switch to go vendoring

vendor/github.com/open-policy-agent/opa/storage/doc.go

@@ -0,0 +1,6 @@
+// Copyright 2016 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+// Package storage exposes the policy engine's storage layer.
+package storage

vendor/github.com/open-policy-agent/opa/storage/errors.go

@@ -0,0 +1,122 @@
+// Copyright 2016 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package storage
+
+import (
+	"fmt"
+)
+
+const (
+	// InternalErr indicates an unknown, internal error has occurred.
+	InternalErr = "storage_internal_error"
+
+	// NotFoundErr indicates the path used in the storage operation does not
+	// locate a document.
+	NotFoundErr = "storage_not_found_error"
+
+	// WriteConflictErr indicates a write on the path enocuntered a conflicting
+	// value inside the transaction.
+	WriteConflictErr = "storage_write_conflict_error"
+
+	// InvalidPatchErr indicates an invalid patch/write was issued. The patch
+	// was rejected.
+	InvalidPatchErr = "storage_invalid_patch_error"
+
+	// InvalidTransactionErr indicates an invalid operation was performed
+	// inside of the transaction.
+	InvalidTransactionErr = "storage_invalid_txn_error"
+
+	// TriggersNotSupportedErr indicates the caller attempted to register a
+	// trigger against a store that does not support them.
+	TriggersNotSupportedErr = "storage_triggers_not_supported_error"
+
+	// WritesNotSupportedErr indicate the caller attempted to perform a write
+	// against a store that does not support them.
+	WritesNotSupportedErr = "storage_writes_not_supported_error"
+
+	// PolicyNotSupportedErr indicate the caller attempted to perform a policy
+	// management operation against a store that does not support them.
+	PolicyNotSupportedErr = "storage_policy_not_supported_error"
+)
+
+// Error is the error type returned by the storage layer.
+type Error struct {
+	Code    string `json:"code"`
+	Message string `json:"message"`
+}
+
+func (err *Error) Error() string {
+	if err.Message != "" {
+		return fmt.Sprintf("%v: %v", err.Code, err.Message)
+	}
+	return err.Code
+}
+
+// IsNotFound returns true if this error is a NotFoundErr.
+func IsNotFound(err error) bool {
+	switch err := err.(type) {
+	case *Error:
+		return err.Code == NotFoundErr
+	}
+	return false
+}
+
+// IsWriteConflictError returns true if this error a WriteConflictErr.
+func IsWriteConflictError(err error) bool {
+	switch err := err.(type) {
+	case *Error:
+		return err.Code == WriteConflictErr
+	}
+	return false
+}
+
+// IsInvalidPatch returns true if this error is a InvalidPatchErr.
+func IsInvalidPatch(err error) bool {
+	switch err := err.(type) {
+	case *Error:
+		return err.Code == InvalidPatchErr
+	}
+	return false
+}
+
+// IsInvalidTransaction returns true if this error is a InvalidTransactionErr.
+func IsInvalidTransaction(err error) bool {
+	switch err := err.(type) {
+	case *Error:
+		return err.Code == InvalidTransactionErr
+	}
+	return false
+}
+
+// IsIndexingNotSupported is a stub for backwards-compatibility.
+//
+// Deprecated: We no longer return IndexingNotSupported errors, so it is
+// unnecessary to check for them.
+func IsIndexingNotSupported(error) bool { return false }
+
+func writeConflictError(path Path) *Error {
+	return &Error{
+		Code:    WriteConflictErr,
+		Message: path.String(),
+	}
+}
+
+func triggersNotSupportedError() *Error {
+	return &Error{
+		Code: TriggersNotSupportedErr,
+	}
+}
+
+func writesNotSupportedError() *Error {
+	return &Error{
+		Code: WritesNotSupportedErr,
+	}
+}
+
+func policyNotSupportedError() *Error {
+	return &Error{
+		Code: PolicyNotSupportedErr,
+	}
+}

