Skip to content

Conversation

@Xynnn007
Copy link
Member

@Xynnn007 Xynnn007 commented Dec 25, 2025

This PR mainly lays the groundwork for the dependency in #1092; please see the specific commit message.

Pre of #1129

@Xynnn007 Xynnn007 marked this pull request as ready for review December 25, 2025 07:53
@Xynnn007 Xynnn007 requested a review from a team as a code owner December 25, 2025 07:53
Copy link
Member

@fitzthum fitzthum left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice. A few comments.

The change in the abstraction is a little confusing. I guess the properties of the Rego backend (setting extensions, getting data and input), etc) are too specific to implement in one generic policy trait.

Still, I feel that things could be clarified slightly. Maybe policy isn't the right name for the directory or the trait could be renamed or comments added.

Generally this seems fine though.

@Xynnn007
Copy link
Member Author

The change in the abstraction is a little confusing. I guess the properties of the Rego backend (setting extensions, getting data and input), etc) are too specific to implement in one generic policy trait.

Yes. Especially extensions.

@mythi
Copy link
Contributor

mythi commented Dec 31, 2025

note: this PR does not trigger CoCo-AS Rust Suites tests at all.

- Add SetResult enum with Inserted and AlreadyExists variants
- Update KeyValueStorage::set() to return Result<SetResult> instead of Result<()>
- Change behavior: return AlreadyExists instead of error when key exists and overwrite=false
- Update all storage implementations (LocalFs, LocalJson, Memory, Postgres)
- Update PolicyEngine::set_policy() to handle new return type

This change allows callers to distinguish between successful insertion
and existing key scenarios without treating 'already exists' as an error.

Signed-off-by: Xynnn007 <[email protected]>
…pport

This commit removes the Engine trait abstraction in favor of concrete,
scenario-specific implementations. The rationale is:

1. Different policy engines may have different entry parameters and APIs,
   making a unified trait interface impractical and overly complex.

2. Policy engines are tightly coupled to their specific use cases. For
   example, the AS (Attestation Service) for EAR token issuance uses
   Rego policies, and there's no foreseeable need to support other
   policy languages in the near future.

3. By creating concrete engine instances at their usage sites and
   encapsulating the implementation details, we achieve better type
   safety and clearer code organization without unnecessary abstraction.

To achieve these goals, this commit

- Refactor PolicyEngine from trait-based to generic design (PolicyEngine<T>)
- Remove Engine trait and PolicyType enum
- Enhance Regorus engine with extension support
- Add ExtensionWrapper struct for Regorus extensions
- Make data parameter optional in Regorus::evaluate
- Add AddRegorusExtensionFailed error variant
- Update error comments from OPA to Regorus terminology
- Move engine-specific methods to PolicyEngine<Regorus> implementation

Signed-off-by: Xynnn007 <[email protected]>
@Xynnn007
Copy link
Member Author

Hi @fitzthum @mkulke hopefully I have resolved all the comments you shared. PTAL

Copy link
Member

@fitzthum fitzthum left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Thanks

@Xynnn007 Xynnn007 merged commit f342a12 into confidential-containers:main Jan 14, 2026
21 checks passed
@Xynnn007 Xynnn007 deleted the kv/set branch January 14, 2026 03:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants