ruby-rego 0.1.0

data/Steepfile

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+target :lib do
+  signature "sig"
+  check "lib"
+  library "json"
+  library "optparse"
+  library "psych"
+  library "yaml"
+end

data/TODO.md

@@ -0,0 +1,35 @@
+# TODO
+
+## Phase 2 features
+
+- Full `every` keyword semantics and test coverage.
+- Rule heads with references (indexing and evaluation).
+- Advanced pattern matching and destructuring in rule bodies.
+- Expanded built-in function set (strings, objects, arrays, conversions).
+- Broader `with` keyword support across evaluator paths.
+
+## Phase 3 features
+
+- Complete OPA built-in function coverage.
+- Full compliance with OPA test suites and edge cases.
+- Partial evaluation and optimization passes.
+- JSON Schema integration and annotations.
+- Policy compiler optimizations for large rule sets.
+
+## Known limitations
+
+- `with` modifiers are limited and may reset memoization caches.
+- Performance is slower than OPA for heavy comprehensions.
+- Not all OPA built-ins and keywords are implemented yet.
+
+## Community requests
+
+- Richer CLI output formats and policy explanations.
+- Deterministic pretty-printer for AST and policies.
+- Better compatibility tooling for OPA policy validation.
+
+## Performance improvements
+
+- Memoization improvements for nested rule dependencies.
+- Reduce object allocations in evaluator hot paths.
+- Add benchmarks for real-world policy suites.

data/benchmark/builtin_calls.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+require "benchmark/ips"
+require "ruby/rego"
+
+policy = <<~REGO
+  package bench
+  result {
+    count(input.items) == 100
+    sum(input.numbers) > 2000
+    max(input.numbers) == 200
+    startswith(input.name, "user")
+    lower(input.name) == "user-1"
+  }
+REGO
+
+compiled = Ruby::Rego.compile(policy)
+input = {
+  "items" => Array.new(100, "item"),
+  "numbers" => (1..200).to_a,
+  "name" => "User-1"
+}
+query = "data.bench.result"
+evaluator = Ruby::Rego::Evaluator.new(compiled, input: input)
+
+Benchmark.ips do |x|
+  x.report("builtin calls") { evaluator.evaluate(query) }
+  x.compare!
+end

data/benchmark/complex_policy.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+require "benchmark/ips"
+require "yaml"
+require "ruby/rego"
+
+policy_path = File.join(__dir__, "..", "examples", "validation_policy.rego")
+config_path = File.join(__dir__, "..", "examples", "sample_config.yaml")
+
+policy = File.read(policy_path)
+input = YAML.safe_load_file(config_path)
+compiled = Ruby::Rego.compile(policy)
+query = "data.validation.deny"
+evaluator = Ruby::Rego::Evaluator.new(compiled, input: input)
+
+Benchmark.ips do |x|
+  x.report("complex policy") { evaluator.evaluate(query) }
+  x.compare!
+end

data/benchmark/comprehensions.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+require "benchmark/ips"
+require "ruby/rego"
+
+policy = <<~REGO
+  package bench
+  evens := [n | some n in input.numbers; n % 2 == 0]
+REGO
+
+compiled = Ruby::Rego.compile(policy)
+input = { "numbers" => (1..200).to_a }
+query = "data.bench.evens"
+evaluator = Ruby::Rego::Evaluator.new(compiled, input: input)
+
+Benchmark.ips do |x|
+  x.report("comprehension") { evaluator.evaluate(query) }
+  x.compare!
+end

data/benchmark/simple_rules.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+require "benchmark/ips"
+require "ruby/rego"
+
+policy = <<~REGO
+  package bench
+  default allow = false
+  allow { input.user == "admin" }
+REGO
+
+compiled = Ruby::Rego.compile(policy)
+input = { "user" => "admin" }
+query = "data.bench.allow"
+evaluator = Ruby::Rego::Evaluator.new(compiled, input: input)
+
+Benchmark.ips do |x|
+  x.report("simple rule") { evaluator.evaluate(query) }
+  x.compare!
+end