vendor/github.com/open-policy-agent/opa/storage/inmem/inmem.go

@@ -0,0 +1,406 @@
+// Copyright 2016 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+// Package inmem implements an in-memory version of the policy engine's storage
+// layer.
+//
+// The in-memory store is used as the default storage layer implementation. The
+// in-memory store supports multi-reader/single-writer concurrency with
+// rollback.
+//
+// Callers should assume the in-memory store does not make copies of written
+// data. Once data is written to the in-memory store, it should not be modified
+// (outside of calling Store.Write). Furthermore, data read from the in-memory
+// store should be treated as read-only.
+package inmem
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"path/filepath"
+	"strings"
+	"sync"
+	"sync/atomic"
+
+	"github.com/open-policy-agent/opa/internal/merge"
+	"github.com/open-policy-agent/opa/storage"
+	"github.com/open-policy-agent/opa/util"
+)
+
+// New returns an empty in-memory store.
+func New() storage.Store {
+	return NewWithOpts()
+}
+
+// NewWithOpts returns an empty in-memory store, with extra options passed.
+func NewWithOpts(opts ...Opt) storage.Store {
+	s := &store{
+		data:             map[string]interface{}{},
+		triggers:         map[*handle]storage.TriggerConfig{},
+		policies:         map[string][]byte{},
+		roundTripOnWrite: true,
+	}
+
+	for _, opt := range opts {
+		opt(s)
+	}
+
+	return s
+}
+
+// NewFromObject returns a new in-memory store from the supplied data object.
+func NewFromObject(data map[string]interface{}) storage.Store {
+	return NewFromObjectWithOpts(data)
+}
+
+// NewFromObject returns a new in-memory store from the supplied data object, with the
+// options passed.
+func NewFromObjectWithOpts(data map[string]interface{}, opts ...Opt) storage.Store {
+	db := NewWithOpts(opts...)
+	ctx := context.Background()
+	txn, err := db.NewTransaction(ctx, storage.WriteParams)
+	if err != nil {
+		panic(err)
+	}
+	if err := db.Write(ctx, txn, storage.AddOp, storage.Path{}, data); err != nil {
+		panic(err)
+	}
+	if err := db.Commit(ctx, txn); err != nil {
+		panic(err)
+	}
+	return db
+}
+
+// NewFromReader returns a new in-memory store from a reader that produces a
+// JSON serialized object. This function is for test purposes.
+func NewFromReader(r io.Reader) storage.Store {
+	return NewFromReaderWithOpts(r)
+}
+
+// NewFromReader returns a new in-memory store from a reader that produces a
+// JSON serialized object, with extra options. This function is for test purposes.
+func NewFromReaderWithOpts(r io.Reader, opts ...Opt) storage.Store {
+	d := util.NewJSONDecoder(r)
+	var data map[string]interface{}
+	if err := d.Decode(&data); err != nil {
+		panic(err)
+	}
+	return NewFromObjectWithOpts(data, opts...)
+}
+
+type store struct {
+	rmu      sync.RWMutex                      // reader-writer lock
+	wmu      sync.Mutex                        // writer lock
+	xid      uint64                            // last generated transaction id
+	data     map[string]interface{}            // raw data
+	policies map[string][]byte                 // raw policies
+	triggers map[*handle]storage.TriggerConfig // registered triggers
+
+	// roundTripOnWrite, if true, means that every call to Write round trips the
+	// data through JSON before adding the data to the store. Defaults to true.
+	roundTripOnWrite bool
+}
+
+type handle struct {
+	db *store
+}
+
+func (db *store) NewTransaction(_ context.Context, params ...storage.TransactionParams) (storage.Transaction, error) {
+	var write bool
+	var ctx *storage.Context
+	if len(params) > 0 {
+		write = params[0].Write
+		ctx = params[0].Context
+	}
+	xid := atomic.AddUint64(&db.xid, uint64(1))
+	if write {
+		db.wmu.Lock()
+	} else {
+		db.rmu.RLock()
+	}
+	return newTransaction(xid, write, ctx, db), nil
+}
+
+// Truncate implements the storage.Store interface. This method must be called within a transaction.
+func (db *store) Truncate(ctx context.Context, txn storage.Transaction, params storage.TransactionParams, it storage.Iterator) error {
+	var update *storage.Update
+	var err error
+	mergedData := map[string]interface{}{}
+
+	underlying, err := db.underlying(txn)
+	if err != nil {
+		return err
+	}
+
+	for {
+		update, err = it.Next()
+		if err != nil {
+			break
+		}
+
+		if update.IsPolicy {
+			err = underlying.UpsertPolicy(strings.TrimLeft(update.Path.String(), "/"), update.Value)
+			if err != nil {
+				return err
+			}
+		} else {
+			var value interface{}
+			err = util.Unmarshal(update.Value, &value)
+			if err != nil {
+				return err
+			}
+
+			var key []string
+			dirpath := strings.TrimLeft(update.Path.String(), "/")
+			if len(dirpath) > 0 {
+				key = strings.Split(dirpath, "/")
+			}
+
+			if value != nil {
+				obj, err := mktree(key, value)
+				if err != nil {
+					return err
+				}
+
+				merged, ok := merge.InterfaceMaps(mergedData, obj)
+				if !ok {
+					return fmt.Errorf("failed to insert data file from path %s", filepath.Join(key...))
+				}
+				mergedData = merged
+			}
+		}
+	}
+
+	if err != nil && err != io.EOF {
+		return err
+	}
+
+	// For backwards compatibility, check if `RootOverwrite` was configured.
+	if params.RootOverwrite {
+		newPath, ok := storage.ParsePathEscaped("/")
+		if !ok {
+			return fmt.Errorf("storage path invalid: %v", newPath)
+		}
+		return underlying.Write(storage.AddOp, newPath, mergedData)
+	}
+
+	for _, root := range params.BasePaths {
+		newPath, ok := storage.ParsePathEscaped("/" + root)
