@magda/typescript-common 1.2.1 → 2.0.0-alpha.1

package/dist/OpaCompileResponseParser.js

@@ -1,9 +1,20 @@
 "use strict";
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.unknown2Ref = exports.value2String = exports.RegoRef = exports.RegoExp = exports.RegoTerm = exports.RegoOperators = exports.RegoRule = void 0;
+exports.unknown2Ref = exports.RegoRuleSet = exports.value2String = exports.RegoRef = exports.RegoExp = exports.RegoTerm = exports.RegoOperators = exports.RegoRule = void 0;
 const lodash_1 = __importDefault(require("lodash"));
 /**
  * @class RegoRule
@@ -19,6 +30,18 @@ const lodash_1 = __importDefault(require("lodash"));
  */
 class RegoRule {
     constructor(options) {
+        var _a;
+        /**
+         * Whether the rule contains any expressions that has any resolvable references.
+         * reference start with `input.` should be considered as non-resolvable in context of partial evaluation.
+         * When this field is set to `true`, we should not attempt to evaluate this expression.
+         * i.e. evaluate() method should return immediately.
+         * This will speed up evaluation process.
+         *
+         * @type {boolean}
+         * @memberof RegoRule
+         */
+        this.hasNoResolvableRef = false;
         this.isCompleteEvaluated = false;
         this.name = lodash_1.default.isString(options.name) ? options.name : "";
         this.fullName = lodash_1.default.isString(options.fullName) ? options.fullName : "";
@@ -42,6 +65,68 @@ class RegoRule {
         if (!(this.parser instanceof OpaCompileResponseParser)) {
             throw new Error("Require parser parameter to create a RegoRule");
         }
+        this.removeDuplicateExpressions();
+        if (((_a = this.expressions) === null || _a === void 0 ? void 0 : _a.length) &&
+            this.expressions.findIndex((exp) => !exp.hasNoResolvableRef) === -1) {
+            this.hasNoResolvableRef = true;
+        }
+        this.evaluate();
+    }
+    /**
+     * OPA PE result might contain duplicate expressions.
+     * https://github.com/open-policy-agent/opa/issues/4516
+     * This method will remove those duplication by simply string comparison.
+     *
+     * @return {*}
+     * @memberof RegoRule
+     */
+    removeDuplicateExpressions() {
+        var _a;
+        if (!((_a = this === null || this === void 0 ? void 0 : this.expressions) === null || _a === void 0 ? void 0 : _a.length)) {
+            return;
+        }
+        const expSet = new Set();
+        this.expressions = this.expressions.filter((exp) => {
+            const orgSetLength = expSet.size;
+            // exp.toJSON() is faster than exp.toConciseJSON()
+            expSet.add(exp.toJSON(0, true));
+            return expSet.size > orgSetLength;
+        });
+    }
+    /**
+     * Test whether the rule is an "impossible" rule.
+     * If so, the rule should be simply discarded.
+     * See: https://github.com/open-policy-agent/opa/issues/4516
+     *
+     * @return {*}  {boolean}
+     * @memberof RegoRule
+     */
+    isImpossible() {
+        var _a;
+        if (!((_a = this === null || this === void 0 ? void 0 : this.expressions) === null || _a === void 0 ? void 0 : _a.length)) {
+            return false;
+        }
+        const nonNegatedExpSet = new Set();
+        const negatedExps = this.expressions.filter((exp) => {
+            if (exp.isNegated) {
+                return true;
+            }
+            else {
+                // add non negated exp content to set
+                // exp.toJSON() is faster than exp.toConciseJSON()
+                nonNegatedExpSet.add(exp.toJSON(0, true));
+                return false;
+            }
+        });
+        if (!negatedExps.length) {
+            return false;
+        }
+        for (const exp of negatedExps) {
+            if (nonNegatedExpSet.has(exp.toJSON(0, true, true))) {
+                return true;
+            }
+        }
+        return false;
     }
     clone(options = {}) {
         const regoRule = new RegoRule(Object.assign({ name: this.name, fullName: this.fullName, isDefault: this.isDefault, value: this.value, isCompleteEvaluated: this.isCompleteEvaluated, expressions: this.expressions.map((e) => e.clone()), parser: this.parser }, options));
@@ -56,30 +141,56 @@ class RegoRule {
      * @memberof RegoRule
      */
     evaluate() {
-        this.expressions = this.expressions.map((exp) => exp.evaluate());
-        const falseExpression = this.expressions.find((exp) => exp.isMatch() === false);
-        if (!lodash_1.default.isUndefined(falseExpression)) {
-            // --- rule expressions are always evaluated in the context of AND
-            // --- any false expression will make the rule not match
+        var _a;
+        if (this.hasNoResolvableRef) {
+            return this;
+        }
+        if (this.isCompleteEvaluated) {
+            return this;
+        }
+        if (!((_a = this === null || this === void 0 ? void 0 : this.expressions) === null || _a === void 0 ? void 0 : _a.length)) {
+            // a rule with empty body / no expression is matched
             this.isCompleteEvaluated = true;
-            this.isMatched = false;
+            this.isMatched = true;
+            return this;
         }
-        else {
-            // --- filter out all expressions are evaluated
-            // --- note any non-false value will considered as a match (true) i.e. 0 is equivalent to true
-            // --- empty expression array indicates unconditional match (true)
-            const idx = this.expressions.findIndex((exp) => !exp.isCompleteEvaluated);
-            if (idx === -1) {
-                this.isCompleteEvaluated = true;
-                this.isMatched = true;
+        let unresolvable = false;
+        for (let i = 0; i < this.expressions.length; i++) {
+            const exp = this.expressions[i];
+            exp.evaluate();
+            if (!exp.isResolvable()) {
+                unresolvable = true;
+                continue;
             }
-            else {
-                // --- further dry the rule if the rule has unsolved exps
-                // --- if a exp is matched (i.e. true) it can be strip out as true AND xxxx = xxxx
-                this.expressions = this.expressions.filter((exp) => exp.isMatch() !== true);
+            if (!exp.isMatched()) {
+                // --- rule expressions are always evaluated in the context of AND
+                // --- any false expression will make the rule not match
+                this.isCompleteEvaluated = true;
+                this.isMatched = false;
+                return this;
             }
         }
-        return this;
+        if (unresolvable) {
+            // there is at least one exp is unresolvable now
+            return this;
+        }
+        else {
+            this.isCompleteEvaluated = true;
+            this.isMatched = true;
+            return this;
+        }
+    }
+    /**
+     * Whether or not the rule is resolvable (i.e. we can tell whether it's matched or not) now.
