|
| 1 | +# Copyright The Conforma Contributors |
| 2 | +# |
| 3 | +# Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | +# you may not use this file except in compliance with the License. |
| 5 | +# You may obtain a copy of the License at |
| 6 | +# |
| 7 | +# http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | +# |
| 9 | +# Unless required by applicable law or agreed to in writing, software |
| 10 | +# distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | +# See the License for the specific language governing permissions and |
| 13 | +# limitations under the License. |
| 14 | +# |
| 15 | +# SPDX-License-Identifier: Apache-2.0 |
| 16 | + |
| 17 | +# Library functions for evaluating volatile configuration rules and determining |
| 18 | +# warning categories based on lifecycle events (pending activation, expiring soon, |
| 19 | +# no expiration, expired, invalid dates). |
| 20 | + |
| 21 | +package lib |
| 22 | + |
| 23 | +import rego.v1 |
| 24 | + |
| 25 | +import data.lib.time as time_lib |
| 26 | + |
| 27 | +# Get configurable warning threshold from rule_data (default defined in rule_data_defaults) |
| 28 | +warning_threshold_days := rule_data("volatile_config_warning_threshold_days") |
| 29 | + |
| 30 | +# Nanoseconds per day constant |
| 31 | +_ns_per_day := 86400000000000 |
| 32 | + |
| 33 | +# Calculate days until a rule expires (returns integer days, can be negative if expired) |
| 34 | +days_until_expiration(rule) := days if { |
| 35 | + until_ns := _get_effective_until_ns(rule) |
| 36 | + now_ns := time_lib.effective_current_time_ns |
| 37 | + diff_ns := until_ns - now_ns |
| 38 | + days := floor(diff_ns / _ns_per_day) |
| 39 | +} |
| 40 | + |
| 41 | +# Check if rule applies to current image/component |
| 42 | +# context is an object with optional fields: imageRef, imageDigest, componentName |
| 43 | +# Returns true if the rule matches based on any of the following criteria: |
| 44 | +# - Global rule (no image/component constraints) |
| 45 | +# - Match by imageRef (DEPRECATED: same as imageDigest, both are digests) |
| 46 | +# - Match by imageUrl prefix (URL without tag) |
| 47 | +# - Match by imageDigest |
| 48 | +# - Match by componentNames |
| 49 | +is_rule_applicable(rule, _) if { |
| 50 | + # Global rule: no constraints specified |
| 51 | + object.get(rule, "imageRef", "") == "" |
| 52 | + object.get(rule, "imageUrl", "") == "" |
| 53 | + object.get(rule, "imageDigest", "") == "" |
| 54 | + count(object.get(rule, "componentNames", [])) == 0 |
| 55 | +} |
| 56 | + |
| 57 | +is_rule_applicable(rule, context) if { |
| 58 | + # Match by imageRef (DEPRECATED: same as imageDigest, both are digests) |
| 59 | + rule_image_ref := object.get(rule, "imageRef", "") |
| 60 | + rule_image_ref != "" |
| 61 | + context_digest := object.get(context, "imageDigest", "") |
| 62 | + rule_image_ref == context_digest |
| 63 | +} |
| 64 | + |
| 65 | +is_rule_applicable(rule, context) if { |
| 66 | + # Match by imageUrl prefix (URL without tag) |
| 67 | + rule_image_url := object.get(rule, "imageUrl", "") |
| 68 | + rule_image_url != "" |
| 69 | + context_image_ref := object.get(context, "imageRef", "") |
| 70 | + _image_url_matches(rule_image_url, context_image_ref) |
| 71 | +} |
| 72 | + |
| 73 | +is_rule_applicable(rule, context) if { |
| 74 | + # Match by imageDigest |
| 75 | + rule_image_digest := object.get(rule, "imageDigest", "") |
| 76 | + rule_image_digest != "" |
| 77 | + context_digest := object.get(context, "imageDigest", "") |
| 78 | + rule_image_digest == context_digest |
| 79 | +} |
| 80 | + |
| 81 | +is_rule_applicable(rule, context) if { |
| 82 | + # Match by componentNames |
| 83 | + component_names := object.get(rule, "componentNames", []) |
| 84 | + count(component_names) > 0 |
| 85 | + context_component_name := object.get(context, "componentName", "") |
| 86 | + some name in component_names |
| 87 | + name == context_component_name |
| 88 | +} |
| 89 | + |
| 90 | +# Determine warning category - check for invalid dates first |
| 91 | +warning_category(rule) := "invalid" if { |
| 92 | + _is_date_invalid(_get_effective_on(rule)) |
| 93 | +} |
| 94 | + |
| 95 | +warning_category(rule) := "invalid" if { |
| 96 | + _is_date_invalid(_get_effective_until(rule)) |
| 97 | +} |
| 98 | + |
| 99 | +# Pending: effectiveOn is in the future |
| 100 | +warning_category(rule) := "pending" if { |
| 101 | + _is_effective_on_in_future(rule) |
| 102 | + _is_effective_until_valid_or_empty(rule) |
| 103 | +} |
| 104 | + |
| 105 | +# Expired: effectiveUntil is in the past |
| 106 | +warning_category(rule) := "expired" if { |
| 107 | + _is_effective_until_expired(rule) |
| 108 | + _is_effective_on_valid_and_not_future(rule) |
| 109 | +} |
| 110 | + |
| 111 | +# Expiring: effectiveUntil is within the warning threshold |
