@stackonward/cli 0.0.1 → 1.0.1

package/dist/resources/templates/go-backend/internal/common/ruleexpression/decoder_test.go

@@ -0,0 +1,260 @@
+package ruleexpression
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
+	"testing"
+)
+
+func TestDecodeAcceptsAllNodeOperatorAndValueTypes(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name string
+		root string
+	}{
+		{name: "all", root: `{"kind":"all","children":[{"kind":"predicate","subject":"attribute","key":"enabled","operator":"exists"}]}`},
+		{name: "any", root: `{"kind":"any","children":[{"kind":"predicate","subject":"attribute","key":"enabled","operator":"exists"}]}`},
+		{name: "not", root: `{"kind":"not","child":{"kind":"predicate","subject":"attribute","key":"enabled","operator":"exists"}}`},
+		{name: "product_eq", root: `{"kind":"predicate","subject":"product","key":"code","operator":"eq","value":"alpha"}`},
+		{name: "product_eq_typed_string", root: `{"kind":"predicate","subject":"product","key":"code","operator":"eq","value":"partner-product"}`},
+		{name: "product_neq", root: `{"kind":"predicate","subject":"product","key":"lifecycle_status","operator":"neq","value":"inactive"}`},
+		{name: "product_in", root: `{"kind":"predicate","subject":"product","key":"code","operator":"in","value":["alpha","beta"]}`},
+		{name: "product_not_in", root: `{"kind":"predicate","subject":"product","key":"code","operator":"not_in","value":["retired_product"]}`},
+		{name: "attribute_exists", root: `{"kind":"predicate","subject":"attribute","key":"commerce_model","operator":"exists"}`},
+		{name: "attribute_eq_boolean", root: `{"kind":"predicate","subject":"attribute","key":"enabled","operator":"eq","value":true}`},
+		{name: "attribute_eq_number", root: `{"kind":"predicate","subject":"attribute","key":"threshold","operator":"eq","value":1.5}`},
+		{name: "attribute_eq_string", root: `{"kind":"predicate","subject":"attribute","key":"commerce_model","operator":"eq","value":"physical_goods"}`},
+		{name: "attribute_eq_string_array", root: `{"kind":"predicate","subject":"attribute","key":"regions","operator":"eq","value":["east","west"]}`},
+		{name: "attribute_eq_surrogate_pair", root: `{"kind":"predicate","subject":"attribute","key":"label","operator":"eq","value":"\ud83d\ude00"}`},
+		{name: "attribute_neq", root: `{"kind":"predicate","subject":"attribute","key":"commerce_model","operator":"neq","value":"saas"}`},
+		{name: "attribute_in", root: `{"kind":"predicate","subject":"attribute","key":"commerce_model","operator":"in","value":["physical_goods","saas"]}`},
+		{name: "attribute_not_in", root: `{"kind":"predicate","subject":"attribute","key":"commerce_model","operator":"not_in","value":["marketplace"]}`},
+		{name: "capability_active", root: `{"kind":"predicate","subject":"capability","key":"scheduled_fulfillment","operator":"active"}`},
+		{name: "capability_inactive", root: `{"kind":"predicate","subject":"capability","key":"scheduled_fulfillment","operator":"inactive"}`},
+		{name: "insights_available", root: `{"kind":"predicate","subject":"insights_metric","key":"trade.gmv_daily","operator":"available"}`},
+		{name: "insights_fresh", root: `{"kind":"predicate","subject":"insights_metric","key":"trade.gmv_daily","operator":"fresh_within_seconds","value":900}`},
+		{name: "product_dataset_available", root: `{"kind":"predicate","subject":"product_dataset","key":"source.capacity","operator":"available"}`},
+		{name: "product_dataset_fresh", root: `{"kind":"predicate","subject":"product_dataset","key":"source.capacity","operator":"fresh_within_seconds","value":60}`},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+			raw := []byte(`{"schema_version":1,"root":` + test.root + `}`)
+			if _, err := Decode(raw); err != nil {
+				t.Fatalf("Decode() error = %v", err)
+			}
+		})
+	}
+}
+
+func TestDecodeRejectsMalformedDuplicateUnknownAndInvalidShapes(t *testing.T) {
+	t.Parallel()
+
+	invalidUTF8 := append([]byte(`{"schema_version":1,"root":{"kind":"predicate","subject":"attribute","key":"label","operator":"eq","value":"`), 0xff)
+	invalidUTF8 = append(invalidUTF8, []byte(`"}}`)...)
+	tests := []struct {
+		name string
+		raw  []byte
+		code ErrorCode
+	}{
+		{name: "empty", raw: nil, code: ErrorCodeInvalidJSON},
+		{name: "malformed", raw: []byte(`{"schema_version":1`), code: ErrorCodeInvalidJSON},
+		{name: "array_envelope", raw: []byte(`[]`), code: ErrorCodeInvalidJSON},
+		{name: "trailing_value", raw: []byte(`{"schema_version":1,"root":{"kind":"predicate","subject":"attribute","key":"enabled","operator":"exists"}} {}`), code: ErrorCodeInvalidJSON},
+		{name: "schema_float", raw: []byte(`{"schema_version":1.0,"root":{"kind":"predicate","subject":"attribute","key":"enabled","operator":"exists"}}`), code: ErrorCodeUnsupportedSchemaVersion},
+		{name: "schema_unknown", raw: []byte(`{"schema_version":2,"root":{"kind":"predicate","subject":"attribute","key":"enabled","operator":"exists"}}`), code: ErrorCodeUnsupportedSchemaVersion},
+		{name: "missing_root", raw: []byte(`{"schema_version":1}`), code: ErrorCodeMissingField},
+		{name: "null_root", raw: []byte(`{"schema_version":1,"root":null}`), code: ErrorCodeInvalidJSON},
+		{name: "duplicate_envelope", raw: []byte(`{"schema_version":1,"schema_version":1,"root":{"kind":"predicate","subject":"attribute","key":"enabled","operator":"exists"}}`), code: ErrorCodeDuplicateField},
+		{name: "escaped_duplicate_node", raw: []byte(`{"schema_version":1,"root":{"kind":"predicate","\u006bind":"predicate","subject":"attribute","key":"enabled","operator":"exists"}}`), code: ErrorCodeDuplicateField},
+		{name: "nested_duplicate", raw: []byte(`{"schema_version":1,"root":{"kind":"not","child":{"kind":"predicate","subject":"attribute","key":"enabled","key":"other","operator":"exists"}}}`), code: ErrorCodeDuplicateField},
+		{name: "unknown_envelope_field", raw: []byte(`{"schema_version":1,"root":{"kind":"predicate","subject":"attribute","key":"enabled","operator":"exists"},"extra":true}`), code: ErrorCodeUnknownField},
+		{name: "unknown_node_field", raw: []byte(`{"schema_version":1,"root":{"kind":"all","children":[{"kind":"predicate","subject":"attribute","key":"enabled","operator":"exists"}],"extra":true}}`), code: ErrorCodeUnknownField},
+		{name: "unknown_predicate_field", raw: []byte(`{"schema_version":1,"root":{"kind":"predicate","subject":"attribute","key":"enabled","operator":"exists","extra":true}}`), code: ErrorCodeUnknownField},
+		{name: "missing_kind", raw: []byte(`{"schema_version":1,"root":{"children":[]}}`), code: ErrorCodeMissingField},
+		{name: "kind_wrong_type", raw: []byte(`{"schema_version":1,"root":{"kind":1}}`), code: ErrorCodeInvalidJSON},
+		{name: "unknown_kind", raw: []byte(`{"schema_version":1,"root":{"kind":"xor","children":[]}}`), code: ErrorCodeInvalidNode},
+		{name: "all_missing_children", raw: []byte(`{"schema_version":1,"root":{"kind":"all"}}`), code: ErrorCodeMissingField},
+		{name: "children_not_array", raw: []byte(`{"schema_version":1,"root":{"kind":"all","children":{}}}`), code: ErrorCodeInvalidJSON},
+		{name: "empty_children", raw: []byte(`{"schema_version":1,"root":{"kind":"any","children":[]}}`), code: ErrorCodeInvalidNode},
+		{name: "not_missing_child", raw: []byte(`{"schema_version":1,"root":{"kind":"not"}}`), code: ErrorCodeMissingField},
+		{name: "null_child", raw: []byte(`{"schema_version":1,"root":{"kind":"not","child":null}}`), code: ErrorCodeInvalidJSON},
+		{name: "predicate_missing_subject", raw: []byte(`{"schema_version":1,"root":{"kind":"predicate","key":"enabled","operator":"exists"}}`), code: ErrorCodeMissingField},
+		{name: "predicate_missing_key", raw: []byte(`{"schema_version":1,"root":{"kind":"predicate","subject":"attribute","operator":"exists"}}`), code: ErrorCodeMissingField},
+		{name: "predicate_missing_operator", raw: []byte(`{"schema_version":1,"root":{"kind":"predicate","subject":"attribute","key":"enabled"}}`), code: ErrorCodeMissingField},
+		{name: "subject_wrong_type", raw: []byte(`{"schema_version":1,"root":{"kind":"predicate","subject":1,"key":"enabled","operator":"exists"}}`), code: ErrorCodeInvalidJSON},
+		{name: "key_wrong_type", raw: []byte(`{"schema_version":1,"root":{"kind":"predicate","subject":"attribute","key":false,"operator":"exists"}}`), code: ErrorCodeInvalidJSON},