+		if !ok {
+			return fmt.Errorf("storage path invalid: %v", newPath)
+		}
+
+		if value, ok := lookup(newPath, mergedData); ok {
+			if len(newPath) > 0 {
+				if err := storage.MakeDir(ctx, db, txn, newPath[:len(newPath)-1]); err != nil {
+					return err
+				}
+			}
+			if err := underlying.Write(storage.AddOp, newPath, value); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func (db *store) Commit(ctx context.Context, txn storage.Transaction) error {
+	underlying, err := db.underlying(txn)
+	if err != nil {
+		return err
+	}
+	if underlying.write {
+		db.rmu.Lock()
+		event := underlying.Commit()
+		db.runOnCommitTriggers(ctx, txn, event)
+		// Mark the transaction stale after executing triggers, so they can
+		// perform store operations if needed.
+		underlying.stale = true
+		db.rmu.Unlock()
+		db.wmu.Unlock()
+	} else {
+		db.rmu.RUnlock()
+	}
+	return nil
+}
+
+func (db *store) Abort(_ context.Context, txn storage.Transaction) {
+	underlying, err := db.underlying(txn)
+	if err != nil {
+		panic(err)
+	}
+	underlying.stale = true
+	if underlying.write {
+		db.wmu.Unlock()
+	} else {
+		db.rmu.RUnlock()
+	}
+}
+
+func (db *store) ListPolicies(_ context.Context, txn storage.Transaction) ([]string, error) {
+	underlying, err := db.underlying(txn)
+	if err != nil {
+		return nil, err
+	}
+	return underlying.ListPolicies(), nil
+}
+
+func (db *store) GetPolicy(_ context.Context, txn storage.Transaction, id string) ([]byte, error) {
+	underlying, err := db.underlying(txn)
+	if err != nil {
+		return nil, err
+	}
+	return underlying.GetPolicy(id)
+}
+
+func (db *store) UpsertPolicy(_ context.Context, txn storage.Transaction, id string, bs []byte) error {
+	underlying, err := db.underlying(txn)
+	if err != nil {
+		return err
+	}
+	return underlying.UpsertPolicy(id, bs)
+}
+
+func (db *store) DeletePolicy(_ context.Context, txn storage.Transaction, id string) error {
+	underlying, err := db.underlying(txn)
+	if err != nil {
+		return err
+	}
+	if _, err := underlying.GetPolicy(id); err != nil {
+		return err
+	}
+	return underlying.DeletePolicy(id)
+}
+
+func (db *store) Register(_ context.Context, txn storage.Transaction, config storage.TriggerConfig) (storage.TriggerHandle, error) {
+	underlying, err := db.underlying(txn)
+	if err != nil {
+		return nil, err
+	}
+	if !underlying.write {
+		return nil, &storage.Error{
+			Code:    storage.InvalidTransactionErr,
+			Message: "triggers must be registered with a write transaction",
+		}
+	}
+	h := &handle{db}
+	db.triggers[h] = config
+	return h, nil
+}
+
+func (db *store) Read(_ context.Context, txn storage.Transaction, path storage.Path) (interface{}, error) {
+	underlying, err := db.underlying(txn)
+	if err != nil {
+		return nil, err
+	}
+	return underlying.Read(path)
+}
+
+func (db *store) Write(_ context.Context, txn storage.Transaction, op storage.PatchOp, path storage.Path, value interface{}) error {
+	underlying, err := db.underlying(txn)
+	if err != nil {
+		return err
+	}
+	val := util.Reference(value)
+	if db.roundTripOnWrite {
+		if err := util.RoundTrip(val); err != nil {
+			return err
+		}
+	}
+	return underlying.Write(op, path, *val)
+}
+
+func (h *handle) Unregister(_ context.Context, txn storage.Transaction) {
+	underlying, err := h.db.underlying(txn)
+	if err != nil {
+		panic(err)
+	}
+	if !underlying.write {
+		panic(&storage.Error{
+			Code:    storage.InvalidTransactionErr,
+			Message: "triggers must be unregistered with a write transaction",
+		})
+	}
+	delete(h.db.triggers, h)
+}
+
+func (db *store) runOnCommitTriggers(ctx context.Context, txn storage.Transaction, event storage.TriggerEvent) {
+	for _, t := range db.triggers {
+		t.OnCommit(ctx, txn, event)
+	}
+}
+
+func (db *store) underlying(txn storage.Transaction) (*transaction, error) {
+	underlying, ok := txn.(*transaction)
+	if !ok {
+		return nil, &storage.Error{
+			Code:    storage.InvalidTransactionErr,
+			Message: fmt.Sprintf("unexpected transaction type %T", txn),
+		}
+	}
+	if underlying.db != db {
+		return nil, &storage.Error{
+			Code:    storage.InvalidTransactionErr,
+			Message: "unknown transaction",
+		}
+	}
+	if underlying.stale {
+		return nil, &storage.Error{
+			Code:    storage.InvalidTransactionErr,
+			Message: "stale transaction",
+		}
+	}
+	return underlying, nil
+}
+
+const rootMustBeObjectMsg = "root must be object"
+const rootCannotBeRemovedMsg = "root cannot be removed"
+
+func invalidPatchError(f string, a ...interface{}) *storage.Error {
+	return &storage.Error{
+		Code:    storage.InvalidPatchErr,
+		Message: fmt.Sprintf(f, a...),
+	}
+}
+
+func mktree(path []string, value interface{}) (map[string]interface{}, error) {
+	if len(path) == 0 {
+		// For 0 length path the value is the full tree.
+		obj, ok := value.(map[string]interface{})
+		if !ok {
+			return nil, invalidPatchError(rootMustBeObjectMsg)
+		}
+		return obj, nil
+	}
+
+	dir := map[string]interface{}{}
+	for i := len(path) - 1; i > 0; i-- {
+		dir[path[i]] = value
+		value = dir
+		dir = map[string]interface{}{}
+	}
+	dir[path[0]] = value
+
+	return dir, nil
+}
+
+func lookup(path storage.Path, data map[string]interface{}) (interface{}, bool) {
+	if len(path) == 0 {
+		return data, true
+	}
+	for i := 0; i < len(path)-1; i++ {
+		value, ok := data[path[i]]
+		if !ok {
+			return nil, false
+		}
+		obj, ok := value.(map[string]interface{})
+		if !ok {
+			return nil, false
+		}
+		data = obj
+	}
+	value, ok := data[path[len(path)-1]]
+	return value, ok
+}

