Merge pull request #2 from SpectralOps/glob-bifs

feat: implement glob builtins

Cargo.toml

@@ -48,6 +48,7 @@ sha2 = { version = "0.10", optional = true }
 sprintf = { version = "0.1", optional = true }
 parse-size = { version = "1", features = ["std"], optional = true }
 serde_yaml = { version = "0.9.1", optional = true }
+globset = { version = "0.4.9", optional = true }
 regex = { version = "1.7.0", optional = true }
 route-pattern = { version = "0.1.0", optional = true }
 regex-intersect = { version = "1.2.0", optional = true }
@@ -105,6 +106,7 @@ json-builtins = ["dep:json-patch"]
 units-builtins = ["dep:parse-size"]
 rand-builtins = ["rng"]
 yaml-builtins = ["dep:serde_yaml"]
+glob-builtins = ["dep:globset"]
 regex-builtins = ["dep:regex", "dep:route-pattern", "dep:regex-intersect"]
 
 all-crypto-builtins = [
@@ -125,6 +127,7 @@ all-builtins = [
  "sprintf-builtins",
  "units-builtins",
  "yaml-builtins",
+ "glob-builtins",
  "regex-builtins",
 ]
 

src/builtins/impls/glob.rs

@@ -14,11 +14,34 @@
 
 //! Builtins used when working with globs.
 
-use anyhow::{bail, Result};
+use anyhow::Result;
 
 /// Returns a string which represents a version of the pattern where all
 /// asterisks have been escaped.
 #[tracing::instrument(name = "glob.quote_meta", err)]
 pub fn quote_meta(pattern: String) -> Result<String> {
- bail!("not implemented");
+ let mut needs_escape = false;
+
+ // shortcircuit if possible to avoid copy
+ for c in pattern.chars() {
+ match c {
+ '*' | '?' | '\\' | '[' | ']' | '{' | '}' => needs_escape = true,
+ _ => {}
+ }
+ }
+ if !needs_escape {
+ return Ok(pattern);
+ }
+
+ let mut out = String::with_capacity(pattern.len());
+ for c in pattern.chars() {
+ match c {
+ '*' | '?' | '\\' | '[' | ']' | '{' | '}' => {
+ out.push('\\');
+ out.push(c);
+ }
+ _ => out.push(c),
+ }
+ }
+ Ok(out)
 }

src/builtins/impls/mod.rs

@@ -22,7 +22,9 @@ use anyhow::{bail, Result};
 #[cfg(feature = "base64url-builtins")]
 pub mod base64url;
 pub mod crypto;
+#[cfg(feature = "glob-builtins")]
 pub mod glob;
+
 pub mod graph;
 pub mod graphql;
 #[cfg(feature = "hex-builtins")]

src/builtins/mod.rs

@@ -66,7 +66,10 @@ pub fn resolve<C: EvaluationContext>(name: &str) -> Result<Box<dyn Builtin<C>>>
  "crypto.x509.parse_rsa_private_key" => {
  Ok(self::impls::crypto::x509::parse_rsa_private_key.wrap())
  }
+
+ #[cfg(feature = "glob-builtins")]
  "glob.quote_meta" => Ok(self::impls::glob::quote_meta.wrap()),
+
  "graph.reachable_paths" => Ok(self::impls::graph::reachable_paths.wrap()),
  "graphql.is_valid" => Ok(self::impls::graphql::is_valid.wrap()),
  "graphql.parse" => Ok(self::impls::graphql::parse.wrap()),

tests/infra-fixtures/test-glob.rego

@@ -0,0 +1,9 @@
+package test
+
+quote_1 := glob.quote_meta("abc")
+
+quote_2 := glob.quote_meta("foobar*")
+
+match_1_true := glob.match("*.foo.bar", ["/"], "n.goo.bar.foo.bar")
+
+match_2_false := glob.match("*.foo.bar", ["."], "n.goo.bar.foo.bar")

tests/smoke_test.rs

@@ -120,6 +120,7 @@ integration_test!(test_units, "test-units");
 integration_test!(test_rand, "test-rand");
 integration_test!(test_yaml, "test-yaml");
 
+integration_test!(test_glob, "test-glob");
 integration_test!(test_regex, "test-regex");
 
 /*

tests/snapshots/smoke_test__glob.snap

@@ -0,0 +1,10 @@
+---
+source: tests/smoke_test.rs
+expression: "test_policy(\"test-glob\", None).await.expect(\"error in test suite\")"
+---
+- result:
+ match_1_true: true
+ match_2_false: false
+ quote_1: abc
+ quote_2: "foobar\\*"
+