+		{name: "operator_wrong_type", raw: []byte(`{"schema_version":1,"root":{"kind":"predicate","subject":"attribute","key":"enabled","operator":[]}}`), code: ErrorCodeInvalidJSON},
+		{name: "unknown_subject", raw: []byte(`{"schema_version":1,"root":{"kind":"predicate","subject":"account","key":"enabled","operator":"exists"}}`), code: ErrorCodeInvalidPredicate},
+		{name: "unknown_operator", raw: []byte(`{"schema_version":1,"root":{"kind":"predicate","subject":"attribute","key":"enabled","operator":"matches","value":"yes"}}`), code: ErrorCodeInvalidPredicate},
+		{name: "subject_operator_mismatch", raw: []byte(`{"schema_version":1,"root":{"kind":"predicate","subject":"capability","key":"billing","operator":"eq","value":"active"}}`), code: ErrorCodeInvalidPredicate},
+		{name: "missing_value", raw: []byte(`{"schema_version":1,"root":{"kind":"predicate","subject":"attribute","key":"enabled","operator":"eq"}}`), code: ErrorCodeInvalidPredicate},
+		{name: "unexpected_value", raw: []byte(`{"schema_version":1,"root":{"kind":"predicate","subject":"capability","key":"billing","operator":"active","value":true}}`), code: ErrorCodeInvalidPredicate},
+		{name: "null_value", raw: []byte(`{"schema_version":1,"root":{"kind":"predicate","subject":"attribute","key":"enabled","operator":"eq","value":null}}`), code: ErrorCodeInvalidPredicate},
+		{name: "object_value", raw: []byte(`{"schema_version":1,"root":{"kind":"predicate","subject":"attribute","key":"enabled","operator":"eq","value":{}}}`), code: ErrorCodeInvalidPredicate},
+		{name: "numeric_array_value", raw: []byte(`{"schema_version":1,"root":{"kind":"predicate","subject":"attribute","key":"enabled","operator":"in","value":[1]}}`), code: ErrorCodeInvalidJSON},
+		{name: "nested_array_value", raw: []byte(`{"schema_version":1,"root":{"kind":"predicate","subject":"attribute","key":"enabled","operator":"in","value":[["yes"]]}}`), code: ErrorCodeInvalidJSON},
+		{name: "number_outside_binary64", raw: []byte(`{"schema_version":1,"root":{"kind":"predicate","subject":"attribute","key":"threshold","operator":"eq","value":1e400}}`), code: ErrorCodeInvalidNumber},
+		{name: "invalid_catalog_code", raw: []byte(`{"schema_version":1,"root":{"kind":"predicate","subject":"attribute","key":"Bad-Code","operator":"exists"}}`), code: ErrorCodeInvalidPredicate},
+		{name: "dataset_not_namespaced", raw: []byte(`{"schema_version":1,"root":{"kind":"predicate","subject":"product_dataset","key":"capacity","operator":"available"}}`), code: ErrorCodeInvalidPredicate},
+		{name: "invalid_utf8", raw: invalidUTF8, code: ErrorCodeInvalidUnicode},
+		{name: "lone_high_surrogate", raw: []byte(`{"schema_version":1,"root":{"kind":"predicate","subject":"attribute","key":"label","operator":"eq","value":"\ud800"}}`), code: ErrorCodeInvalidUnicode},
+		{name: "lone_low_surrogate", raw: []byte(`{"schema_version":1,"root":{"kind":"predicate","subject":"attribute","key":"label","operator":"eq","value":"\udc00"}}`), code: ErrorCodeInvalidUnicode},
+		{name: "noncharacter_value", raw: []byte(`{"schema_version":1,"root":{"kind":"predicate","subject":"attribute","key":"label","operator":"eq","value":"\ufdd0"}}`), code: ErrorCodeInvalidUnicode},
+		{name: "plane_noncharacter_value", raw: []byte(`{"schema_version":1,"root":{"kind":"predicate","subject":"attribute","key":"label","operator":"eq","value":"\ud83f\udffe"}}`), code: ErrorCodeInvalidUnicode},
+		{name: "noncharacter_field_name", raw: []byte(`{"schema_version":1,"root":{"kind":"predicate","subject":"attribute","key":"label","operator":"exists"},"\ufffe":true}`), code: ErrorCodeInvalidUnicode},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+			_, err := Decode(test.raw)
+			assertErrorCode(t, err, test.code)
+		})
+	}
+}
+
+func TestDecodeEnforcesResourceLimitsAtBoundaries(t *testing.T) {
+	t.Parallel()
+
+	base := []byte(`{"schema_version":1,"root":{"kind":"predicate","subject":"attribute","key":"enabled","operator":"exists"}}`)
+	atSizeLimit := append(append([]byte(nil), base...), bytes.Repeat([]byte(" "), MaxJSONBytes-len(base))...)