vendor/github.com/open-policy-agent/opa/storage/inmem/opts.go

@@ -0,0 +1,25 @@
+package inmem
+
+// An Opt modifies store at instantiation.
+type Opt func(*store)
+
+// OptRoundTripOnWrite sets whether incoming objects written to store are
+// round-tripped through JSON to ensure they are serializable to JSON.
+//
+// Callers should disable this if they can guarantee all objects passed to
+// Write() are serializable to JSON. Failing to do so may result in undefined
+// behavior, including panics.
+//
+// Usually, when only storing objects in the inmem store that have been read
+// via encoding/json, this is safe to disable, and comes with an improvement
+// in performance and memory use.
+//
+// If setting to false, callers should deep-copy any objects passed to Write()
+// unless they can guarantee the objects will not be mutated after being written,
+// and that mutations happening to the objects after they have been passed into
+// Write() don't affect their logic.
+func OptRoundTripOnWrite(enabled bool) Opt {
+	return func(s *store) {
+		s.roundTripOnWrite = enabled
+	}
+}

vendor/github.com/open-policy-agent/opa/storage/inmem/txn.go

@@ -0,0 +1,396 @@
+// Copyright 2017 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package inmem
+
+import (
+	"container/list"
+	"encoding/json"
+	"strconv"
+
+	"github.com/open-policy-agent/opa/internal/deepcopy"
+	"github.com/open-policy-agent/opa/storage"
+	"github.com/open-policy-agent/opa/storage/internal/errors"
+	"github.com/open-policy-agent/opa/storage/internal/ptr"
+)
+
+// transaction implements the low-level read/write operations on the in-memory
+// store and contains the state required for pending transactions.
+//
+// For write transactions, the struct contains a logical set of updates
+// performed by write operations in the transaction. Each write operation
+// compacts the set such that two updates never overlap:
+//
+// - If new update path is a prefix of existing update path, existing update is
+// removed, new update is added.
+//
+// - If existing update path is a prefix of new update path, existing update is
+// modified.
+//
+// - Otherwise, new update is added.
+//
+// Read transactions do not require any special handling and simply passthrough
+// to the underlying store. Read transactions do not support upgrade.
+type transaction struct {
+	xid      uint64
+	write    bool
+	stale    bool
+	db       *store
+	updates  *list.List
+	policies map[string]policyUpdate
+	context  *storage.Context
+}
+
+type policyUpdate struct {
+	value  []byte
+	remove bool
+}
+
+func newTransaction(xid uint64, write bool, context *storage.Context, db *store) *transaction {
+	return &transaction{
+		xid:      xid,
+		write:    write,
+		db:       db,
+		policies: map[string]policyUpdate{},
+		updates:  list.New(),
+		context:  context,
+	}
+}
+
+func (txn *transaction) ID() uint64 {
+	return txn.xid
+}
+
+func (txn *transaction) Write(op storage.PatchOp, path storage.Path, value interface{}) error {
+
+	if !txn.write {
+		return &storage.Error{
+			Code:    storage.InvalidTransactionErr,
+			Message: "data write during read transaction",
+		}
+	}
+
+	if len(path) == 0 {
+		return txn.updateRoot(op, value)
+	}
+
+	for curr := txn.updates.Front(); curr != nil; {
+		update := curr.Value.(*update)
+
+		// Check if new update masks existing update exactly. In this case, the
+		// existing update can be removed and no other updates have to be
+		// visited (because no two updates overlap.)
+		if update.path.Equal(path) {
+			if update.remove {
+				if op != storage.AddOp {
+					return errors.NewNotFoundError(path)
+				}
+			}
+			txn.updates.Remove(curr)
+			break
+		}
+
+		// Check if new update masks existing update. In this case, the
+		// existing update has to be removed but other updates may overlap, so
+		// we must continue.
+		if update.path.HasPrefix(path) {
+			remove := curr
+			curr = curr.Next()
+			txn.updates.Remove(remove)
+			continue
+		}
+
+		// Check if new update modifies existing update. In this case, the
+		// existing update is mutated.
+		if path.HasPrefix(update.path) {
+			if update.remove {
+				return errors.NewNotFoundError(path)
+			}
+			suffix := path[len(update.path):]
+			newUpdate, err := newUpdate(update.value, op, suffix, 0, value)
+			if err != nil {
+				return err
+			}
+			update.value = newUpdate.Apply(update.value)
+			return nil
+		}
+
+		curr = curr.Next()
+	}
+
+	update, err := newUpdate(txn.db.data, op, path, 0, value)
+	if err != nil {
+		return err
+	}
+
+	txn.updates.PushFront(update)
+	return nil
+}
+
+func (txn *transaction) updateRoot(op storage.PatchOp, value interface{}) error {
+	if op == storage.RemoveOp {
+		return invalidPatchError(rootCannotBeRemovedMsg)
+	}
+	if _, ok := value.(map[string]interface{}); !ok {
+		return invalidPatchError(rootMustBeObjectMsg)
+	}
+	txn.updates.Init()
+	txn.updates.PushFront(&update{
+		path:   storage.Path{},
+		remove: false,
+		value:  value,
+	})
+	return nil
+}
+
+func (txn *transaction) Commit() (result storage.TriggerEvent) {
+	result.Context = txn.context
+	for curr := txn.updates.Front(); curr != nil; curr = curr.Next() {
+		action := curr.Value.(*update)
+		updated := action.Apply(txn.db.data)
+		txn.db.data = updated.(map[string]interface{})
+
+		result.Data = append(result.Data, storage.DataEvent{
+			Path:    action.path,
+			Data:    action.value,
+			Removed: action.remove,
+		})
+	}
+	for id, update := range txn.policies {
+		if update.remove {
+			delete(txn.db.policies, id)
+		} else {
+			txn.db.policies[id] = update.value
+		}
+
