regopy

Rego 是 Open Policy Agent 项目的原生查询语言。如果您想了解更多关于 Rego 作为语言及其各种用例的信息，我们建议您查阅 OPA 提供的上述语言文档。

此模块是 Microsoft 开发并维护的 Rego 语言编译器和运行时开源跨平台 C++ 实现 rego-cpp 的包装器。您可以在这里了解更多关于该项目的信息。在这个包装器中，我们尽可能地提供 ReGo 查询引擎的惯用 Python 接口。我们希望这个项目对希望在 Python 环境中利用 Rego 力量的用户有所帮助。

警告：虽然这个项目已经发展到支持完整的 ReGo 语言（见下方的语言支持），但我们不支持所有内置函数。尽管如此，我们已经验证了它与 OPA ReGo 测试套件的兼容性。即使如此，它仍应被视为实验性软件，并应谨慎使用。

示例用法

from regopy import Interpreter
rego = Interpreter()
print(rego.query("x=5;y=x + (2 - 4 * 0.25) * -3 + 7.4"))
# {"bindings":{"x":5, "y":9.5}}
input0 = {
    "a": 10,
    "b": "20",
    "c": 30.0,
    "d": True
}
data0 = {
    "one": {
        "bar": "Foo",
        "baz": 5,
        "be": True,
        "bop": 23.4
    },
    "two": {
        "bar": "Bar",
        "baz": 12.3,
        "be": False,
        "bop": 42
    }
}
data1 = {
    "three": {
        "bar": "Baz",
        "baz": 15,
        "be": True,
        "bop": 4.23
    }
}
module = '''
    package objects

    rect := {`width`: 2, "height": 4}
    cube := {"width": 3, `height`: 4, "depth": 5}
    a := 42
    b := false
    c := null
    d := {"a": a, "x": [b, c]}
    index := 1
    shapes := [rect, cube]
    names := ["prod", `smoke1`, "dev"]
    sites := [{"name": "prod"}, {"name": names[index]}, {"name": "dev"}]
    e := {
        a: "foo",
        "three": c,
        names[2]: b,
        "four": d,
    }
    f := e["dev"]
'''
rego.set_input(input0)
rego.add_data(data0)
rego.add_data(data1)
rego.add_module("objects", module)
print(rego.query("x=[data.one, input.b, data.objects.sites[1]]"))
# {"bindings":{"x":[{"bar":"Foo", "baz":5, "be":true, "bop":23.4}, "20", {"name":"smoke1"}]}}

语言支持

我们支持 OPA 定义的 ReGo v0.68.0 版本，以下语法

module          = package { import } policy
package         = "package" ref
import          = "import" ref [ "as" var ]
policy          = { rule }
rule            = [ "default" ] rule-head { rule-body }
rule-head       = ( ref | var ) ( rule-head-set | rule-head-obj | rule-head-func | rule-head-comp )
rule-head-comp  = [ assign-operator term ] [ "if" ]
rule-head-obj   = "[" term "]" [ assign-operator term ] [ "if" ]
rule-head-func  = "(" rule-args ")" [ assign-operator term ] [ "if" ]
rule-head-set   = "contains" term [ "if" ] | "[" term "]"
rule-args       = term { "," term }
rule-body       = [ "else" [ assign-operator term ] [ "if" ] ] ( "{" query "}" ) | literal
query           = literal { ( ";" | ( [CR] LF ) ) literal }
literal         = ( some-decl | expr | "not" expr ) { with-modifier }
with-modifier   = "with" term "as" term
some-decl       = "some" term { "," term } { "in" expr }
expr            = term | expr-call | expr-infix | expr-every | expr-parens | unary-expr
expr-call       = var [ "." var ] "(" [ expr { "," expr } ] ")"
expr-infix      = expr infix-operator expr
expr-every      = "every" var { "," var } "in" ( term | expr-call | expr-infix ) "{" query "}"
expr-parens     = "(" expr ")"
unary-expr      = "-" expr
membership      = term [ "," term ] "in" term
term            = ref | var | scalar | array | object | set | membership | array-compr | object-compr | set-compr
array-compr     = "[" term "|" query "]"
set-compr       = "{" term "|" query "}"
object-compr    = "{" object-item "|" query "}"
infix-operator  = assign-operator | bool-operator | arith-operator | bin-operator
bool-operator   = "==" | "!=" | "<" | ">" | ">=" | "<="
arith-operator  = "+" | "-" | "*" | "/" | "%"
bin-operator    = "&" | "|"
assign-operator = ":=" | "="
ref             = ( var | array | object | set | array-compr | object-compr | set-compr | expr-call ) { ref-arg }
ref-arg         = ref-arg-dot | ref-arg-brack
ref-arg-brack   = "[" ( scalar | var | array | object | set | "_" ) "]"
ref-arg-dot     = "." var
var             = ( ALPHA | "_" ) { ALPHA | DIGIT | "_" }
scalar          = string | NUMBER | TRUE | FALSE | NULL
string          = STRING | raw-string
raw-string      = "`" { CHAR-"`" } "`"
array           = "[" term { "," term } "]"
object          = "{" object-item { "," object-item } "}"
object-item     = ( scalar | ref | var ) ":" term
set             = empty-set | non-empty-set
non-empty-set   = "{" term { "," term } "}"
empty-set       = "set(" ")"

[!NOTE] 此语法对应于启用了 rego.v1 的 ReGo（有关更多信息，请参阅 OPA v1.0）。

定义

[]     optional (zero or one instances)
{}     repetition (zero or more instances)
|      alternation (one of the instances)
()     grouping (order of expansion)
STRING JSON string
NUMBER JSON number
TRUE   JSON true
FALSE  JSON false
NULL   JSON null
CHAR   Unicode character
ALPHA  ASCII characters A-Z and a-z
DIGIT  ASCII characters 0-9
CR     Carriage Return
LF     Line Feed

内置函数

目前支持以下内置功能

• 聚合
• 数组
• 位
• 类型转换
• 编码
• 图
• 数字
• 对象
• 正则表达式
• 语义版本
• 集合
• 字符串
• 时间
• 类型
• 单位
• UUID
• 杂项
  • opa.runtime
  • 打印

与OPA Rego Go实现的兼容性

我们的目标是实现并保持与参考Go实现的完全兼容性。我们开发了一个测试驱动程序，它运行相同的测试并验证我们产生相同的输出。在这个阶段，我们通过了所有非内置特定的测试套件，这些测试套件是从OPA存储库克隆的。要使用可用于测试的OPA测试构建，请使用以下预设之一

• release-clang-opa
• release-opa

目前，我们没有完全通过以下测试套件

• crypto*
• glob*
• graphql
• invalidkeyerror
• json*（除jsonbuiltins外）
• jwt*
• net*
• planner-ir
• providers-aws