+	if _, err := Decode(atSizeLimit); err != nil {
+		t.Fatalf("Decode() at size limit error = %v", err)
+	}
+	_, err := Decode(append(atSizeLimit, ' '))
+	assertErrorCode(t, err, ErrorCodeLimitExceeded)
+
+	if _, err := Decode(nestedNotExpressionJSON(MaxDepth)); err != nil {
+		t.Fatalf("Decode() at depth limit error = %v", err)
+	}
+	_, err = Decode(nestedNotExpressionJSON(MaxDepth + 1))
+	assertErrorCode(t, err, ErrorCodeLimitExceeded)
+
+	if _, err := Decode(childrenExpressionJSON(MaxChildren)); err != nil {
+		t.Fatalf("Decode() at children limit error = %v", err)
+	}
+	_, err = Decode(childrenExpressionJSON(MaxChildren + 1))
+	assertErrorCode(t, err, ErrorCodeLimitExceeded)
+
+	if _, err := Decode(nodeCountExpressionJSON([]int{15, 15, 15, 14})); err != nil {
+		t.Fatalf("Decode() at node limit error = %v", err)
+	}
+	_, err = Decode(nodeCountExpressionJSON([]int{15, 15, 15, 15}))
+	assertErrorCode(t, err, ErrorCodeLimitExceeded)
+
+	atStringLimit := strings.Repeat("界", MaxStringLength)
+	if _, err := Decode(attributeStringExpressionJSON(t, atStringLimit)); err != nil {
+		t.Fatalf("Decode() at string limit error = %v", err)
+	}
+	_, err = Decode(attributeStringExpressionJSON(t, atStringLimit+"界"))
+	assertErrorCode(t, err, ErrorCodeLimitExceeded)
+
+	if _, err := Decode(attributeArrayExpressionJSON(t, MaxStringArrayItems)); err != nil {
+		t.Fatalf("Decode() at string array limit error = %v", err)
+	}
+	_, err = Decode(attributeArrayExpressionJSON(t, MaxStringArrayItems+1))
+	assertErrorCode(t, err, ErrorCodeLimitExceeded)
+}
+
+func TestDecodeValidatesCodeAndFreshnessBoundaries(t *testing.T) {
+	t.Parallel()
+
+	atCodeLimit := "a" + strings.Repeat("b", maxCatalogCodeLength-1)
+	if _, err := Decode([]byte(fmt.Sprintf(`{"schema_version":1,"root":{"kind":"predicate","subject":"attribute","key":%q,"operator":"exists"}}`, atCodeLimit))); err != nil {
+		t.Fatalf("Decode() at code limit error = %v", err)
+	}
+	overCodeLimit := atCodeLimit + "b"
+	_, err := Decode([]byte(fmt.Sprintf(`{"schema_version":1,"root":{"kind":"predicate","subject":"attribute","key":%q,"operator":"exists"}}`, overCodeLimit)))
+	assertErrorCode(t, err, ErrorCodeInvalidPredicate)
+
+	validFreshness := []string{"1", "86400"}
+	for _, value := range validFreshness {
+		raw := []byte(`{"schema_version":1,"root":{"kind":"predicate","subject":"insights_metric","key":"trade.gmv_daily","operator":"fresh_within_seconds","value":` + value + `}}`)
+		if _, err := Decode(raw); err != nil {
+			t.Fatalf("Decode() freshness %s error = %v", value, err)
+		}
+	}
+	for _, value := range []string{"0", "86401", "1.5", "1.0", "1e0"} {
+		raw := []byte(`{"schema_version":1,"root":{"kind":"predicate","subject":"insights_metric","key":"trade.gmv_daily","operator":"fresh_within_seconds","value":` + value + `}}`)
+		_, err := Decode(raw)
+		assertErrorCode(t, err, ErrorCodeInvalidPredicate)
+	}
+}
+
+func TestExpressionV1UnmarshalJSONUsesStrictDecoder(t *testing.T) {
+	t.Parallel()
+
+	var expression ExpressionV1
+	err := json.Unmarshal([]byte(`{"schema_version":1,"root":{"kind":"predicate","subject":"attribute","key":"enabled","operator":"exists","extra":true}}`), &expression)
+	assertErrorCode(t, err, ErrorCodeUnknownField)
+}
+
+func assertErrorCode(t *testing.T, err error, expected ErrorCode) {
+	t.Helper()
+	if err == nil {
+		t.Fatalf("error = nil, want code %s", expected)
+	}
+	var expressionError *Error
+	if !errors.As(err, &expressionError) {