+		result.Policy = append(result.Policy, storage.PolicyEvent{
+			ID:      id,
+			Data:    update.value,
+			Removed: update.remove,
+		})
+	}
+	return result
+}
+
+func (txn *transaction) Read(path storage.Path) (interface{}, error) {
+
+	if !txn.write {
+		return ptr.Ptr(txn.db.data, path)
+	}
+
+	merge := []*update{}
+
+	for curr := txn.updates.Front(); curr != nil; curr = curr.Next() {
+
+		update := curr.Value.(*update)
+
+		if path.HasPrefix(update.path) {
+			if update.remove {
+				return nil, errors.NewNotFoundError(path)
+			}
+			return ptr.Ptr(update.value, path[len(update.path):])
+		}
+
+		if update.path.HasPrefix(path) {
+			merge = append(merge, update)
+		}
+	}
+
+	data, err := ptr.Ptr(txn.db.data, path)
+
+	if err != nil {
+		return nil, err
+	}
+
+	if len(merge) == 0 {
+		return data, nil
+	}
+
+	cpy := deepcopy.DeepCopy(data)
+
+	for _, update := range merge {
+		cpy = update.Relative(path).Apply(cpy)
+	}
+
+	return cpy, nil
+}
+
+func (txn *transaction) ListPolicies() []string {
+	var ids []string
+	for id := range txn.db.policies {
+		if _, ok := txn.policies[id]; !ok {
+			ids = append(ids, id)
+		}
+	}
+	for id, update := range txn.policies {
+		if !update.remove {
+			ids = append(ids, id)
+		}
+	}
+	return ids
+}
+
+func (txn *transaction) GetPolicy(id string) ([]byte, error) {
+	if update, ok := txn.policies[id]; ok {
+		if !update.remove {
+			return update.value, nil
+		}
+		return nil, errors.NewNotFoundErrorf("policy id %q", id)
+	}
+	if exist, ok := txn.db.policies[id]; ok {
+		return exist, nil
+	}
+	return nil, errors.NewNotFoundErrorf("policy id %q", id)
+}
+
+func (txn *transaction) UpsertPolicy(id string, bs []byte) error {
+	if !txn.write {
+		return &storage.Error{
+			Code:    storage.InvalidTransactionErr,
+			Message: "policy write during read transaction",
+		}
+	}
+	txn.policies[id] = policyUpdate{bs, false}
+	return nil
+}
+
+func (txn *transaction) DeletePolicy(id string) error {
+	if !txn.write {
+		return &storage.Error{
+			Code:    storage.InvalidTransactionErr,
+			Message: "policy write during read transaction",
+		}
+	}
+	txn.policies[id] = policyUpdate{nil, true}
+	return nil
+}
+
+// update contains state associated with an update to be applied to the
+// in-memory data store.
+type update struct {
+	path   storage.Path // data path modified by update
+	remove bool         // indicates whether update removes the value at path
+	value  interface{}  // value to add/replace at path (ignored if remove is true)
+}
+
+func newUpdate(data interface{}, op storage.PatchOp, path storage.Path, idx int, value interface{}) (*update, error) {
+
+	switch data := data.(type) {
+	case map[string]interface{}:
+		return newUpdateObject(data, op, path, idx, value)
+
+	case []interface{}:
+		return newUpdateArray(data, op, path, idx, value)
+
+	case nil, bool, json.Number, string:
+		return nil, errors.NewNotFoundError(path)
+	}
+
+	return nil, &storage.Error{
+		Code:    storage.InternalErr,
+		Message: "invalid data value encountered",
+	}
+}
+
+func newUpdateArray(data []interface{}, op storage.PatchOp, path storage.Path, idx int, value interface{}) (*update, error) {
+
+	if idx == len(path)-1 {
+		if path[idx] == "-" || path[idx] == strconv.Itoa(len(data)) {
+			if op != storage.AddOp {
+				return nil, invalidPatchError("%v: invalid patch path", path)
+			}
+			cpy := make([]interface{}, len(data)+1)
+			copy(cpy, data)
+			cpy[len(data)] = value
+			return &update{path[:len(path)-1], false, cpy}, nil
+		}
+
+		pos, err := ptr.ValidateArrayIndex(data, path[idx], path)
+		if err != nil {
+			return nil, err
+		}
+
+		switch op {
+		case storage.AddOp:
+			cpy := make([]interface{}, len(data)+1)
+			copy(cpy[:pos], data[:pos])
+			copy(cpy[pos+1:], data[pos:])
+			cpy[pos] = value
+			return &update{path[:len(path)-1], false, cpy}, nil
+
+		case storage.RemoveOp:
+			cpy := make([]interface{}, len(data)-1)
+			copy(cpy[:pos], data[:pos])
+			copy(cpy[pos:], data[pos+1:])
+			return &update{path[:len(path)-1], false, cpy}, nil
+
+		default:
+			cpy := make([]interface{}, len(data))
+			copy(cpy, data)
+			cpy[pos] = value
+			return &update{path[:len(path)-1], false, cpy}, nil
+		}
+	}
+
+	pos, err := ptr.ValidateArrayIndex(data, path[idx], path)
+	if err != nil {
+		return nil, err
+	}
+
+	return newUpdate(data[pos], op, path, idx+1, value)
+}
+
+func newUpdateObject(data map[string]interface{}, op storage.PatchOp, path storage.Path, idx int, value interface{}) (*update, error) {
+
+	if idx == len(path)-1 {
+		switch op {
+		case storage.ReplaceOp, storage.RemoveOp:
+			if _, ok := data[path[idx]]; !ok {
+				return nil, errors.NewNotFoundError(path)
+			}
+		}
+		return &update{path, op == storage.RemoveOp, value}, nil
+	}
+
+	if data, ok := data[path[idx]]; ok {
+		return newUpdate(data, op, path, idx+1, value)
+	}
+
+	return nil, errors.NewNotFoundError(path)
+}
+func (u *update) Apply(data interface{}) interface{} {
+	if len(u.path) == 0 {
+		return u.value
+	}
+	parent, err := ptr.Ptr(data, u.path[:len(u.path)-1])
+	if err != nil {
+		panic(err)
+	}
+	key := u.path[len(u.path)-1]
+	if u.remove {
+		obj := parent.(map[string]interface{})
+		delete(obj, key)
+		return data
+	}
+	switch parent := parent.(type) {
+	case map[string]interface{}:
+		if parent == nil {
+			parent = make(map[string]interface{}, 1)
+		}
+		parent[key] = u.value
+	case []interface{}:
+		idx, err := strconv.Atoi(key)
+		if err != nil {
+			panic(err)
+		}
+		parent[idx] = u.value
+	}
+	return data
+}
+
+func (u *update) Relative(path storage.Path) *update {
+	cpy := *u
+	cpy.path = cpy.path[len(path):]
+	return &cpy
+}