+     *
+     * @return {*}  {boolean}
+     * @memberof RegoRule
+     */
+    isResolvable() {
+        if (!this.isCompleteEvaluated) {
+            this.evaluate();
+        }
+        return this.isCompleteEvaluated;
     }
     /**
      * Generate Human Readable string of this rule
@@ -103,6 +214,30 @@ class RegoRule {
             return parts.join(" AND \n");
         }
     }
+    toData() {
+        return {
+            default: this.isDefault,
+            value: this.value,
+            fullName: this.fullName,
+            name: this.name,
+            expressions: this.expressions.map((exp, idx) => exp.toData(idx))
+        };
+    }
+    toJson() {
+        return JSON.stringify(this.toData());
+    }
+    toConciseData() {
+        return {
+            default: this.isDefault,
+            value: this.value,
+            fullName: this.fullName,
+            name: this.name,
+            expressions: this.expressions.map((exp) => exp.toConciseData())
+        };
+    }
+    toConciseJSON() {
+        return JSON.stringify(this.toConciseData());
+    }
     /**
      * Create RegoRule from Opa response data
      *
@@ -129,7 +264,6 @@ class RegoRule {
             parser
         };
         const regoRule = new RegoRule(ruleOptions);
-        regoRule.evaluate();
         return regoRule;
     }
     static createExpressionsFromRuleBodyData(data, parser) {
@@ -176,9 +310,23 @@ exports.RegoOperators = {
  */
 class RegoTerm {
     constructor(type, value, parser) {
+        /**
+         * Whether the expression contains any resolvable references.
+         * reference start with `input.` should be considered as non-resolvable in context of partial evaluation.
+         * When this field is set to `true`, we should not attempt to evaluate this expression.
+         * i.e. evaluate() method should return immediately.
+         * This will speed up evaluation process.
+         *
+         * @type {boolean}
+         * @memberof RegoTerm
+         */
+        this.hasNoResolvableRef = false;
         this.type = type;
         this.value = value;
         this.parser = parser;
+        if (this.value instanceof RegoRef && this.value.hasNoResolvableRef) {
+            this.hasNoResolvableRef = true;
+        }
     }
     clone() {
         return new RegoTerm(this.type, this.value, this.parser);
@@ -193,7 +341,7 @@ class RegoTerm {
         if (this.value instanceof RegoRef)
             return this.value.fullRefString();
         else
-            return this.value;
+            return JSON.stringify(this.value);
     }
     /**
      * If it's a reference term. A operator is an Reference term as well
@@ -329,6 +477,9 @@ class RegoTerm {
      * @memberof RegoTerm
      */
     getValue() {
+        if (this.hasNoResolvableRef) {
+            return undefined;
+        }
         if (!this.isRef()) {
             return this.value;
         }
@@ -338,13 +489,67 @@ class RegoTerm {
             }
             else {
                 const fullName = this.fullRefString();
-                const result = this.parser.completeRuleResults[fullName];
-                if (lodash_1.default.isUndefined(result))
+                if (!this.parser.isRefResolvable(fullName)) {
                     return undefined;
-                return result.value;
+                }
+                return this.parser.getRefValue(fullName);
             }
         }
     }
+    /**
+     * Whether or not the RegoTerm is resolvable
+     *
+     * @return {*}  {boolean}
+     * @memberof RegoTerm
+     */
+    isValueResolvable() {
+        if (this.hasNoResolvableRef) {
+            return false;
+        }
+        if (!this.isRef()) {
+            return true;
+        }
+        else {
+            if (this.isOperator()) {
+                return false;
+            }
+            else {
+                const fullName = this.fullRefString();
+                return this.parser.isRefResolvable(fullName);
+            }
+        }
+    }
+    toData() {
+        if (this.isRef()) {
+            return this.value.toData();
+        }
+        else {
+            return {
+                type: this.type,
+                value: this.value
+            };
+        }
+    }
+    toJson() {
+        return JSON.stringify(this.toData());
+    }
+    toConciseData() {
+        if (this.isRef()) {
+            return {
+                isRef: true,
+                value: this.fullRefString()
+            };
+        }
+        else {
+            return {
+                isRef: false,
+                value: this.value
+            };
+        }
+    }
+    toConciseJSON() {
+        return JSON.stringify(this.toConciseData());
+    }
     static parseFromData(data, parser) {
         if (data.type === "ref") {
             return new RegoTerm(data.type, RegoRef.parseFromData(data), parser);
@@ -363,6 +568,18 @@ exports.RegoTerm = RegoTerm;
  */
 class RegoExp {
     constructor(terms, isNegated = false, isCompleteEvaluated = false, value = null, parser) {
+        var _a;
+        /**
+         * Whether the expression contains any resolvable references.