data/examples/README.md

@@ -0,0 +1,27 @@
+# Examples
+
+## CLI validation example
+
+From the repository root:
+
+```bash
+bundle exec exe/rego-validate --policy examples/validation_policy.rego --config examples/sample_config.yaml
+```
+
+Override the default query:
+
+```bash
+bundle exec exe/rego-validate --policy examples/validation_policy.rego --config examples/sample_config.yaml --query data.validation.deny
+```
+
+## Ruby API example
+
+```ruby
+require "ruby/rego"
+
+policy = File.read("examples/simple_policy.rego")
+input = {"user" => "admin"}
+
+result = Ruby::Rego.evaluate(policy, input: input, query: "data.example.allow")
+puts result.value.to_ruby
+```

data/examples/sample_config.yaml

@@ -0,0 +1,2 @@
+enabled: false
+timeout: 10

data/examples/simple_policy.rego

@@ -0,0 +1,7 @@
+package example
+
+default allow = false
+
+allow {
+  input.user == "admin"
+}

data/examples/validation_policy.rego

@@ -0,0 +1,11 @@
+package validation
+
+deny[msg] {
+  input.enabled == false
+  msg := "feature must be enabled"
+}
+
+deny[msg] {
+  input.timeout < 30
+  msg := "timeout must be at least 30"
+}

data/exe/rego-validate

@@ -0,0 +1,6 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require "ruby/rego/cli"
+
+exit RegoValidate::CLI.new(ARGV).run if $PROGRAM_NAME == __FILE__

data/lib/ruby/rego/ast/base.rb

@@ -0,0 +1,95 @@
+# frozen_string_literal: true
+
+module Ruby
+  module Rego
+    module AST
+      # Base class for all AST nodes.
+      #
+      # Provides location tracking, a visitor entry point, and common debugging
+      # helpers.
+      class Base
+        # @param location [Location, nil]
+        def initialize(location: nil)
+          @location = location
+        end
+
+        # @return [Location, nil]
+        attr_reader :location
+
+        # @param visitor [Object]
+        # @return [Object]
+        def accept(visitor)
+          visitor.visit(self)
+        end
+
+        # @param keys [Array<Symbol>, nil]
+        # @return [Hash<Symbol, Object>]
+        def deconstruct_keys(keys)
+          attributes = deconstruct_attributes
+          allowed = deconstructable_keys
+          filtered = attributes.slice(*allowed)
+          keys ? filtered.slice(*keys) : filtered
+        end
+
+        def deconstruct_attributes
+          attributes = {} # @type var attributes: Hash[Symbol, Object]
+          instance_variables.each_with_object(attributes) do |variable, result|
+            key = variable.to_s.delete_prefix("@").to_sym
+            result[key] = instance_variable_get(variable)
+          end
+          attributes
+        end
+
+        def deconstructable_keys
+          instance_variables.map { |variable| variable.to_s.delete_prefix("@").to_sym }
+        end
+
+        private :deconstruct_attributes, :deconstructable_keys
+
+        # @return [String]
+        def to_s
+          klass = self.class
+          attributes = instance_variables.sort.map do |variable|
+            value = instance_variable_get(variable)
+            "#{variable.to_s.delete_prefix("@")}=#{klass.format_value(value)}"
+          end
+
+          "#{klass.name}(#{attributes.join(", ")})"
+        end
+
+        # @param other [Object]
+        # @return [Boolean]
+        def ==(other)
+          return false unless other.instance_of?(self.class)
+
+          instance_variables.sort.all? do |variable|
+            instance_variable_get(variable) == other.instance_variable_get(variable)
+          end
+        end
+
+        # @param other [Object]
+        # @return [Boolean]
+        def eql?(other)
+          self == other
+        end
+
+        # @return [Integer]
+        def hash
+          values = instance_variables.sort.map { |variable| instance_variable_get(variable) }
+          [self.class, values].hash
+        end
+
+        # @param value [Object]
+        # @return [String]
+        def self.format_value(value)
+          case value
+          when String, Symbol, Numeric, Array, Hash, TrueClass, FalseClass, NilClass
+            value.inspect
+          else
+            value.to_s
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ruby/rego/ast/binary_op.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Ruby
+  module Rego
+    module AST
+      # Represents a binary operation.
+      class BinaryOp < Base
+        OPERATORS = %i[
+          eq
+          neq
+          and
+          or
+          lt
+          lte
+          gt
+          gte
+          in
+          plus
+          minus
+          mult
+          div
+          mod
+          assign
+          unify
+        ].freeze
+
+        # @param operator [Symbol]
+        # @param left [Object]
+        # @param right [Object]
+        # @param location [Location, nil]
+        def initialize(operator:, left:, right:, location: nil)
+          @operator = operator
+          validate_operator!
+          super(location: location)
+          @left = left
+          @right = right
+        end
+
+        # @return [Symbol]
+        attr_reader :operator
+
+        # @return [Object]
+        attr_reader :left
+
+        # @return [Object]
+        attr_reader :right
+
+        private
+
+        def validate_operator # rubocop:disable Naming/PredicateMethod
+          OPERATORS.include?(@operator)
+        end
+
+        def validate_operator!
+          return if validate_operator
+
+          raise ArgumentError, "Unknown binary operator: #{@operator.inspect}"
+        end
+      end
+    end
+  end
+end