vendor/github.com/open-policy-agent/opa/storage/interface.go

@@ -0,0 +1,247 @@
+// Copyright 2016 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package storage
+
+import (
+	"context"
+
+	"github.com/open-policy-agent/opa/metrics"
+)
+
+// Transaction defines the interface that identifies a consistent snapshot over
+// the policy engine's storage layer.
+type Transaction interface {
+	ID() uint64
+}
+
+// Store defines the interface for the storage layer's backend.
+type Store interface {
+	Trigger
+	Policy
+
+	// NewTransaction is called create a new transaction in the store.
+	NewTransaction(context.Context, ...TransactionParams) (Transaction, error)
+
+	// Read is called to fetch a document referred to by path.
+	Read(context.Context, Transaction, Path) (interface{}, error)
+
+	// Write is called to modify a document referred to by path.
+	Write(context.Context, Transaction, PatchOp, Path, interface{}) error
+
+	// Commit is called to finish the transaction. If Commit returns an error, the
+	// transaction must be automatically aborted by the Store implementation.
+	Commit(context.Context, Transaction) error
+
+	// Truncate is called to make a copy of the underlying store, write documents in the new store
+	// by creating multiple transactions in the new store as needed and finally swapping
+	// over to the new storage instance. This method must be called within a transaction on the original store.
+	Truncate(context.Context, Transaction, TransactionParams, Iterator) error
+
+	// Abort is called to cancel the transaction.
+	Abort(context.Context, Transaction)
+}
+
+// MakeDirer defines the interface a Store could realize to override the
+// generic MakeDir functionality in storage.MakeDir
+type MakeDirer interface {
+	MakeDir(context.Context, Transaction, Path) error
+}
+
+// TransactionParams describes a new transaction.
+type TransactionParams struct {
+
+	// BasePaths indicates the top-level paths where write operations will be performed in this transaction.
+	BasePaths []string
+
+	// RootOverwrite is deprecated. Use BasePaths instead.
+	RootOverwrite bool
+
+	// Write indicates if this transaction will perform any write operations.
+	Write bool
+
+	// Context contains key/value pairs passed to triggers.
+	Context *Context
+}
+
+// Context is a simple container for key/value pairs.
+type Context struct {
+	values map[interface{}]interface{}
+}
+
+// NewContext returns a new context object.
+func NewContext() *Context {
+	return &Context{
+		values: map[interface{}]interface{}{},
+	}
+}
+
+// Get returns the key value in the context.
+func (ctx *Context) Get(key interface{}) interface{} {
+	if ctx == nil {
+		return nil
+	}
+	return ctx.values[key]
+}
+
+// Put adds a key/value pair to the context.
+func (ctx *Context) Put(key, value interface{}) {
+	ctx.values[key] = value
+}
+
+var metricsKey = struct{}{}
+
+// WithMetrics allows passing metrics via the Context.
+// It puts the metrics object in the ctx, and returns the same
+// ctx (not a copy) for convenience.
+func (ctx *Context) WithMetrics(m metrics.Metrics) *Context {
+	ctx.values[metricsKey] = m
+	return ctx
+}
+
+// Metrics() allows using a Context's metrics. Returns nil if metrics
+// were not attached to the Context.
+func (ctx *Context) Metrics() metrics.Metrics {
+	if m, ok := ctx.values[metricsKey]; ok {
+		if met, ok := m.(metrics.Metrics); ok {
+			return met
+		}
+	}
+	return nil
+}
+
+// WriteParams specifies the TransactionParams for a write transaction.
+var WriteParams = TransactionParams{
+	Write: true,
+}
+
+// PatchOp is the enumeration of supposed modifications.
+type PatchOp int
+
+// Patch supports add, remove, and replace operations.
+const (
+	AddOp     PatchOp = iota
+	RemoveOp          = iota
+	ReplaceOp         = iota
+)
+
+// WritesNotSupported provides a default implementation of the write
+// interface which may be used if the backend does not support writes.
+type WritesNotSupported struct{}
+
+func (WritesNotSupported) Write(context.Context, Transaction, PatchOp, Path, interface{}) error {
+	return writesNotSupportedError()
+}
+
+// Policy defines the interface for policy module storage.
+type Policy interface {
+	ListPolicies(context.Context, Transaction) ([]string, error)
+	GetPolicy(context.Context, Transaction, string) ([]byte, error)
+	UpsertPolicy(context.Context, Transaction, string, []byte) error
+	DeletePolicy(context.Context, Transaction, string) error
+}
+
+// PolicyNotSupported provides a default implementation of the policy interface
+// which may be used if the backend does not support policy storage.
+type PolicyNotSupported struct{}
+
+// ListPolicies always returns a PolicyNotSupportedErr.
+func (PolicyNotSupported) ListPolicies(context.Context, Transaction) ([]string, error) {
+	return nil, policyNotSupportedError()
+}
+
+// GetPolicy always returns a PolicyNotSupportedErr.
+func (PolicyNotSupported) GetPolicy(context.Context, Transaction, string) ([]byte, error) {
+	return nil, policyNotSupportedError()
+}
+
+// UpsertPolicy always returns a PolicyNotSupportedErr.
+func (PolicyNotSupported) UpsertPolicy(context.Context, Transaction, string, []byte) error {
+	return policyNotSupportedError()
+}
+
+// DeletePolicy always returns a PolicyNotSupportedErr.
+func (PolicyNotSupported) DeletePolicy(context.Context, Transaction, string) error {
+	return policyNotSupportedError()
+}
+
+// PolicyEvent describes a change to a policy.
+type PolicyEvent struct {
+	ID      string
+	Data    []byte
+	Removed bool
+}
+
+// DataEvent describes a change to a base data document.
+type DataEvent struct {
+	Path    Path
+	Data    interface{}
+	Removed bool
+}
+
+// TriggerEvent describes the changes that caused the trigger to be invoked.
+type TriggerEvent struct {
+	Policy  []PolicyEvent
+	Data    []DataEvent
+	Context *Context
+}
+
+// IsZero returns true if the TriggerEvent indicates no changes occurred. This
+// function is primarily for test purposes.
+func (e TriggerEvent) IsZero() bool {
+	return !e.PolicyChanged() && !e.DataChanged()
+}
+
+// PolicyChanged returns true if the trigger was caused by a policy change.
+func (e TriggerEvent) PolicyChanged() bool {
+	return len(e.Policy) > 0
+}
+
+// DataChanged returns true if the trigger was caused by a data change.
+func (e TriggerEvent) DataChanged() bool {
+	return len(e.Data) > 0
+}
+
+// TriggerConfig contains the trigger registration configuration.
+type TriggerConfig struct {
+
+	// OnCommit is invoked when a transaction is successfully committed. The
+	// callback is invoked with a handle to the write transaction that
+	// successfully committed before other clients see the changes.
+	OnCommit func(context.Context, Transaction, TriggerEvent)
+}
+
+// Trigger defines the interface that stores implement to register for change
+// notifications when the store is changed.
+type Trigger interface {
+	Register(context.Context, Transaction, TriggerConfig) (TriggerHandle, error)
+}
+
+// TriggersNotSupported provides default implementations of the Trigger
+// interface which may be used if the backend does not support triggers.
+type TriggersNotSupported struct{}
+
+// Register always returns an error indicating triggers are not supported.
+func (TriggersNotSupported) Register(context.Context, Transaction, TriggerConfig) (TriggerHandle, error) {
+	return nil, triggersNotSupportedError()
+}
+
+// TriggerHandle defines the interface that can be used to unregister triggers that have
+// been registered on a Store.
+type TriggerHandle interface {
+	Unregister(context.Context, Transaction)
+}
+
+// Iterator defines the interface that can be used to read files from a directory starting with
+// files at the base of the directory, then sub-directories etc.
+type Iterator interface {
+	Next() (*Update, error)
+}
+
+// Update contains information about a file
+type Update struct {
+	Path     Path
+	Value    []byte
+	IsPolicy bool
+}

