
-	ReqPath    string
+	ClientAddr         string
+	ReqID              uint64
+	ReqMethod          string
+	ReqPath            string
+	HTTPRequestContext HTTPRequestContext
+}
+
+type HTTPRequestContext struct {
+	Header http.Header
 }
 
 // Fields adapts the RequestContext fields to logrus.Fields.

vendor/github.com/open-policy-agent/opa/plugins/rest/auth.go

@@ -708,6 +708,7 @@ type awsSigningAuthPlugin struct {
 	AWSService          string `json:"service,omitempty"`
 	AWSSignatureVersion string `json:"signature_version,omitempty"`
 
+	host          string
 	ecrAuthPlugin *ecrAuthPlugin
 	kmsSignPlugin *awsKMSSignPlugin
 
@@ -827,6 +828,13 @@ func (ap *awsSigningAuthPlugin) NewClient(c Config) (*http.Client, error) {
 		return nil, err
 	}
 
+	url, err := url.Parse(c.URL)
+	if err != nil {
+		return nil, err
+	}
+
+	ap.host = url.Host
+
 	if ap.logger == nil {
 		ap.logger = c.logger
 	}
@@ -839,6 +847,13 @@ func (ap *awsSigningAuthPlugin) NewClient(c Config) (*http.Client, error) {
 }
 
 func (ap *awsSigningAuthPlugin) Prepare(req *http.Request) error {
+	if ap.host != req.URL.Host {
+		// Return early if the host does not match.
+		// This can happen when the OCI registry responded with a redirect to another host.
+		// For instance, ECR redirects to S3 and the ECR auth header should not be included in the S3 request.
+		return nil
+	}
+
 	switch ap.AWSService {
 	case "ecr":
 		return ap.ecrAuthPlugin.Prepare(req)

vendor/github.com/open-policy-agent/opa/topdown/eval.go

@@ -407,15 +407,9 @@ func (e *eval) evalStep(iter evalIterator) error {
 		})
 	case *ast.Every:
 		eval := evalEvery{
-			e:    e,
-			expr: expr,
-			generator: ast.NewBody(
-				ast.Equality.Expr(
-					ast.RefTerm(terms.Domain, terms.Key).SetLocation(terms.Domain.Location),
-					terms.Value,
-				).SetLocation(terms.Domain.Location),
-			),
-			body: terms.Body,
+			Every: terms,
+			e:     e,
+			expr:  expr,
 		}
 		err = eval.eval(func() error {
 			defined = true
@@ -3390,19 +3384,32 @@ func (e evalTerm) save(iter unifyIterator) error {
 }
 
 type evalEvery struct {
-	e         *eval
-	expr      *ast.Expr
-	generator ast.Body
-	body      ast.Body
+	*ast.Every
+	e    *eval
+	expr *ast.Expr
 }
 
 func (e evalEvery) eval(iter unifyIterator) error {
 	// unknowns in domain or body: save the expression, PE its body
-	if e.e.unknown(e.generator, e.e.bindings) || e.e.unknown(e.body, e.e.bindings) {
+	if e.e.unknown(e.Domain, e.e.bindings) || e.e.unknown(e.Body, e.e.bindings) {
 		return e.save(iter)
 	}
 
-	domain := e.e.closure(e.generator)
+	if pd := e.e.bindings.Plug(e.Domain); pd != nil {
+		if !isIterableValue(pd.Value) {
+			e.e.traceFail(e.expr)
+			return nil
+		}
+	}
+
+	generator := ast.NewBody(
+		ast.Equality.Expr(
+			ast.RefTerm(e.Domain, e.Key).SetLocation(e.Domain.Location),
+			e.Value,
+		).SetLocation(e.Domain.Location),
+	)
+
+	domain := e.e.closure(generator)
 	all := true // all generator evaluations yield one successful body evaluation
 
 	domain.traceEnter(e.expr)
@@ -3413,14 +3420,14 @@ func (e evalEvery) eval(iter unifyIterator) error {
 			// This would do extra work, like iterating needlessly if domain was a large array.
 			return nil
 		}
-		body := child.closure(e.body)
+		body := child.closure(e.Body)
 		body.findOne = true
-		body.traceEnter(e.body)
+		body.traceEnter(e.Body)
 		done := false
 		err := body.eval(func(*eval) error {
-			body.traceExit(e.body)
+			body.traceExit(e.Body)
 			done = true
-			body.traceRedo(e.body)
+			body.traceRedo(e.Body)
 			return nil
 		})
 		if !done {
@@ -3446,6 +3453,15 @@ func (e evalEvery) eval(iter unifyIterator) error {
 	return nil
 }
 
+// isIterableValue returns true if the AST value is an iterable type.
+func isIterableValue(x ast.Value) bool {
+	switch x.(type) {
+	case *ast.Array, ast.Object, ast.Set:
+		return true
+	}
+	return false
+}
+
 func (e *evalEvery) save(iter unifyIterator) error {
 	return e.e.saveExpr(e.plug(e.expr), e.e.bindings, iter)
 }

vendor/github.com/open-policy-agent/opa/version/version.go

@@ -11,7 +11,7 @@ import (
 )
 
 // Version is the canonical version of OPA.
-var Version = "0.64.1"
+var Version = "0.65.0"
 
 // GoVersion is the version of Go this was built with
 var GoVersion = runtime.Version()