+		t.Fatalf("error type = %T, want *ruleexpression.Error: %v", err, err)
+	}
+	if expressionError.Code != expected {
+		t.Fatalf("error code = %s, want %s: %v", expressionError.Code, expected, err)
+	}
+}
+
+func nestedNotExpressionJSON(depth int) []byte {
+	node := `{"kind":"predicate","subject":"attribute","key":"enabled","operator":"exists"}`
+	for currentDepth := 1; currentDepth < depth; currentDepth++ {
+		node = `{"kind":"not","child":` + node + `}`
+	}
+	return []byte(`{"schema_version":1,"root":` + node + `}`)
+}
+
+func childrenExpressionJSON(count int) []byte {
+	children := make([]string, count)
+	for i := range children {
+		children[i] = fmt.Sprintf(`{"kind":"predicate","subject":"attribute","key":"flag_%d","operator":"exists"}`, i)
+	}
+	return []byte(`{"schema_version":1,"root":{"kind":"all","children":[` + strings.Join(children, ",") + `]}}`)
+}
+
+func nodeCountExpressionJSON(groupSizes []int) []byte {
+	groups := make([]string, len(groupSizes))
+	for groupIndex, size := range groupSizes {
+		children := make([]string, size)
+		for childIndex := range children {
+			children[childIndex] = fmt.Sprintf(`{"kind":"predicate","subject":"attribute","key":"flag_%d_%d","operator":"exists"}`, groupIndex, childIndex)
+		}
+		groups[groupIndex] = `{"kind":"all","children":[` + strings.Join(children, ",") + `]}`
+	}
+	return []byte(`{"schema_version":1,"root":{"kind":"all","children":[` + strings.Join(groups, ",") + `]}}`)
+}
+
+func attributeStringExpressionJSON(t *testing.T, value string) []byte {
+	t.Helper()
+	encoded, err := json.Marshal(value)
+	if err != nil {
+		t.Fatalf("json.Marshal() error = %v", err)
+	}
+	return []byte(`{"schema_version":1,"root":{"kind":"predicate","subject":"attribute","key":"label","operator":"eq","value":` + string(encoded) + `}}`)
+}
+
+func attributeArrayExpressionJSON(t *testing.T, count int) []byte {
+	t.Helper()
+	values := make([]string, count)
+	for i := range values {
+		values[i] = fmt.Sprintf("value_%d", i)
+	}
+	encoded, err := json.Marshal(values)
+	if err != nil {
+		t.Fatalf("json.Marshal() error = %v", err)
+	}
+	return []byte(`{"schema_version":1,"root":{"kind":"predicate","subject":"attribute","key":"labels","operator":"in","value":` + string(encoded) + `}}`)
+}

package/dist/resources/templates/go-backend/internal/common/ruleexpression/errors.go

@@ -0,0 +1,55 @@
+package ruleexpression
+
+import "fmt"
+
+// ErrorCode 标识稳定、业务中立的规则表达式错误类别。
+type ErrorCode string
+
+const (
+	ErrorCodeInvalidJSON              ErrorCode = "invalid_json"
+	ErrorCodeUnsupportedSchemaVersion ErrorCode = "unsupported_schema_version"
+	ErrorCodeDuplicateField           ErrorCode = "duplicate_field"
+	ErrorCodeUnknownField             ErrorCode = "unknown_field"
+	ErrorCodeMissingField             ErrorCode = "missing_field"
+	ErrorCodeInvalidNode              ErrorCode = "invalid_node"
+	ErrorCodeInvalidPredicate         ErrorCode = "invalid_predicate"
+	ErrorCodeLimitExceeded            ErrorCode = "limit_exceeded"
+	ErrorCodeInvalidUnicode           ErrorCode = "invalid_unicode"
+	ErrorCodeInvalidNumber            ErrorCode = "invalid_number"
+	ErrorCodeEvaluationFailed         ErrorCode = "evaluation_failed"
+)
+
+// Error 提供可机读错误码、精确 JSON 路径和原始错误链。
+type Error struct {
+	// Code 是稳定错误类别。
+	Code ErrorCode
+	// Path 是发生错误的表达式 JSON 路径。
+	Path string
+	// Message 是英文诊断信息。
+	Message string
+	// Cause 保留底层解析或 resolver 错误。
+	Cause error
+}
+
+// Error 返回适合日志和测试诊断的英文错误文本。
+func (e *Error) Error() string {
+	detail := fmt.Sprintf("%s: %s", e.Code, e.Message)