vendor/github.com/open-policy-agent/opa/storage/internal/errors/errors.go

@@ -0,0 +1,39 @@
+// Copyright 2021 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+// Package errors contains reusable error-related code for the storage layer.
+package errors
+
+import (
+	"fmt"
+
+	"github.com/open-policy-agent/opa/storage"
+)
+
+const ArrayIndexTypeMsg = "array index must be integer"
+const DoesNotExistMsg = "document does not exist"
+const OutOfRangeMsg = "array index out of range"
+
+func NewNotFoundError(path storage.Path) *storage.Error {
+	return NewNotFoundErrorWithHint(path, DoesNotExistMsg)
+}
+
+func NewNotFoundErrorWithHint(path storage.Path, hint string) *storage.Error {
+	return NewNotFoundErrorf("%v: %v", path.String(), hint)
+}
+
+func NewNotFoundErrorf(f string, a ...interface{}) *storage.Error {
+	msg := fmt.Sprintf(f, a...)
+	return &storage.Error{
+		Code:    storage.NotFoundErr,
+		Message: msg,
+	}
+}
+
+func NewWriteConflictError(p storage.Path) *storage.Error {
+	return &storage.Error{
+		Code:    storage.WriteConflictErr,
+		Message: p.String(),
+	}
+}

vendor/github.com/open-policy-agent/opa/storage/internal/ptr/ptr.go

@@ -0,0 +1,68 @@
+// Copyright 2021 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+// Package ptr provides utilities for pointer operations using storage layer paths.
+package ptr
+
+import (
+	"strconv"
+
+	"github.com/open-policy-agent/opa/storage"
+	"github.com/open-policy-agent/opa/storage/internal/errors"
+)
+
+func Ptr(data interface{}, path storage.Path) (interface{}, error) {
+	node := data
+	for i := range path {
+		key := path[i]
+		switch curr := node.(type) {
+		case map[string]interface{}:
+			var ok bool
+			if node, ok = curr[key]; !ok {
+				return nil, errors.NewNotFoundError(path)
+			}
+		case []interface{}:
+			pos, err := ValidateArrayIndex(curr, key, path)
+			if err != nil {
+				return nil, err
+			}
+			node = curr[pos]
+		default:
+			return nil, errors.NewNotFoundError(path)
+		}
+	}
+
+	return node, nil
+}
+
+func ValidateArrayIndex(arr []interface{}, s string, path storage.Path) (int, error) {
+	idx, ok := isInt(s)
+	if !ok {
+		return 0, errors.NewNotFoundErrorWithHint(path, errors.ArrayIndexTypeMsg)
+	}
+	return inRange(idx, arr, path)
+}
+
+// ValidateArrayIndexForWrite also checks that `s` is a valid way to address an
+// array element like `ValidateArrayIndex`, but returns a `resource_conflict` error
+// if it is not.
+func ValidateArrayIndexForWrite(arr []interface{}, s string, i int, path storage.Path) (int, error) {
+	idx, ok := isInt(s)
+	if !ok {
+		return 0, errors.NewWriteConflictError(path[:i-1])
+	}
+	return inRange(idx, arr, path)
+}
+
+func isInt(s string) (int, bool) {
+	idx, err := strconv.Atoi(s)
+	return idx, err == nil
+}
+
+func inRange(i int, arr []interface{}, path storage.Path) (int, error) {
+	if i < 0 || i >= len(arr) {
+		return 0, errors.NewNotFoundErrorWithHint(path, errors.OutOfRangeMsg)
+	}
+	return i, nil
+}

