feat(azure_policy): test runner, compiler fixes, and example program

Adds the YAML test runner that exercises the companion test data PRs, plus
several compiler fixes surfaced during testing:

- Removed parameter register caching that produced wrong results inside
  short-circuiting allOf/anyOf blocks
- Simplified cross-resource effect details to only emit roleDefinitionIds
  and type (deployment templates aren't evaluated for compliance)
- Replaced guid/uniqueString builtins with clear "unsupported" errors
- Normalized datetime output to ISO 8601 with Z suffix
- Bumped DEFAULT_MAX_COL to 8192 for long template expressions

Also restructures the example binary into examples/regorus/ with new
azure-policy-eval and azure-policy-aliases subcommands, adds C# alias
normalization tests, and documents Azure Policy support in the README.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>

Author: anakrish

README.md

@@ -248,6 +248,52 @@ $ diff <(regorus eval -b tests/aci -d tests/aci/data.json -i tests/aci/input.jso
 ```
 
 
+## Azure Policy (Preview)
+
+Regorus can evaluate [Azure Policy](https://learn.microsoft.com/en-us/azure/governance/policy/overview)
+definitions natively. A dedicated compiler translates Azure Policy JSON
+directly into RVM (Regorus Virtual Machine) bytecode — the same VM that
+powers Rego evaluation — so you don't have to rewrite policies in Rego.
+Enable it with the `azure_policy` cargo feature.
+
+Most of the policy language is supported: conditions with `field`, `count`,
+and `value`; logical connectives (`allOf`, `anyOf`, `not`); comparison
+operators; template expressions like `parameters()`, `concat()`,
+`dateTimeAdd()`, and `utcNow()`; and effects including Deny, Audit, Modify,
+Append, AuditIfNotExists, and DeployIfNotExists. An alias registry handles
+the translation from fully-qualified alias names to the flattened ARM resource
+shape expected by the engine.
+
+### Quick start
+
+```bash
+cargo install --example regorus --features azure_policy --path .
+
+# Evaluate a policy against a non-compliant storage account (→ Deny)
+regorus azure-policy-eval \
+    --policy-definition examples/regorus/azure_policy_data/require_https_storage.json \
+    --resource examples/regorus/azure_policy_data/non_compliant_storage.json \
+    --aliases tests/azure_policy/aliases/test_aliases.json
+
+# Same policy against a compliant resource (→ undefined, no effect)
+regorus azure-policy-eval \
+    --policy-definition examples/regorus/azure_policy_data/require_https_storage.json \
+    --resource examples/regorus/azure_policy_data/compliant_storage.json \
+    --aliases tests/azure_policy/aliases/test_aliases.json
+
+# List aliases for a resource type
+regorus azure-policy-aliases \
+    --aliases tests/azure_policy/aliases/test_aliases.json \
+    --resource-type Microsoft.Storage
+```
+
+The test suite covers conditions, effects, template functions, alias
+resolution, and end-to-end scenarios across 74 YAML-driven test files:
+
+```bash
+cargo test --features azure_policy -- azure_policy
+```
+
 ## Performance
 
 To check how fast Regorus runs on your system, first install a tool like [hyperfine](https://github.com/sharkdp/hyperfine).

bindings/csharp/Regorus.Tests/AzurePolicyTests.cs

@@ -0,0 +1,187 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+using System;
+using System.IO;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+using Regorus;
+
+namespace Regorus.Tests;
+
+/// <summary>
+/// Tests for Azure Policy alias normalization and denormalization
+/// using the AliasRegistry exposed through the C# bindings.
+/// </summary>
+[TestClass]
+public class AzurePolicyTests
+{
+    /// <summary>
+    /// Sample alias definitions for Microsoft.Storage provider.
+    /// These mirror a subset of the test aliases used by the Rust test suite.
+    /// </summary>
+    private const string StorageAliasesJson = @"[{
+        ""namespace"": ""Microsoft.Storage"",
+        ""resourceTypes"": [{
+            ""resourceType"": ""storageAccounts"",
+            ""capabilities"": ""SupportsTags, SupportsLocation"",
+            ""aliases"": [
+                {
+                    ""name"": ""Microsoft.Storage/storageAccounts/supportsHttpsTrafficOnly"",