+         * reference start with `input.` should be considered as non-resolvable in context of partial evaluation.
+         * When this field is set to `true`, we should not attempt to evaluate this expression.
+         * i.e. evaluate() method should return immediately.
+         * This will speed up evaluation process.
+         *
+         * @type {boolean}
+         * @memberof RegoExp
+         */
+        this.hasNoResolvableRef = false;
         /**
          * If it's complete evaluated
          *
@@ -382,6 +599,10 @@ class RegoExp {
         this.isCompleteEvaluated = isCompleteEvaluated;
         this.value = value;
         this.parser = parser;
+        if (((_a = this === null || this === void 0 ? void 0 : this.terms) === null || _a === void 0 ? void 0 : _a.length) &&
+            this.terms.findIndex((item) => !item.hasNoResolvableRef) === -1) {
+            this.hasNoResolvableRef = true;
+        }
     }
     clone() {
         const regoExp = new RegoExp(this.terms.map((t) => t.clone()), this.isNegated, this.isCompleteEvaluated, this.value, this.parser);
@@ -394,7 +615,22 @@ class RegoExp {
      * @memberof RegoExp
      */
     termsAsString() {
-        return this.terms.map((t) => t.asString());
+        return this.terms.map((t) => t.asString()).join(" ");
+    }
+    /**
+     * Print concise format expression string presentation.
+     * Can be used for debugging
+     *
+     * @return {*}
+     * @memberof RegoExp
+     */
+    asString() {
+        if (this.isNegated) {
+            return "NOT " + this.termsAsString();
+        }
+        else {
+            return this.termsAsString();
+        }
     }
     /**
      * Output human readable string
@@ -462,18 +698,41 @@ class RegoExp {
                 return this.value;
         }
     }
-    isMatch() {
-        const value = this.getValue();
-        if (lodash_1.default.isUndefined(value)) {
+    /**
+     * Whether or not a expression should be considered as "matched".
+     * If all expressions of a rule are "matched", the rule will be considered as "matched".
+     * Thus, the rule has a value.
+     *
+     * Please note: if an expression's value is `0`, empty string "", null etc, the expression is considered as "matched".
+     * We only consider an expression as "Not Matched" when the expression has value `false` or is undefined.
+     *
+     * @return {boolean}
+     * @memberof RegoExp
+     */
+    isMatched() {
+        if (!this.isResolvable()) {
             return undefined;
         }
+        const isMatched = this.value === false || lodash_1.default.isUndefined(this.value) ? false : true;
+        if (this.isNegated) {
+            return !isMatched;
+        }
         else {
-            if (value === false || lodash_1.default.isUndefined(value))
-                return false;
-            // --- 0 is a match
-            return true;
+            return isMatched;
         }
     }
+    /**
+     * Whether or not the expression is resolvable now.
+     *
+     * @return {boolean}
+     * @memberof RegoExp
+     */
+    isResolvable() {
+        if (!this.isCompleteEvaluated) {
+            this.evaluate();
+        }
+        return this.isCompleteEvaluated;
+    }
     /**
      * Convert operator term to string and put rest operands into an array.
      * And then return a [Operator, Operands] structure
@@ -492,12 +751,7 @@ class RegoExp {
                 operator = t.asOperator();
             }
             else {
-                const value = t.getValue();
-                if (!lodash_1.default.isUndefined(value)) {
-                    operands.push(new RegoTerm(typeof value, value, this.parser));
-                }
-                else
-                    operands.push(t);
+                operands.push(t);
             }
         });
         if (!operator) {
@@ -515,19 +769,27 @@ class RegoExp {
      * @memberof RegoExp
      */
     evaluate() {
+        if (this.hasNoResolvableRef) {
+            return this;
+        }
+        if (this.isCompleteEvaluated) {
+            return this;
+        }
+        // --- so far there is no 2 terms expression e.g. ! x
+        // --- builtin function should never be included in residual rule
+        // --- as we won't apply them on unknowns
         if (this.terms.length === 0) {
             // --- exp should be considered as matched (true)
-            // --- unless isNegated is true
-            // --- will try to normalise isNegated here
             this.isCompleteEvaluated = true;
-            this.value = this.isNegated ? false : true;
-            this.isNegated = false;
+            this.value = true;
+            return this;
         }
-        if (this.terms.length === 1) {
+        else if (this.terms.length === 1) {
             const term = this.terms[0];
-            const value = term.getValue();
-            if (lodash_1.default.isUndefined(value))
+            if (!term.isValueResolvable()) {
                 return this;
+            }
+            const value = term.getValue();
             this.value = value;
             this.isCompleteEvaluated = true;
             return this;
@@ -536,47 +798,101 @@ class RegoExp {
             // --- 3 terms expression e.g. true == true or x >= 3
             // --- we only evalute some redundant expression e.g. true == true or false != true
             const [operator, operands] = this.toOperatorOperandsArray();
-            if (operands.findIndex((op) => op.isRef()) !== -1) {
-                // --- this expression involve unknown no need to evalute
+            if (!operands[0].isValueResolvable() ||
+                !operands[1].isValueResolvable()) {
+                // if one of the term value is resolvable now, we can't evaluate further.