data/lib/ruby/rego/ast/call.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Ruby
+  module Rego
+    module AST
+      # Represents a function or built-in call.
+      class Call < Base
+        # @param name [Object]
+        # @param args [Array<Object>]
+        # @param location [Location, nil]
+        def initialize(name:, args:, location: nil)
+          super(location: location)
+          @name = name
+          @args = args.dup.freeze
+        end
+
+        # @return [Object]
+        attr_reader :name
+
+        # @return [Array<Object>]
+        attr_reader :args
+      end
+    end
+  end
+end

data/lib/ruby/rego/ast/composite.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Ruby
+  module Rego
+    module AST
+      # Represents an array literal.
+      class ArrayLiteral < Base
+        # @param elements [Array<Object>]
+        # @param location [Location, nil]
+        def initialize(elements:, location: nil)
+          super(location: location)
+          @elements = elements.dup.freeze
+        end
+
+        # @return [Array<Object>]
+        attr_reader :elements
+      end
+
+      # Represents an object literal.
+      class ObjectLiteral < Base
+        # @param pairs [Array<Array(Object, Object)>]
+        # @param location [Location, nil]
+        def initialize(pairs:, location: nil)
+          super(location: location)
+          @pairs = pairs.map { |pair| pair.dup.freeze }.freeze
+        end
+
+        # @return [Array<Array(Object, Object)>]
+        attr_reader :pairs
+      end
+
+      # Represents a set literal.
+      class SetLiteral < Base
+        # @param elements [Array<Object>]
+        # @param location [Location, nil]
+        def initialize(elements:, location: nil)
+          super(location: location)
+          @elements = elements.dup.freeze
+        end
+
+        # @return [Array<Object>]
+        attr_reader :elements
+      end
+    end
+  end
+end

data/lib/ruby/rego/ast/comprehension.rb

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Ruby
+  module Rego
+    module AST
+      # Represents an array comprehension.
+      class ArrayComprehension < Base
+        # @param term [Object]
+        # @param body [Array<Object>]
+        # @param location [Location, nil]
+        def initialize(term:, body:, location: nil)
+          super(location: location)
+          @term = term
+          @body = body.dup.freeze
+        end
+
+        # @return [Object]
+        attr_reader :term
+
+        # @return [Object]
+        attr_reader :body
+      end
+
+      # Represents an object comprehension.
+      class ObjectComprehension < Base
+        # @param term [Object]
+        # @param body [Array<Object>]
+        # @param location [Location, nil]
+        def initialize(term:, body:, location: nil)
+          super(location: location)
+          @term = term
+          @body = body.dup.freeze
+        end
+
+        # @return [Object]
+        attr_reader :term
+
+        # @return [Object]
+        attr_reader :body
+      end
+
+      # Represents a set comprehension.
+      class SetComprehension < Base
+        # @param term [Object]
+        # @param body [Array<Object>]
+        # @param location [Location, nil]
+        def initialize(term:, body:, location: nil)
+          super(location: location)
+          @term = term
+          @body = body.dup.freeze
+        end
+
+        # @return [Object]
+        attr_reader :term
+
+        # @return [Object]
+        attr_reader :body
+      end
+    end
+  end
+end