vendor/github.com/open-policy-agent/opa/storage/path.go

@@ -0,0 +1,154 @@
+// Copyright 2016 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package storage
+
+import (
+	"fmt"
+	"net/url"
+	"strconv"
+	"strings"
+
+	"github.com/open-policy-agent/opa/ast"
+)
+
+// Path refers to a document in storage.
+type Path []string
+
+// ParsePath returns a new path for the given str.
+func ParsePath(str string) (path Path, ok bool) {
+	if len(str) == 0 {
+		return nil, false
+	}
+	if str[0] != '/' {
+		return nil, false
+	}
+	if len(str) == 1 {
+		return Path{}, true
+	}
+	parts := strings.Split(str[1:], "/")
+	return parts, true
+}
+
+// ParsePathEscaped returns a new path for the given escaped str.
+func ParsePathEscaped(str string) (path Path, ok bool) {
+	path, ok = ParsePath(str)
+	if !ok {
+		return
+	}
+	for i := range path {
+		segment, err := url.PathUnescape(path[i])
+		if err == nil {
+			path[i] = segment
+		}
+	}
+	return
+}
+
+// NewPathForRef returns a new path for the given ref.
+func NewPathForRef(ref ast.Ref) (path Path, err error) {
+
+	if len(ref) == 0 {
+		return nil, fmt.Errorf("empty reference (indicates error in caller)")
+	}
+
+	if len(ref) == 1 {
+		return Path{}, nil
+	}
+
+	path = make(Path, 0, len(ref)-1)
+
+	for _, term := range ref[1:] {
+		switch v := term.Value.(type) {
+		case ast.String:
+			path = append(path, string(v))
+		case ast.Number:
+			path = append(path, v.String())
+		case ast.Boolean, ast.Null:
+			return nil, &Error{
+				Code:    NotFoundErr,
+				Message: fmt.Sprintf("%v: does not exist", ref),
+			}
+		case *ast.Array, ast.Object, ast.Set:
+			return nil, fmt.Errorf("composites cannot be base document keys: %v", ref)
+		default:
+			return nil, fmt.Errorf("unresolved reference (indicates error in caller): %v", ref)
+		}
+	}
+
+	return path, nil
+}
+
+// Compare performs lexigraphical comparison on p and other and returns -1 if p
+// is less than other, 0 if p is equal to other, or 1 if p is greater than
+// other.
+func (p Path) Compare(other Path) (cmp int) {
+	min := len(p)
+	if len(other) < min {
+		min = len(other)
+	}
+	for i := 0; i < min; i++ {
+		if cmp := strings.Compare(p[i], other[i]); cmp != 0 {
+			return cmp
+		}
+	}
+	if len(p) < len(other) {
+		return -1
+	}
+	if len(p) == len(other) {
+		return 0
+	}
+	return 1
+}
+
+// Equal returns true if p is the same as other.
+func (p Path) Equal(other Path) bool {
+	return p.Compare(other) == 0
+}
+
+// HasPrefix returns true if p starts with other.
+func (p Path) HasPrefix(other Path) bool {
+	if len(other) > len(p) {
+		return false
+	}
+	for i := range other {
+		if p[i] != other[i] {
+			return false
+		}
+	}
+	return true
+}
+
+// Ref returns a ref that represents p rooted at head.
+func (p Path) Ref(head *ast.Term) (ref ast.Ref) {
+	ref = make(ast.Ref, len(p)+1)
+	ref[0] = head
+	for i := range p {
+		idx, err := strconv.ParseInt(p[i], 10, 64)
+		if err == nil {
+			ref[i+1] = ast.UIntNumberTerm(uint64(idx))
+		} else {
+			ref[i+1] = ast.StringTerm(p[i])
+		}
+	}
+	return ref
+}
+
+func (p Path) String() string {
+	buf := make([]string, len(p))
+	for i := range buf {
+		buf[i] = url.PathEscape(p[i])
+	}
+	return "/" + strings.Join(buf, "/")
+}
+
+// MustParsePath returns a new Path for s. If s cannot be parsed, this function
+// will panic. This is mostly for test purposes.
+func MustParsePath(s string) Path {
+	path, ok := ParsePath(s)
+	if !ok {
+		panic(s)
+	}
+	return path
+}

vendor/github.com/open-policy-agent/opa/storage/storage.go

@@ -0,0 +1,126 @@
+// Copyright 2016 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package storage
+
+import (
+	"context"
+)
+
+// NewTransactionOrDie is a helper function to create a new transaction. If the
+// storage layer cannot create a new transaction, this function will panic. This
+// function should only be used for tests.
+func NewTransactionOrDie(ctx context.Context, store Store, params ...TransactionParams) Transaction {
+	txn, err := store.NewTransaction(ctx, params...)
+	if err != nil {
+		panic(err)
+	}
+	return txn
+}
+
+// ReadOne is a convenience function to read a single value from the provided Store. It
+// will create a new Transaction to perform the read with, and clean up after itself
+// should an error occur.
+func ReadOne(ctx context.Context, store Store, path Path) (interface{}, error) {
+	txn, err := store.NewTransaction(ctx)
+	if err != nil {
+		return nil, err
+	}
+	defer store.Abort(ctx, txn)
+
+	return store.Read(ctx, txn, path)
+}
+
+// WriteOne is a convenience function to write a single value to the provided Store. It
+// will create a new Transaction to perform the write with, and clean up after itself
+// should an error occur.
+func WriteOne(ctx context.Context, store Store, op PatchOp, path Path, value interface{}) error {
+	txn, err := store.NewTransaction(ctx, WriteParams)
+	if err != nil {
+		return err
+	}
+
+	if err := store.Write(ctx, txn, op, path, value); err != nil {
+		store.Abort(ctx, txn)
+		return err
+	}
+
+	return store.Commit(ctx, txn)
+}
+
+// MakeDir inserts an empty object at path. If the parent path does not exist,
+// MakeDir will create it recursively.
+func MakeDir(ctx context.Context, store Store, txn Transaction, path Path) error {
+
+	// Allow the Store implementation to deal with this in its own way.
+	if md, ok := store.(MakeDirer); ok {
+		return md.MakeDir(ctx, txn, path)
+	}
+
+	if len(path) == 0 {
+		return nil
+	}
+
+	node, err := store.Read(ctx, txn, path)
+	if err != nil {
+		if !IsNotFound(err) {
+			return err
+		}
+
+		if err := MakeDir(ctx, store, txn, path[:len(path)-1]); err != nil {
+			return err
+		}
+
+		return store.Write(ctx, txn, AddOp, path, map[string]interface{}{})
+	}
+
+	if _, ok := node.(map[string]interface{}); ok {
+		return nil
+	}
+	return writeConflictError(path)
+}
+
+// Txn is a convenience function that executes f inside a new transaction
+// opened on the store. If the function returns an error, the transaction is
+// aborted and the error is returned. Otherwise, the transaction is committed
+// and the result of the commit is returned.
+func Txn(ctx context.Context, store Store, params TransactionParams, f func(Transaction) error) error {
+
+	txn, err := store.NewTransaction(ctx, params)
+	if err != nil {
+		return err
+	}
+
+	if err := f(txn); err != nil {
+		store.Abort(ctx, txn)
+		return err
+	}
+
+	return store.Commit(ctx, txn)
+}
+
+// NonEmpty returns a function that tests if a path is non-empty. A
+// path is non-empty if a Read on the path returns a value or a Read
+// on any of the path prefixes returns a non-object value.
+func NonEmpty(ctx context.Context, store Store, txn Transaction) func([]string) (bool, error) {
+	return func(path []string) (bool, error) {
+		if _, err := store.Read(ctx, txn, Path(path)); err == nil {
+			return true, nil
+		} else if !IsNotFound(err) {
+			return false, err
+		}
+		for i := len(path) - 1; i > 0; i-- {
+			val, err := store.Read(ctx, txn, Path(path[:i]))
+			if err != nil && !IsNotFound(err) {
+				return false, err
+			} else if err == nil {
+				if _, ok := val.(map[string]interface{}); ok {
+					return false, nil
+				}
+				return true, nil
+			}
+		}
+		return false, nil
+	}
+}