                 return this;
             }
-            else {
-                const operandsValues = operands.map((op) => op.getValue());
-                let value = null;
-                switch (operator) {
-                    case "=":
-                        value = operandsValues[0] === operandsValues[1];
-                        break;
-                    case ">":
-                        value = operandsValues[0] > operandsValues[1];
-                        break;
-                    case "<":
-                        value = operandsValues[0] < operandsValues[1];
-                        break;
-                    case ">=":
-                        value = operandsValues[0] >= operandsValues[1];
-                        break;
-                    case "<=":
-                        value = operandsValues[0] <= operandsValues[1];
-                        break;
-                    case "!=":
-                        value = operandsValues[0] != operandsValues[1];
-                        break;
-                    default:
-                        throw new Error(`Invalid 3 terms rego expression, Unknown operator "${operator}": ${this.termsAsString()}`);
-                }
-                this.isCompleteEvaluated = true;
-                this.value = value;
-                return this;
+            const operandsValues = operands.map((op) => op.getValue());
+            if (operandsValues.findIndex((v) => typeof v === "undefined")) {
             }
+            let value = null;
+            switch (operator) {
+                case "=":
+                    value = operandsValues[0] === operandsValues[1];
+                    break;
+                case ">":
+                    value = operandsValues[0] > operandsValues[1];
+                    break;
+                case "<":
+                    value = operandsValues[0] < operandsValues[1];
+                    break;
+                case ">=":
+                    value = operandsValues[0] >= operandsValues[1];
+                    break;
+                case "<=":
+                    value = operandsValues[0] <= operandsValues[1];
+                    break;
+                case "!=":
+                    value = operandsValues[0] != operandsValues[1];
+                    break;
+                default:
+                    throw new Error(`Invalid 3 terms rego expression, Unknown operator "${operator}": ${this.termsAsString()}`);
+            }
+            this.isCompleteEvaluated = true;
+            this.value = value;
+            return this;
         }
         else {
             throw new Error(`Invalid ${this.terms.length} terms rego expression: ${this.termsAsString()}`);
         }
-        // --- so far there is no 2 terms expression e.g. ! x
-        // --- builtin function should never be included in residual rule
-        // --- as we won't apply them on unknowns
-        return this;
+    }
+    toData(index = 0, ignoreIndex = false, ignoreNegated = false) {
+        const terms = this.terms.map((term) => term.toData());
+        if (this.isNegated && !ignoreNegated) {
+            if (ignoreIndex) {
+                return {
+                    negated: true,
+                    terms
+                };
+            }
+            else {
+                return {
+                    negated: true,
+                    index,
+                    terms
+                };
+            }
+        }
+        else {
+            if (ignoreIndex) {
+                return {
+                    terms
+                };
+            }
+            else {
+                return {
+                    index,
+                    terms
+                };
+            }
+        }
+    }
+    toJSON(index = 0, ignoreIndex = false, ignoreNegated = false) {
+        return JSON.stringify(this.toData(index, ignoreIndex, ignoreNegated));
+    }
+    toConciseData() {
+        let data;
+        if (this.terms.length === 1) {
+            const term = this.terms[0];
+            data = {
+                negated: this.isNegated,
+                operator: null,
+                operands: [term.toConciseData()]
+            };
+        }
+        else {
+            const [operator, operands] = this.toOperatorOperandsArray();
+            data = {
+                negated: this.isNegated,
+                operator,
+                operands: operands.map((item) => item.toConciseData())
+            };
+        }
+        return data;
+    }
+    toConciseJSON() {
+        return JSON.stringify(this.toConciseData());
     }
     static parseFromData(expData, parser) {
         const isNegated = expData.negated === true;
@@ -608,11 +924,38 @@ exports.RegoExp = RegoExp;
  */
 class RegoRef {
     constructor(parts) {
+        var _a;
+        /**
+         * Whether the expression contains any resolvable references.
+         * reference start with `input.` should be considered as non-resolvable in context of partial evaluation.
+         * When this field is set to `true`, we should not attempt to evaluate this expression.
+         * i.e. evaluate() method should return immediately.
+         * This will speed up evaluation process.
+         *
+         * @type {boolean}
+         * @memberof RegoRef
+         */
+        this.hasNoResolvableRef = false;
         this.parts = parts;
+        if (
+        // `input.` ref should be considered not resolvable in partial evaluate context.
+        (this.parts.length && ((_a = this.parts[0]) === null || _a === void 0 ? void 0 : _a.value) === "input") ||
+            this.isOperator()) {
+            this.hasNoResolvableRef = true;
+        }
     }
     clone() {
         return new RegoRef(this.parts.map((p) => (Object.assign({}, p))));
     }
+    toData() {
+        return {
+            type: "ref",
+            value: this.parts
+        };
+    }
+    toJson() {
+        return JSON.stringify(this.toData());
+    }
     static parseFromData(data) {
         if (data.type === "ref") {
             return new RegoRef(data.value);
@@ -662,10 +1005,8 @@ class RegoRef {
             if (isFirstPart)
                 isFirstPart = false;
             return partStr;
-            //--- a.[_].[_] should be a[_][_]
         })
-            .join(".")
