Initial QSfera import

Server/vendor/github.com/open-policy-agent/opa/v1/rego/errors.go

@@ -0,0 +1,24 @@
+package rego
+
+// HaltError is an error type to return from a custom function implementation
+// that will abort the evaluation process (analogous to topdown.Halt).
+type HaltError struct {
+	err error
+}
+
+// Error delegates to the wrapped error
+func (h *HaltError) Error() string {
+	return h.err.Error()
+}
+
+// NewHaltError wraps an error such that the evaluation process will stop
+// when it occurs.
+func NewHaltError(err error) error {
+	return &HaltError{err: err}
+}
+
+// ErrorDetails interface is satisfied by an error that provides further
+// details.
+type ErrorDetails interface {
+	Lines() []string
+}

Server/vendor/github.com/open-policy-agent/opa/v1/rego/plugins.go

@@ -0,0 +1,49 @@
+// Copyright 2023 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package rego
+
+import (
+	"context"
+	"sync"
+
+	"github.com/open-policy-agent/opa/v1/ast"
+	"github.com/open-policy-agent/opa/v1/ir"
+)
+
+var targetPlugins = map[string]TargetPlugin{}
+var pluginMtx sync.Mutex
+
+type TargetPlugin interface {
+	IsTarget(string) bool
+	PrepareForEval(context.Context, *ir.Policy, ...PrepareOption) (TargetPluginEval, error)
+}
+
+type TargetPluginEval interface {
+	Eval(context.Context, *EvalContext, ast.Value) (ast.Value, error)
+}
+
+func (*Rego) targetPlugin(tgt string) TargetPlugin {
+	for _, p := range targetPlugins {
+		if p.IsTarget(tgt) {
+			return p
+		}
+	}
+	return nil
+}
+
+func RegisterPlugin(name string, p TargetPlugin) {
+	pluginMtx.Lock()
+	defer pluginMtx.Unlock()
+	if _, ok := targetPlugins[name]; ok {
+		panic("plugin already registered " + name)
+	}
+	targetPlugins[name] = p
+}
+
+func ResetTargetPlugins() {
+	pluginMtx.Lock()
+	defer pluginMtx.Unlock()
+	targetPlugins = map[string]TargetPlugin{}
+}

Server/vendor/github.com/open-policy-agent/opa/v1/rego/resultset.go

@@ -0,0 +1,102 @@
+package rego
+
+import (
+	"fmt"
+
+	"github.com/open-policy-agent/opa/v1/ast"
+)
+
+// ResultSet represents a collection of output from Rego evaluation. An empty
+// result set represents an undefined query.
+type ResultSet []Result
+
+// Vars represents a collection of variable bindings. The keys are the variable
+// names and the values are the binding values.
+type Vars map[string]any
+
+// WithoutWildcards returns a copy of v with wildcard variables removed.
+func (v Vars) WithoutWildcards() Vars {
+	n := Vars{}
+	for k, v := range v {
+		if ast.Var(k).IsWildcard() || ast.Var(k).IsGenerated() {
+			continue
+		}
+		n[k] = v
+	}
+	return n
+}
+
+// Result defines the output of Rego evaluation.
+type Result struct {
+	Expressions []*ExpressionValue `json:"expressions"`
+	Bindings    Vars               `json:"bindings,omitempty"`
+}
+
+func newResult() Result {
+	return Result{
+		Bindings: Vars{},
+	}
+}
+
+// Location defines a position in a Rego query or module.
+type Location struct {
+	Row int `json:"row"`
+	Col int `json:"col"`
+}
+
+// ExpressionValue defines the value of an expression in a Rego query.
+type ExpressionValue struct {
+	Value    any       `json:"value"`
+	Text     string    `json:"text"`
+	Location *Location `json:"location"`
+}
+
+func newExpressionValue(expr *ast.Expr, value any) *ExpressionValue {
+	result := &ExpressionValue{
+		Value: value,
+	}
+	if expr.Location != nil {
+		result.Text = string(expr.Location.Text)
+		result.Location = &Location{
+			Row: expr.Location.Row,
+			Col: expr.Location.Col,
+		}
+	}
+	return result
+}
+
+func (ev *ExpressionValue) String() string {
+	return fmt.Sprint(ev.Value)
+}
+
+// Allowed is a helper method that'll return true if all of these conditions hold:
+// - the result set only has one element
+// - there is only one expression in the result set's only element
+// - that expression has the value `true`
+// - there are no bindings.
+//
+// If bindings are present, this will yield `false`: it would be a pitfall to
+// return `true` for a query like `data.authz.allow = x`, which always has result
+// set element with value true, but could also have a binding `x: false`.
+func (rs ResultSet) Allowed() bool {
+	x, _ := ResultValue[bool](rs)
+	return x
+}
+
+// ResultValue is a helper function that'll return a value of type T if all of
+// these conditions hold:
+// - the result set only has one element
+// - there is only one expression in the result set's only element
+// - that expression has type T
+// - there are no bindings.
+func ResultValue[T any](rs ResultSet) (T, bool) {
+	var zero T
+	if len(rs) == 1 && len(rs[0].Bindings) == 0 {
+		if exprs := rs[0].Expressions; len(exprs) == 1 {
+			if v, ok := exprs[0].Value.(T); ok {
+				return v, true
+			}
+		}
+	}
+	return zero, false
+}