| 112 | +warning_category(rule) := "expiring" if { |
| 113 | + _is_effective_until_expiring(rule) |
| 114 | + _is_effective_on_valid_and_not_future(rule) |
| 115 | +} |
| 116 | + |
| 117 | +# No expiration: rule is active (effectiveOn in past or not set) but has no effectiveUntil |
| 118 | +warning_category(rule) := "no_expiration" if { |
| 119 | + _get_effective_until(rule) == "" |
| 120 | + _is_effective_on_active_or_unset(rule) |
| 121 | +} |
| 122 | + |
| 123 | +# ============================================================================= |
| 124 | +# Helper functions for date extraction and validation |
| 125 | +# ============================================================================= |
| 126 | + |
| 127 | +# Extract effectiveOn date string from rule |
| 128 | +_get_effective_on(rule) := object.get(rule, "effectiveOn", "") |
| 129 | + |
| 130 | +# Extract effectiveUntil date string from rule |
| 131 | +_get_effective_until(rule) := object.get(rule, "effectiveUntil", "") |
| 132 | + |
| 133 | +# Safely parse RFC3339 date, undefined on failure |
| 134 | +_parse_date_safe(date_str) := ns if { |
| 135 | + date_str != "" |
| 136 | + ns := time.parse_rfc3339_ns(date_str) |
| 137 | +} |
| 138 | + |
| 139 | +# Check if a date string is invalid (non-empty but unparseable) |
| 140 | +# Empty strings are considered valid (not set, not invalid) |
| 141 | +_is_date_invalid(date_str) if { |
| 142 | + date_str != "" |
| 143 | + not _parse_date_safe(date_str) |
| 144 | +} |
| 145 | + |
| 146 | +# Get effectiveOn as nanoseconds, undefined if invalid or empty |
| 147 | +_get_effective_on_ns(rule) := _parse_date_safe(_get_effective_on(rule)) |
| 148 | + |
| 149 | +# Get effectiveUntil as nanoseconds, undefined if invalid or empty |
| 150 | +_get_effective_until_ns(rule) := _parse_date_safe(_get_effective_until(rule)) |
| 151 | + |
| 152 | +# Check if effectiveOn is in the future |
| 153 | +_is_effective_on_in_future(rule) if { |
| 154 | + on_ns := _get_effective_on_ns(rule) |
| 155 | + now_ns := time_lib.effective_current_time_ns |
| 156 | + on_ns > now_ns |
| 157 | +} |
| 158 | + |
| 159 | +# Check if effectiveOn is active (in the past) or not set |
| 160 | +_is_effective_on_active_or_unset(rule) if { |
| 161 | + _get_effective_on(rule) == "" |
| 162 | +} else if { |
| 163 | + on_ns := _get_effective_on_ns(rule) |
| 164 | + now_ns := time_lib.effective_current_time_ns |
| 165 | + on_ns <= now_ns |
| 166 | +} |
| 167 | + |
| 168 | +# Check if effectiveOn is valid (if set) and not in the future |
| 169 | +_is_effective_on_valid_and_not_future(rule) if { |
| 170 | + _get_effective_on(rule) == "" |
| 171 | +} else if { |
| 172 | + on_ns := _get_effective_on_ns(rule) |
| 173 | + now_ns := time_lib.effective_current_time_ns |
| 174 | + on_ns <= now_ns |
| 175 | +} |
| 176 | + |
| 177 | +# Check if effectiveUntil is valid (if set) or empty |
| 178 | +_is_effective_until_valid_or_empty(rule) if { |
| 179 | + _get_effective_until(rule) == "" |
| 180 | +} else if { |
| 181 | + _get_effective_until_ns(rule) |
| 182 | +} |
| 183 | + |
| 184 | +# Check if effectiveUntil is expired (in the past) |
| 185 | +_is_effective_until_expired(rule) if { |
| 186 | + until_ns := _get_effective_until_ns(rule) |
| 187 | + now_ns := time_lib.effective_current_time_ns |
| 188 | + until_ns < now_ns |
| 189 | +} |
| 190 | + |
| 191 | +# Check if effectiveUntil is expiring (within warning threshold) |
| 192 | +_is_effective_until_expiring(rule) if { |
| 193 | + until_ns := _get_effective_until_ns(rule) |
| 194 | + now_ns := time_lib.effective_current_time_ns |
| 195 | + until_ns >= now_ns |
| 196 | + days := days_until_expiration(rule) |
| 197 | + days <= warning_threshold_days |
| 198 | +} |
| 199 | + |
| 200 | +# Helper: check if imageUrl matches the image reference |
| 201 | +# imageUrl is a URL pattern without tag (e.g., "quay.io/redhat/myimage") |
| 202 | +# image_ref may include tag and/or digest (e.g., "quay.io/redhat/myimage:v1@sha256:...") |
| 203 | +_image_url_matches(url_pattern, image_ref) if { |
| 204 | + # Extract the repo portion (before any : or @) |
| 205 | + ref_without_digest := split(image_ref, "@")[0] |
| 206 | + ref_without_tag := split(ref_without_digest, ":")[0] |
| 207 | + |
| 208 | + # Check if pattern matches exactly |
| 209 | + ref_without_tag == url_pattern |
| 210 | +} |
| 211 | + |
| 212 | +_image_url_matches(url_pattern, image_ref) if { |
| 213 | + ref_without_digest := split(image_ref, "@")[0] |
| 214 | + ref_without_tag := split(ref_without_digest, ":")[0] |
| 215 | + |
| 216 | + # Also allow prefix matching for broader scopes (e.g., "quay.io/redhat" matches "quay.io/redhat/myimage") |
| 217 | + startswith(ref_without_tag, sprintf("%s/", [url_pattern])) |
| 218 | +} |
0 commit comments