-            .replace(/\.\[/g, "[");
+            .join(".");
         return this.removeAllPrefixs(str, removalPrefixs);
     }
     refString(removalPrefixs = []) {
@@ -718,6 +1059,189 @@ function value2String(value) {
         return JSON.stringify(value);
 }
 exports.value2String = value2String;
+class RegoRuleSet {
+    constructor(parser, rules, fullName = "", name = "") {
+        var _a, _b;
+        this.fullName = "";
+        this.name = "";
+        this.rules = [];
+        this.defaultRule = null;
+        this.isCompleteEvaluated = false;
+        /**
+         * Whether the ruleSet contains any rules that has any resolvable references.
+         * reference start with `input.` should be considered as non-resolvable in context of partial evaluation.
+         * When this field is set to `true`, we should not attempt to evaluate this expression.
+         * i.e. evaluate() method should return immediately.
+         * This will speed up evaluation process.
+         *
+         * @type {boolean}
+         * @memberof RegoRuleSet
+         */
+        this.hasNoResolvableRef = false;
+        this.parser = parser;
+        if (rules === null || rules === void 0 ? void 0 : rules.length) {
+            const defaultRuleIdx = rules.findIndex((r) => r.isDefault);
+            if (defaultRuleIdx !== -1) {
+                this.defaultRule = rules[defaultRuleIdx];
+            }
+            this.rules = rules.filter((r) => !r.isDefault);
+        }
+        if (fullName) {
+            this.fullName = fullName;
+        }
+        else if ((_a = rules === null || rules === void 0 ? void 0 : rules[0]) === null || _a === void 0 ? void 0 : _a.fullName) {
+            this.fullName = rules[0].fullName;
+        }
+        if (name) {
+            this.name = name;
+        }
+        else if ((_b = rules === null || rules === void 0 ? void 0 : rules[0]) === null || _b === void 0 ? void 0 : _b.name) {
+            this.name = rules[0].name;
+        }
+        if (this.rules.length &&
+            this.rules.findIndex((r) => !r.hasNoResolvableRef) === -1) {
+            this.hasNoResolvableRef = true;
+        }
+        this.evaluate();
+    }
+    evaluate() {
+        var _a;
+        if (this.hasNoResolvableRef) {
+            return this;
+        }
+        if (this.isCompleteEvaluated) {
+            return this;
+        }
+        if (!((_a = this.rules) === null || _a === void 0 ? void 0 : _a.length)) {
+            if (!this.defaultRule) {
+                this.isCompleteEvaluated = true;
+                this.value = undefined;
+                return this;
+            }
+            else {
+                if (this.defaultRule.isResolvable()) {
+                    this.isCompleteEvaluated = true;
+                    this.value = this.defaultRule.value;
+                    return this;
+                }
+                else {
+                    return this;
+                }
+            }
+        }
+        this.rules.forEach((r) => r.evaluate());
+        const matchedRule = this.rules.find((r) => r.isResolvable() && r.isMatched);
+        if (matchedRule) {
+            this.isCompleteEvaluated = true;
+            this.value = matchedRule.value;
+            return this;
+        }
+        if (this.rules.findIndex((r) => !r.isResolvable()) !== -1) {
+            // still has rule unresolvable
+            return this;
+        }
+        // rest (if any) are all unmatched rules
+        if (!this.defaultRule) {
+            this.isCompleteEvaluated = true;
+            this.value = undefined;
+            return this;
+        }
+        else {
+            if (this.defaultRule.isResolvable()) {
+                this.isCompleteEvaluated = true;
+                this.value = this.defaultRule.value;
+                return this;
+            }
+            else {
+                return this;
+            }
+        }
+    }
+    isResolvable() {
+        if (!this.isCompleteEvaluated) {
+            this.evaluate();
+        }
+        return this.isCompleteEvaluated;
+    }
+    getResidualRules() {
+        if (this.isResolvable()) {
+            return [];
+        }
+        let rules = this.defaultRule
+            ? [this.defaultRule, ...this.rules]
+            : [...this.rules];
+        rules = this.rules.filter((r) => !r.isResolvable());
+        if (!rules.length) {
+            return [];
+        }
+        rules = lodash_1.default.flatMap(rules, (rule) => {
+            // all resolvable expressions can all be ignored as:
+            // - if the expression is resolved to "matched", it won't impact the result of the rule
+            // - if the expression is resolved to "unmatched", the rule should be resolved to "unmatched" earlier.