+	if e.Path != "" {
+		detail = fmt.Sprintf("%s at %s: %s", e.Code, e.Path, e.Message)
+	}
+	if e.Cause != nil {
+		return detail + ": " + e.Cause.Error()
+	}
+	return detail
+}
+
+// Unwrap 允许 errors.Is 和 errors.As 访问底层错误。
+func (e *Error) Unwrap() error { return e.Cause }
+
+func newError(code ErrorCode, path string, message string) *Error {
+	return &Error{Code: code, Path: path, Message: message}
+}
+
+func wrapError(code ErrorCode, path string, message string, cause error) *Error {
+	return &Error{Code: code, Path: path, Message: message, Cause: cause}
+}

package/dist/resources/templates/go-backend/internal/common/ruleexpression/evaluator.go

@@ -0,0 +1,96 @@
+package ruleexpression
+
+import "fmt"
+
+// Result 是 Requirement Expression 的三值求值结果。
+type Result string
+
+const (
+	ResultTrue          Result = "true"
+	ResultFalse         Result = "false"
+	ResultIndeterminate Result = "indeterminate"
+)
+
+// IsValid 判断结果是否属于封闭三值集合。
+func (r Result) IsValid() bool {
+	return r == ResultTrue || r == ResultFalse || r == ResultIndeterminate
+}
+
+// PredicateResolver 由消费方提供事实解析，不允许改变组合节点语义。
+type PredicateResolver func(predicate *PredicateNode) (Result, error)
+
+// Evaluate 按声明顺序和固定三值真值表求值表达式。
+func Evaluate(expression ExpressionV1, resolver PredicateResolver) (Result, error) {
+	if err := validateExpression(expression); err != nil {
+		return ResultIndeterminate, err
+	}
+	if resolver == nil {
+		return ResultIndeterminate, newError(ErrorCodeEvaluationFailed, "$.root", "predicate resolver must not be nil")
+	}
+	return evaluateNode(expression.Root, "$.root", resolver)
+}
+
+func evaluateNode(node Node, path string, resolver PredicateResolver) (Result, error) {
+	switch current := node.(type) {
+	case *AllNode:
+		hasIndeterminate := false
+		for i := range current.Children {
+			result, err := evaluateNode(current.Children[i], fmt.Sprintf("%s.children[%d]", path, i), resolver)
+			if err != nil {
+				return ResultIndeterminate, err
+			}
+			if result == ResultFalse {
+				return ResultFalse, nil
+			}
+			if result == ResultIndeterminate {
+				hasIndeterminate = true
+			}
+		}
+		if hasIndeterminate {
+			return ResultIndeterminate, nil
+		}
+		return ResultTrue, nil
+	case *AnyNode:
+		hasIndeterminate := false
+		for i := range current.Children {
+			result, err := evaluateNode(current.Children[i], fmt.Sprintf("%s.children[%d]", path, i), resolver)
+			if err != nil {
+				return ResultIndeterminate, err
+			}
+			if result == ResultTrue {
+				return ResultTrue, nil
+			}
+			if result == ResultIndeterminate {
+				hasIndeterminate = true
+			}
+		}
+		if hasIndeterminate {
+			return ResultIndeterminate, nil
+		}
+		return ResultFalse, nil
+	case *NotNode:
+		result, err := evaluateNode(current.Child, path+".child", resolver)
+		if err != nil {
+			return ResultIndeterminate, err
+		}
+		switch result {
+		case ResultTrue:
+			return ResultFalse, nil
+		case ResultFalse:
+			return ResultTrue, nil
+		default:
+			return ResultIndeterminate, nil
+		}
+	case *PredicateNode:
+		result, err := resolver(current)
+		if err != nil {
+			return ResultIndeterminate, wrapError(ErrorCodeEvaluationFailed, path, "predicate resolver failed", err)
+		}
+		if !result.IsValid() {
+			return ResultIndeterminate, newError(ErrorCodeEvaluationFailed, path, "predicate resolver returned an invalid result")
+		}
+		return result, nil
+	default:
+		return ResultIndeterminate, newError(ErrorCodeInvalidNode, path, "node kind is not supported")
