Skip to content

Commit 1f9be4b

Browse files
gr0migmartri
gr0
and
migmartri
authored
Add policy name when computing policy arguments (#2289)
Signed-off-by: Rafał Kuć <[email protected]> Signed-off-by: Rafał Kuć <[email protected]> Co-authored-by: Miguel Martinez Trivino <[email protected]>
1 parent 8c64a0a commit 1f9be4b

File tree

4 files changed

+42
-29
lines changed

4 files changed

+42
-29
lines changed

‎app/cli/internal/action/attestation_init.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -316,7 +316,7 @@ func getGroupMaterialsToAdd(group *v1.PolicyGroup, pgAtt *v1.PolicyGroupAttachme
316316
// translates materials and interpolates material names
317317
func groupMaterialToCraftingSchemaMaterial(gm *v1.PolicyGroup_Material, group *v1.PolicyGroup, pgAtt *v1.PolicyGroupAttachment, logger *zerolog.Logger) (*v1.CraftingSchema_Material, error) {
318318
// Validates and computes arguments
319-
args, err := policies.ComputeArguments(group.GetSpec().GetInputs(), pgAtt.GetWith(), nil, logger)
319+
args, err := policies.ComputeArguments(group.GetMetadata().GetName(), group.GetSpec().GetInputs(), pgAtt.GetWith(), nil, logger)
320320
if err != nil {
321321
return nil, err
322322
}

‎pkg/policies/policies.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -140,7 +140,7 @@ func (pv *PolicyVerifier) evaluatePolicyAttachment(ctx context.Context, attachme
140140
pv.logger.Debug().Msgf("evaluating policy %s against attestation", policy.Metadata.Name)
141141
}
142142

143-
args, err := ComputeArguments(policy.GetSpec().GetInputs(), attachment.GetWith(), opts.bindings, pv.logger)
143+
args, err := ComputeArguments(policy.GetMetadata().GetName(), policy.GetSpec().GetInputs(), attachment.GetWith(), opts.bindings, pv.logger)
144144
if err != nil {
145145
return nil, NewPolicyError(err)
146146
}
@@ -215,7 +215,7 @@ func (pv *PolicyVerifier) evaluatePolicyAttachment(ctx context.Context, attachme
215215
}
216216

217217
// ComputeArguments takes a list of arguments, and matches it against the expected inputs. It also applies a set of interpolations if needed.
218-
func ComputeArguments(inputs []*v1.PolicyInput, args map[string]string, bindings map[string]string, logger *zerolog.Logger) (map[string]string, error) {
218+
func ComputeArguments(name string, inputs []*v1.PolicyInput, args map[string]string, bindings map[string]string, logger *zerolog.Logger) (map[string]string, error) {
219219
result := make(map[string]string)
220220

221221
// Policies without inputs in the spec
@@ -263,7 +263,7 @@ func ComputeArguments(inputs []*v1.PolicyInput, args map[string]string, bindings
263263
return input.Name == k
264264
})
265265
if !expected {
266-
logger.Warn().Msgf("argument %q will be ignored", k)
266+
logger.Warn().Msgf("argument %q not defined in policy %q spec, ignoring it", k, name)
267267
continue
268268
}
269269
value, err := templates.ApplyBinding(v, bindings)

‎pkg/policies/policies_test.go‎

Lines changed: 36 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -814,22 +814,25 @@ func (s *testSuite) TestGetInputArguments() {
814814