+            const unresolvedExpressions = rule.expressions.filter((exp) => !exp.isResolvable());
+            if (unresolvedExpressions.length !== 1) {
+                return [rule];
+            }
+            // For rules with single expression, reduce the layer by replacing it with target reference rules
+            const exp = unresolvedExpressions[0];
+            if (exp.terms.length === 1) {
+                const fullName = exp.terms[0].fullRefString();
+                const ruleSet = this.parser.ruleSets[fullName];
+                if (!ruleSet) {
+                    const compressedRule = rule.clone();
+                    compressedRule.expressions = [exp];
+                    return [compressedRule];
+                }
+                return ruleSet.getResidualRules();
+            }
+            else if (exp.terms.length === 3) {
+                const [operator, [op1, op2]] = exp.toOperatorOperandsArray();
+                if (operator != "=" && operator != "!=") {
+                    // For now, we will only further process the ref when operator is = or !=
+                    return [rule];
+                }
+                if (!op1.isValueResolvable() && !op2.isValueResolvable()) {
+                    // when both op1 & op1 are not resolvable ref, we will not attempt to process further
+                    return [rule];
+                }
+                const value = op1.isValueResolvable()
+                    ? op1.getValue()
+                    : op2.getValue();
+                const refTerm = op1.isValueResolvable() ? op2 : op1;
+                const fullName = refTerm.fullRefString();
+                const ruleSet = this.parser.ruleSets[fullName];
+                if (!ruleSet) {
+                    const compressedRule = rule.clone();
+                    compressedRule.expressions = [exp];
+                    return [compressedRule];
+                }
+                let refRules = ruleSet.getResidualRules();
+                // when negated expression, reverse the operator
+                const convertedOperator = exp.isNegated
+                    ? operator == "="
+                        ? "!="
+                        : "="
+                    : operator;
+                if (convertedOperator == "=") {
+                    refRules = refRules.filter((r) => r.value == value);
+                }
+                else {
+                    refRules = refRules.filter((r) => r.value != value);
+                }
+                if (!refRules.length) {
+                    // this means this rule can never matched
+                    return [];
+                }
+                return refRules;
+            }
+            else {
+                throw new Error(`Failed to produce residualRules for rule: ${rule.toJson()}`);
+            }
+        });
+        return rules;
+    }
+}
+exports.RegoRuleSet = RegoRuleSet;
 /**
  * OPA result Parser
  *
@@ -756,6 +1280,13 @@ class OpaCompileResponseParser {
          * @memberof OpaCompileResponseParser
          */
         this.rules = [];
+        /**
+         * Parsed, compressed & evaluated rule sets
+         *
+         * @type {RegoRuleSet[]}
+         * @memberof OpaCompileResponseParser
+         */
+        this.ruleSets = {};
         this.queries = [];
         /**
          * A cache of all resolved rule result
@@ -774,6 +1305,7 @@ class OpaCompileResponseParser {
          * @memberof OpaCompileResponseParser
          */
         this.pseudoQueryRuleName = RegoRule.randomRuleName("default_rule_");
+        this.ruleDuplicationCheckCache = {};
     }
     setQueryRuleResult(val) {
         this.completeRuleResults[this.pseudoQueryRuleName] = {
@@ -797,20 +1329,26 @@ class OpaCompileResponseParser {
         else {
             this.data = json;
         }
-        if (!this.data.result) {
+        /**
+         * OPA might output {"result": {}} as unconditional `false` or never matched
+         */
+        if (!this.data.result || !Object.keys(this.data.result).length) {
             // --- mean no rule matched
             this.setQueryRuleResult(false);
             return [];
         }
         this.data = this.data.result;
-        if ((!this.data.queries ||
+        if (!this.data.queries ||
             !lodash_1.default.isArray(this.data.queries) ||
-            !this.data.queries.length) &&
-            (!lodash_1.default.isArray(this.data.support) || !this.data.support.length)) {
-            // --- mean no rule matched
+            !this.data.queries.length) {
             this.setQueryRuleResult(false);
             return [];
         }
+        if (this.data.queries.findIndex((q) => !(q === null || q === void 0 ? void 0 : q.length)) !== -1) {
+            //  when query is always true, the "queries" value in the result will contain an empty array
+            this.setQueryRuleResult(true);
+            return [];
+        }
         const queries = this.data.queries;
         if (queries) {
             if (queries.findIndex((ruleBody) => !ruleBody || !ruleBody.length) !== -1) {
@@ -828,9 +1366,9 @@ class OpaCompileResponseParser {
                     value: true,
                     parser: this
                 });
-                rule.evaluate();
-                this.originalRules.push(rule);
-                this.rules.push(rule);
+                // this.originalRules.push(rule);
+                // this.rules.push(rule);
+                this.addRule(rule);
             });
         }
         const packages = this.data.support;
@@ -844,85 +1382,69 @@ class OpaCompileResponseParser {
                 const rules = p.rules;
                 rules.forEach((r) => {
                     const regoRule = RegoRule.parseFromData(r, packageName, this);
-                    this.originalRules.push(regoRule);
-                    // --- only save matched rules
-                    if (!regoRule.isCompleteEvaluated) {
-                        this.rules.push(regoRule);
-                    }
-                    else {
-                        if (regoRule.isMatched) {
-                            this.rules.push(regoRule);
-                        }
-                    }
+                    //this.originalRules.push(regoRule);
+                    //this.rules.push(regoRule);
+                    this.addRule(regoRule);
                 });
             });
         }
-        this.calculateCompleteRuleResult();
-        this.reduceDependencies();
+        this.ruleDuplicationCheckCache = {};
+        lodash_1.default.uniq(this.rules.map((r) => r.fullName)).forEach((fullName) => (this.ruleSets[fullName] = new RegoRuleSet(this, this.rules.filter((r) => r.fullName === fullName), fullName)));
+        this.resolveAllRuleSets();
         return this.rules;
     }
-    /**
-     * Tried to merge rules outcome so that the ref value can be established easier
-     * After this step, any rules doesn't involve unknown should be merged to one value
-     * This will help to generate more concise query later.