+	}
+}

package/dist/resources/templates/go-backend/internal/common/ruleexpression/evaluator_test.go

@@ -0,0 +1,220 @@
+package ruleexpression
+
+import (
+	"errors"
+	"reflect"
+	"testing"
+)
+
+func TestEvaluateAllTruthTable(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		left  Result
+		right Result
+		want  Result
+	}{
+		{ResultTrue, ResultTrue, ResultTrue},
+		{ResultTrue, ResultFalse, ResultFalse},
+		{ResultTrue, ResultIndeterminate, ResultIndeterminate},
+		{ResultFalse, ResultTrue, ResultFalse},
+		{ResultFalse, ResultFalse, ResultFalse},
+		{ResultFalse, ResultIndeterminate, ResultFalse},
+		{ResultIndeterminate, ResultTrue, ResultIndeterminate},
+		{ResultIndeterminate, ResultFalse, ResultFalse},
+		{ResultIndeterminate, ResultIndeterminate, ResultIndeterminate},
+	}
+
+	for _, test := range tests {
+		name := string(test.left) + "_" + string(test.right)
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			expression := expressionWithRoot(&AllNode{Children: []Node{resultPredicate("left"), resultPredicate("right")}})
+			got, err := Evaluate(expression, resolverFor(map[string]Result{"left": test.left, "right": test.right}))
+			if err != nil {
+				t.Fatalf("Evaluate() error = %v", err)
+			}
+			if got != test.want {
+				t.Fatalf("Evaluate() = %s, want %s", got, test.want)
+			}
+		})
+	}
+}
+
+func TestEvaluateAnyTruthTable(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		left  Result
+		right Result
+		want  Result
+	}{
+		{ResultTrue, ResultTrue, ResultTrue},
+		{ResultTrue, ResultFalse, ResultTrue},
+		{ResultTrue, ResultIndeterminate, ResultTrue},
+		{ResultFalse, ResultTrue, ResultTrue},
+		{ResultFalse, ResultFalse, ResultFalse},
+		{ResultFalse, ResultIndeterminate, ResultIndeterminate},
+		{ResultIndeterminate, ResultTrue, ResultTrue},
+		{ResultIndeterminate, ResultFalse, ResultIndeterminate},
+		{ResultIndeterminate, ResultIndeterminate, ResultIndeterminate},
+	}
+
+	for _, test := range tests {
+		name := string(test.left) + "_" + string(test.right)
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			expression := expressionWithRoot(&AnyNode{Children: []Node{resultPredicate("left"), resultPredicate("right")}})
+			got, err := Evaluate(expression, resolverFor(map[string]Result{"left": test.left, "right": test.right}))
+			if err != nil {
+				t.Fatalf("Evaluate() error = %v", err)
+			}
+			if got != test.want {
+				t.Fatalf("Evaluate() = %s, want %s", got, test.want)
+			}
+		})
+	}
+}
+
+func TestEvaluateNotTruthTable(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		input Result
+		want  Result
+	}{
+		{ResultTrue, ResultFalse},
+		{ResultFalse, ResultTrue},
+		{ResultIndeterminate, ResultIndeterminate},
+	}
+	for _, test := range tests {
+		t.Run(string(test.input), func(t *testing.T) {
+			t.Parallel()
+			expression := expressionWithRoot(&NotNode{Child: resultPredicate("value")})
+			got, err := Evaluate(expression, resolverFor(map[string]Result{"value": test.input}))
+			if err != nil {
+				t.Fatalf("Evaluate() error = %v", err)
+			}
+			if got != test.want {
+				t.Fatalf("Evaluate() = %s, want %s", got, test.want)
+			}
+		})
+	}
+}
+
+func TestEvaluateNestedPrecedenceAndDeterministicShortCircuit(t *testing.T) {
+	t.Parallel()
+
+	expression := expressionWithRoot(&AllNode{Children: []Node{
+		&AnyNode{Children: []Node{resultPredicate("unknown"), resultPredicate("false")}},
+		resultPredicate("late"),
+	}})
+	visited := make([]string, 0, 3)