data/lib/ruby/rego/ast/every.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Ruby
+  module Rego
+    module AST
+      # Represents an `every` expression.
+      class Every < Base
+        # @param value_var [Variable]
+        # @param domain [Object]
+        # @param body [Array<Object>]
+        # @param key_var [Variable, nil]
+        # @param location [Location, nil]
+        def initialize(value_var:, domain:, body:, key_var: nil, location: nil)
+          super(location: location)
+          @key_var = key_var
+          @value_var = value_var
+          @domain = domain
+          @body = body.dup.freeze
+        end
+
+        # @return [Variable, nil]
+        attr_reader :key_var
+
+        # @return [Variable]
+        attr_reader :value_var
+
+        # @return [Object]
+        attr_reader :domain
+
+        # @return [Array<Object>]
+        attr_reader :body
+      end
+    end
+  end
+end

data/lib/ruby/rego/ast/import.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Ruby
+  module Rego
+    module AST
+      # Represents an import declaration.
+      class Import < Base
+        # @param path [Array<String> | String]
+        # @param alias_name [String, nil]
+        # @param location [Location, nil]
+        def initialize(path:, alias_name: nil, location: nil)
+          super(location: location)
+          @path = path
+          @alias = alias_name
+        end
+
+        # @return [Array<String> | String]
+        attr_reader :path
+
+        # @return [String, nil]
+        attr_reader :alias
+
+        # @return [String, nil]
+        def alias_name
+          self.alias
+        end
+      end
+    end
+  end
+end

data/lib/ruby/rego/ast/literal.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Ruby
+  module Rego
+    module AST
+      # Base class for literal values.
+      class Literal < Base
+        # @param value [Object]
+        # @param location [Location, nil]
+        def initialize(value:, location: nil)
+          super(location: location)
+          @value = value
+        end
+
+        # @return [Object]
+        attr_reader :value
+      end
+
+      # Represents a string literal.
+      class StringLiteral < Literal
+        # @param value [String]
+        # @param location [Location, nil]
+        def initialize(value:, location: nil)
+          super
+        end
+      end
+
+      # Represents a template string with interpolations.
+      class TemplateString < Base
+        # @param parts [Array<Object>]
+        # @param location [Location, nil]
+        def initialize(parts:, location: nil)
+          super(location: location)
+          @parts = parts.dup.freeze
+        end
+
+        # @return [Array<Object>]
+        attr_reader :parts
+      end
+
+      # Represents a numeric literal.
+      class NumberLiteral < Literal
+        # @param value [Numeric]
+        # @param location [Location, nil]
+        def initialize(value:, location: nil)
+          super
+        end
+      end
+
+      # Represents a boolean literal.
+      class BooleanLiteral < Literal
+        # @param value [Boolean]
+        # @param location [Location, nil]
+        def initialize(value:, location: nil)
+          super
+        end
+      end
+
+      # Represents a null literal.
+      class NullLiteral < Literal
+        # @param location [Location, nil]
+        def initialize(location: nil)
+          super(value: nil, location: location)
+        end
+      end
+    end
+  end
+end

data/lib/ruby/rego/ast/module.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Ruby
+  module Rego
+    module AST
+      # Represents a complete Rego module.
+      class Module < Base
+        # @param package [Package]
+        # @param imports [Array<Import>]
+        # @param rules [Array<Rule>]
+        # @param location [Location, nil]
+        def initialize(package:, imports:, rules:, location: nil)
+          super(location: location)
+          @package = package
+          @imports = imports
+          @rules = rules
+        end
+
+        # @return [Package]
+        attr_reader :package
+
+        # @return [Array<Import>]
+        attr_reader :imports
+
+        # @return [Array<Rule>]
+        attr_reader :rules
+      end
+    end
+  end
+end

data/lib/ruby/rego/ast/package.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Ruby
+  module Rego
+    module AST
+      # Represents a package declaration.
+      class Package < Base
+        # @param path [Array<String>]
+        # @param location [Location, nil]
+        def initialize(path:, location: nil)
+          super(location: location)
+          @path = path
+        end
+
+        # @return [Array<String>]
+        attr_reader :path
+      end
+    end
+  end
+end