-     * `CompleteRule` rule involves no `unknowns`
-     *
-     * Only for internal usage
-     *
-     * @private
-     * @memberof OpaCompileResponseParser
-     */
-    calculateCompleteRuleResult() {
-        const fullNames = this.rules.map((r) => r.fullName);
-        fullNames.forEach((fullName) => {
-            const rules = this.rules.filter((r) => r.fullName === fullName);
-            const nonCompletedRules = rules.filter((r) => !r.isCompleteEvaluated);
-            const completedRules = rules.filter((r) => r.isCompleteEvaluated);
-            const defaultRules = completedRules.filter((r) => r.isDefault);
-            const nonDefaultRules = completedRules.filter((r) => !r.isDefault);
-            if (nonDefaultRules.length) {
-                // --- if a non default complete eveluated rules exist
-                // --- it will be the final outcome
-                this.completeRuleResults[fullName] = this.createCompleteRuleResult(nonDefaultRules[0]);
-                return;
-            }
-            if (!nonCompletedRules.length) {
-                // --- if no unevaluated rule left, default rule value should be used
-                if (defaultRules.length) {
-                    this.completeRuleResults[fullName] = this.createCompleteRuleResult(defaultRules[0]);
-                    return;
-                }
-                else {
-                    // --- no matched complete non default rule left; Not possible
-                    throw new Error(`Unexpected empty rule result for ${fullName}`);
-                }
+    addRule(rule) {
+        this.originalRules.push(rule);
+        if (rule.isImpossible()) {
+            return;
+        }
+        if (!this.ruleDuplicationCheckCache[rule.fullName]) {
+            this.ruleDuplicationCheckCache[rule.fullName] = new Set();
+        }
+        const setData = this.ruleDuplicationCheckCache[rule.fullName];
+        const _a = rule.toData(), { name, fullName } = _a, ruleData = __rest(_a, ["name", "fullName"]);
+        const jsonData = JSON.stringify(ruleData);
+        const size = setData.size;
+        setData.add(jsonData);
+        if (size === setData.size) {
+            return;
+        }
+        this.rules.push(rule);
+    }
+    isRefResolvable(fullName) {
+        if (this.completeRuleResults[fullName]) {
+            return true;
+        }
+        const ruleSet = this.ruleSets[fullName];
+        if (!ruleSet) {
+            return false;
+        }
+        return ruleSet.isResolvable();
+    }
+    getRefValue(fullName) {
+        const completeResult = this.completeRuleResults[fullName];
+        if (completeResult) {
+            return completeResult.value;
+        }
+        const ruleSet = this.ruleSets[fullName];
+        if (!ruleSet || !ruleSet.isResolvable()) {
+            return undefined;
+        }
+        return ruleSet.value;
+    }
+    resolveAllRuleSets() {
+        while (true) {
+            const unresolvedSetsNum = Object.values(this.ruleSets).filter((rs) => !rs.isResolvable()).length;
+            if (!unresolvedSetsNum) {
+                break;
             }
-            else {
-                // --- do nothing
-                // --- Some defaultRules might be able to strip out once
-                // --- nonCompleteRules are determined later
-                return;
+            Object.values(this.ruleSets).forEach((rs) => rs.evaluate());
+            const newUnresolvedSetsNum = Object.values(this.ruleSets).filter((rs) => !rs.isResolvable()).length;
+            if (!newUnresolvedSetsNum ||
+                newUnresolvedSetsNum >= unresolvedSetsNum) {
+                break;
             }
-        });
-    }
-    /**
-     * Only for internal usage
-     *
-     * @returns
-     * @private
-     * @memberof OpaCompileResponseParser
-     */
-    reduceDependencies() {
-        const rules = this.rules.filter((r) => !r.isCompleteEvaluated);
-        if (!rules.length)
-            return;
-        for (let i = 0; i < rules.length; i++) {
-            const rule = rules[i];
-            rule.expressions = rule.expressions.map((e) => e.evaluate());
-            rule.evaluate();
         }
-        // --- unmatched non-default rule can be stripped out
-        this.rules = this.rules.filter((r) => !(r.isCompleteEvaluated && !r.isMatched && !r.isDefault));
     }
     /**
      * Call to evaluate a rule
@@ -932,136 +1454,28 @@ class OpaCompileResponseParser {
      * @memberof OpaCompileResponseParser
      */
     evaluateRule(fullName) {
-        var _a, _b, _c;
-        if ((_b = (_a = this.completeRuleResults) === null || _a === void 0 ? void 0 : _a[fullName]) === null || _b === void 0 ? void 0 : _b.isCompleteEvaluated) {
-            // --- already evaluated during paring or dependencies removal
-            return (_c = this.completeRuleResults) === null || _c === void 0 ? void 0 : _c[fullName];
+        if (this.completeRuleResults[fullName]) {
+            return this.completeRuleResults[fullName];
         }
-        let rules = this.rules.filter((r) => r.fullName === fullName);
-        const originalRuleName = rules[0].name;
-        if (!rules.length) {
-            // --- no any rule matched; often (depends on your policy) it means a overall non-matched (false)
+        const ruleSet = this.ruleSets[fullName];
+        if (!ruleSet) {
             return null;
         }
-        const defaultRule = rules.find((r) => r.isDefault);
-        const defaultValue = lodash_1.default.isUndefined(defaultRule)
-            ? undefined
-            : defaultRule.value;
-        if (rules.find((r) => r.isCompleteEvaluated))
-            // --- filter out default rules & unmatched
-            // --- isMatch is only set when r.isCompleteEvaluated = true
-            rules = rules.filter((r) => !(r.isDefault || (r.isCompleteEvaluated && !r.isMatched)));
-        if (!rules.length) {
+        if (ruleSet.isResolvable()) {
             return {
                 fullName,
-                name: defaultRule ? defaultRule.name : "",
-                value: defaultValue,
-                isCompleteEvaluated: true,