815815
func (s *testSuite) TestComputePolicyArguments() {
816816
cases := []struct {
817-
name string
818-
inputs []*v12.PolicyInput
819-
args map[string]string
820-
bindings map[string]string
821-
expected map[string]string
822-
expectErr bool
823-
errMsg string
817+
name string
818+
policyName string
819+
inputs []*v12.PolicyInput
820+
args map[string]string
821+
bindings map[string]string
822+
expected map[string]string
823+
expectErr bool
824+
errMsg string
824825
}{
825826
{
826-
name: "all args passed when no inputs present",
827-
inputs: nil,
828-
args: map[string]string{"arg1": "value1", "arg2": "value2"},
829-
expected: map[string]string{"arg1": "value1", "arg2": "value2"},
827+
name: "all args passed when no inputs present",
828+
policyName: "test-policy",
829+
inputs: nil,
830+
args: map[string]string{"arg1": "value1", "arg2": "value2"},
831+
expected: map[string]string{"arg1": "value1", "arg2": "value2"},
830832
},
831833
{
832-
name: "required inputs",
834+
name: "required inputs",
835+
policyName: "test-policy",
833836
inputs: []*v12.PolicyInput{{
834837
Name: "arg1",
835838
Required: true,
@@ -839,7 +842,8 @@ func (s *testSuite) TestComputePolicyArguments() {
839842
errMsg: "missing required input \"arg1\"",
840843
},
841844
{
842-
name: "default values are set",
845+
name: "default values are set",
846+
policyName: "test-policy",
843847
inputs: []*v12.PolicyInput{{
844848
Name: "arg1",
845849
Default: "value1",
@@ -851,7 +855,8 @@ func (s *testSuite) TestComputePolicyArguments() {
851855
expected: map[string]string{"arg1": "value1", "arg2": "value2"},
852856
},
853857
{
854-
name: "unexpected arguments are ignored",
858+
name: "unexpected arguments are ignored",
859+
policyName: "test-policy",
855860
inputs: []*v12.PolicyInput{{
856861
Name: "arg1",
857862
Default: "value1",
@@ -862,7 +867,8 @@ func (s *testSuite) TestComputePolicyArguments() {
862867
expected: map[string]string{"arg1": "value1"},
863868
},
864869
{
865-
name: "expected arguments with values are respected",
870+
name: "expected arguments with values are respected",
871+
policyName: "test-policy",
866872
inputs: []*v12.PolicyInput{{
867873
Name: "arg1",
868874
Default: "value1",
@@ -873,7 +879,8 @@ func (s *testSuite) TestComputePolicyArguments() {
873879
expected: map[string]string{"arg1": "value1", "arg2": "value2"},
874880
},
875881
{
876-
name: "simple bindings",
882+
name: "simple bindings",
883+
policyName: "test-policy",
877884
inputs: []*v12.PolicyInput{{
878885
Name: "arg1",
879886
}},
@@ -882,7 +889,8 @@ func (s *testSuite) TestComputePolicyArguments() {
882889
expected: map[string]string{"arg1": "Hello world"},
883890
},
884891
{
885-
name: "multiple bindings",
892+
name: "multiple bindings",
893+
policyName: "test-policy",
886894
inputs: []*v12.PolicyInput{{
887895
Name: "arg1",
888896
}, {
@@ -893,7 +901,8 @@ func (s *testSuite) TestComputePolicyArguments() {
893901
expected: map[string]string{"arg1": "Hello world template", "arg2": "Bye template"},
894902
},
895903
{
896-
name: "no variable found in bindings, renders zero value",
904+
name: "no variable found in bindings, renders zero value",
905+
policyName: "test-policy",
897906
inputs: []*v12.PolicyInput{{
898907
Name: "arg1",
899908
}},
@@ -902,7 +911,8 @@ func (s *testSuite) TestComputePolicyArguments() {
902911
expected: map[string]string{"arg1": "Hello "},
903912
},
904913
{
905-
name: "no interpolation needed",
914+
name: "no interpolation needed",
915+
policyName: "test-policy",
906916
inputs: []*v12.PolicyInput{{
907917
Name: "arg1",
908918
}},
@@ -911,7 +921,8 @@ func (s *testSuite) TestComputePolicyArguments() {
911921
expected: map[string]string{"arg1": "Hello world"},
912922
},
913923
{
914-
name: "required and default is illegal",
924+
name: "required and default is illegal",
925+
policyName: "test-policy",
915926
inputs: []*v12.PolicyInput{{
916927
Name: "arg1",
917928
Required: true,
@@ -922,7 +933,8 @@ func (s *testSuite) TestComputePolicyArguments() {
922933
errMsg: "input arg1 can not be required and have a default at the same time",
923934
},
924935
{
925-
name: "inputs prefix without dot",
936+
name: "inputs prefix without dot",
937+
policyName: "test-policy",
926938
inputs: []*v12.PolicyInput{{
927939
Name: "arg1",
928940
}, {
@@ -933,7 +945,8 @@ func (s *testSuite) TestComputePolicyArguments() {
933945
expected: map[string]string{"arg1": "Hello world template", "arg2": "Bye template"},
934946
},
935947
{
936-
name: "required input with missing binding",
948+
name: "required input with missing binding",
949+
policyName: "test-policy",
937950
inputs: []*v12.PolicyInput{{
938951
Name: "arg1",
939952
Required: true,
@@ -945,7 +958,7 @@ func (s *testSuite) TestComputePolicyArguments() {
945958

946959
for _, tc := range cases {
947960
s.Run(tc.name, func() {
948-
computed, err := ComputeArguments(tc.inputs, tc.args, tc.bindings, &s.logger)
961+
computed, err := ComputeArguments(tc.policyName, tc.inputs, tc.args, tc.bindings, &s.logger)
949962
if tc.expectErr {
950963
s.Error(err)
951964
s.Contains(err.Error(), tc.errMsg)

‎pkg/policies/policy_groups.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ func (pgv *PolicyGroupVerifier) VerifyMaterial(ctx context.Context, material *ap
6262
}
6363

6464
// matches group arguments against spec and apply defaults
65-
groupArgs, err := ComputeArguments(group.GetSpec().GetInputs(), groupAtt.GetWith(), nil, pgv.logger)
65+
groupArgs, err := ComputeArguments(group.GetMetadata().GetName(), group.GetSpec().GetInputs(), groupAtt.GetWith(), nil, pgv.logger)
6666
if err != nil {
6767
return nil, NewPolicyError(err)
6868
}
@@ -121,7 +121,7 @@ func (pgv *PolicyGroupVerifier) VerifyStatement(ctx context.Context, statement *
121121
continue
122122
}
123123
// compute group arguments
124-
groupArgs, err := ComputeArguments(group.GetSpec().GetInputs(), groupAtt.GetWith(), nil, pgv.logger)
124+
groupArgs, err := ComputeArguments(group.GetMetadata().GetName(), group.GetSpec().GetInputs(), groupAtt.GetWith(), nil, pgv.logger)
125125
if err != nil {
126126
return nil, NewPolicyError(err)
127127
}

0 commit comments

Comments
 (0)