+	result, err := Evaluate(expression, func(predicate *PredicateNode) (Result, error) {
+		visited = append(visited, predicate.Key)
+		switch predicate.Key {
+		case "unknown":
+			return ResultIndeterminate, nil
+		case "false":
+			return ResultFalse, nil
+		default:
+			return ResultTrue, nil
+		}
+	})
+	if err != nil {
+		t.Fatalf("Evaluate() error = %v", err)
+	}
+	if result != ResultIndeterminate {
+		t.Fatalf("Evaluate() = %s, want %s", result, ResultIndeterminate)
+	}
+	wantVisited := []string{"unknown", "false", "late"}
+	if !reflect.DeepEqual(visited, wantVisited) {
+		t.Fatalf("visited = %#v, want %#v", visited, wantVisited)
+	}
+
+	shortCircuit := expressionWithRoot(&AllNode{Children: []Node{resultPredicate("true"), resultPredicate("false"), resultPredicate("late")}})
+	visited = visited[:0]
+	result, err = Evaluate(shortCircuit, func(predicate *PredicateNode) (Result, error) {
+		visited = append(visited, predicate.Key)
+		if predicate.Key == "false" {
+			return ResultFalse, nil
+		}
+		return ResultTrue, nil
+	})
+	if err != nil {
+		t.Fatalf("Evaluate() short circuit error = %v", err)
+	}
+	if result != ResultFalse {
+		t.Fatalf("Evaluate() short circuit = %s, want %s", result, ResultFalse)
+	}
+	wantVisited = []string{"true", "false"}
+	if !reflect.DeepEqual(visited, wantVisited) {
+		t.Fatalf("visited = %#v, want %#v", visited, wantVisited)
+	}
+}
+
+func TestEvaluateReturnsTypedResolverErrors(t *testing.T) {
+	t.Parallel()
+
+	sentinel := errors.New("facts unavailable")
+	expression := expressionWithRoot(resultPredicate("value"))
+	result, err := Evaluate(expression, func(*PredicateNode) (Result, error) {
+		return ResultIndeterminate, sentinel
+	})
+	if result != ResultIndeterminate {
+		t.Fatalf("Evaluate() result = %s, want %s", result, ResultIndeterminate)
+	}
+	assertErrorCode(t, err, ErrorCodeEvaluationFailed)
+	if !errors.Is(err, sentinel) {
+		t.Fatalf("Evaluate() error = %v, want wrapped sentinel", err)
+	}
+
+	result, err = Evaluate(expression, func(*PredicateNode) (Result, error) {
+		return Result("unexpected"), nil
+	})
+	if result != ResultIndeterminate {
+		t.Fatalf("Evaluate() invalid result = %s, want %s", result, ResultIndeterminate)
+	}
+	assertErrorCode(t, err, ErrorCodeEvaluationFailed)
+
+	_, err = Evaluate(expression, nil)
+	assertErrorCode(t, err, ErrorCodeEvaluationFailed)
+}
+
+func TestPublicOperationsRejectUnsupportedNodeWithoutPanic(t *testing.T) {
+	t.Parallel()
+
+	expression := expressionWithRoot(unsupportedNode{values: []string{"not", "comparable"}})
+	_, err := CanonicalJSON(expression)
+	assertErrorCode(t, err, ErrorCodeInvalidNode)
+
+	result, err := Evaluate(expression, func(*PredicateNode) (Result, error) {
+		return ResultTrue, nil
+	})
+	if result != ResultIndeterminate {
+		t.Fatalf("Evaluate() result = %s, want %s", result, ResultIndeterminate)
+	}
+	assertErrorCode(t, err, ErrorCodeInvalidNode)
+}
+
+func expressionWithRoot(root Node) ExpressionV1 {
+	return ExpressionV1{SchemaVersion: SchemaVersionV1, Root: root}
+}
+
+func resultPredicate(key string) *PredicateNode {
+	return &PredicateNode{Subject: SubjectAttribute, Key: key, Operator: OperatorExists}
+}
+
+func resolverFor(results map[string]Result) PredicateResolver {
+	return func(predicate *PredicateNode) (Result, error) {
+		return results[predicate.Key], nil
+	}
+}
+
+type unsupportedNode struct {
+	values []string
+}
+
+func (unsupportedNode) Kind() NodeKind { return NodeKindPredicate }
+
+func (unsupportedNode) isRequirementNode() {}