-                residualRules: []
+                name: ruleSet.name,
+                value: ruleSet.value,
+                isCompleteEvaluated: true
             };
         }
         else {
-            const matchedRule = rules.find((r) => r.isMatched);
-            if (matchedRule) {
-                return {
-                    fullName,
-                    name: originalRuleName,
-                    value: matchedRule.value,
-                    isCompleteEvaluated: true,
-                    residualRules: []
-                };
-            }
-            const ruleWithEmptyExps = rules.find((r) => !r.expressions.length);
-            if (ruleWithEmptyExps) {
-                // empty exp / body means unconditional match
-                return {
-                    fullName,
-                    name: originalRuleName,
-                    value: ruleWithEmptyExps.value,
-                    isCompleteEvaluated: true,
-                    residualRules: []
-                };
-            }
-            if (rules.length === 1 && rules[0].expressions.length === 1) {
-                rules[0].expressions[0].terms.length === 1;
-            }
-            // if a rules contains one expression only, we will try to resolve any possible rule ref
-            rules = lodash_1.default.flatMap(rules, (rule) => {
-                if (rules.length === 1 && rules[0].expressions.length === 1) {
-                    const exp = rules[0].expressions[0];
-                    if (exp.terms.length === 1 && exp.terms[0].isRef()) {
-                        const ruleRef = exp.terms[0].fullRefString();
-                        const result = this.evaluateRule(ruleRef);
-                        if (result) {
-                            if (result.isCompleteEvaluated) {
-                                return [
-                                    RegoRule.createFromValue(result.value, this)
-                                ];
-                            }
-                            else {
-                                return result.residualRules;
-                            }
-                        }
-                        else {
-                            return [rule];
-                        }
-                    }
-                    else if (exp.terms.length === 3) {
-                        const [opStr, [op1, op2]] = exp.toOperatorOperandsArray();
-                        if (opStr === "=" &&
-                            ((op1.isRef() && typeof op2.value === "boolean") ||
-                                (op2.isRef() && typeof op1.value === "boolean"))) {
-                            const ruleRef = op1.isRef()
-                                ? op1.fullRefString()
-                                : op2.fullRefString();
-                            const bVal = typeof op1.value === "boolean"
-                                ? op1.value
-                                : op2.value;
-                            const result = this.evaluateRule(ruleRef);
-                            if (result) {
-                                if (result.isCompleteEvaluated) {
-                                    if (bVal === false) {
-                                        return [
-                                            RegoRule.createFromValue(!result.value, this)
-                                        ];
-                                    }
-                                    else {
-                                        return [
-                                            RegoRule.createFromValue(result.value, this)
-                                        ];
-                                    }
-                                }
-                                else {
-                                    if (bVal === false) {
-                                        return result.residualRules.map((r) => r.clone({ value: !r.value }));
-                                    }
-                                    else {
-                                        return result.residualRules;
-                                    }
-                                }
-                            }
-                            else {
-                                return [rule];
-                            }
-                        }
-                        else {
-                            return [rule];
-                        }
-                    }
-                    else {
-                        return [rule];
-                    }
-                }
-                else {
-                    return [rule];
-                }
-            });
             return {
                 fullName,
-                name: rules[0].name,
+                name: ruleSet.name,
                 value: undefined,
                 isCompleteEvaluated: false,
-                residualRules: rules
+                residualRules: ruleSet.getResidualRules()
             };
         }
     }
@@ -1086,6 +1500,9 @@ class OpaCompileResponseParser {
         if (result === null)
             return "null";
         if (result.isCompleteEvaluated) {
+            if (typeof result.value === "undefined") {
+                return "undefined";
+            }
             return value2String(result.value);
         }
         let parts = result.residualRules.map((r) => r.toHumanReadableString());
@@ -1103,23 +1520,6 @@ class OpaCompileResponseParser {
     evaluateAsHumanReadableString() {
         return this.evaluateRuleAsHumanReadableString(this.pseudoQueryRuleName);
     }
-    /**
-     * Only for internal usage
-     *
-     * @param {RegoRule} rule
-     * @returns {CompleteRuleResult}
-     * @private
-     * @memberof OpaCompileResponseParser
-     */
-    createCompleteRuleResult(rule) {
-        return {
-            fullName: rule.fullName,
-            name: rule.name,
-            value: rule.value,
-            isCompleteEvaluated: true,
-            residualRules: []
-        };
-    }
     reportWarns(msg) {
         this.warns.push(msg);
         this.hasWarns = true;