+                    ""defaultPath"": ""properties.supportsHttpsTrafficOnly"",
+                    ""paths"": []
+                },
+                {
+                    ""name"": ""Microsoft.Storage/storageAccounts/minimumTlsVersion"",
+                    ""defaultPath"": ""properties.minimumTlsVersion"",
+                    ""paths"": []
+                },
+                {
+                    ""name"": ""Microsoft.Storage/storageAccounts/allowBlobPublicAccess"",
+                    ""defaultPath"": ""properties.allowBlobPublicAccess"",
+                    ""paths"": []
+                }
+            ]
+        }]
+    }]";
+
+    /// <summary>
+    /// ARM resource in its original shape (with properties wrapper).
+    /// </summary>
+    private const string StorageResourceJson = @"{
+        ""type"": ""Microsoft.Storage/storageAccounts"",
+        ""name"": ""mystorage"",
+        ""location"": ""eastus"",
+        ""properties"": {
+            ""supportsHttpsTrafficOnly"": true,
+            ""minimumTlsVersion"": ""TLS1_2"",
+            ""allowBlobPublicAccess"": false
+        }
+    }";
+
+    [TestMethod]
+    public void AliasRegistry_NormalizeAndWrap_produces_input_envelope()
+    {
+        using var registry = new AliasRegistry();
+        registry.LoadJson(StorageAliasesJson);
+
+        var result = registry.NormalizeAndWrap(
+            StorageResourceJson,
+            apiVersion: null,
+            contextJson: "{}",
+            parametersJson: "{}");
+
+        Assert.IsNotNull(result, "NormalizeAndWrap should return a non-null string");
+
+        // The result should be valid JSON with resource, parameters, and context keys.
+        var doc = JsonNode.Parse(result);
+        Assert.IsNotNull(doc);
+        Assert.IsNotNull(doc["resource"], "envelope must contain 'resource'");
+        Assert.IsNotNull(doc["parameters"], "envelope must contain 'parameters'");
+    }
+
+    [TestMethod]
+    public void AliasRegistry_NormalizeAndWrap_flattens_properties()
+    {
+        using var registry = new AliasRegistry();
+        registry.LoadJson(StorageAliasesJson);
+
+        var result = registry.NormalizeAndWrap(StorageResourceJson);
+        Assert.IsNotNull(result);
+
+        var doc = JsonNode.Parse(result);
+        var resource = doc!["resource"];
+        Assert.IsNotNull(resource);
+
+        // After normalization, alias-mapped properties should be
+        // available at the top level of the resource (lowercased).
+        // The normalizer flattens "properties.supportsHttpsTrafficOnly"
+        // to "supportshttpstrafficonly" at the resource root.
+        var httpsOnly = resource["supportshttpstrafficonly"];
+        Assert.IsNotNull(httpsOnly,
+            "normalized resource should have 'supportshttpstrafficonly' at top level");
+        Assert.AreEqual(true, httpsOnly!.GetValue<bool>());
+    }
+
+    [TestMethod]
+    public void AliasRegistry_NormalizeAndWrap_preserves_type_field()
+    {
+        using var registry = new AliasRegistry();
+        registry.LoadJson(StorageAliasesJson);
+
+        var result = registry.NormalizeAndWrap(StorageResourceJson);
+        var doc = JsonNode.Parse(result!);
+        var resource = doc!["resource"];
+
+        // The "type" field should be preserved (lowercased key).
+        var typeField = resource!["type"];
+        Assert.IsNotNull(typeField, "normalized resource should have 'type'");
+        Assert.AreEqual(
+            "microsoft.storage/storageaccounts",
+            typeField!.GetValue<string>().ToLowerInvariant());
+    }
+
+    [TestMethod]
+    public void AliasRegistry_NormalizeAndWrap_includes_parameters()
+    {
+        using var registry = new AliasRegistry();
+        registry.LoadJson(StorageAliasesJson);
+
+        var parametersJson = @"{ ""effect"": ""Deny"" }";
+        var result = registry.NormalizeAndWrap(
+            StorageResourceJson,
+            parametersJson: parametersJson);
+        Assert.IsNotNull(result);
+
+        var doc = JsonNode.Parse(result!);
+        var parameters = doc!["parameters"];
+        Assert.IsNotNull(parameters);
+        Assert.AreEqual("Deny", parameters!["effect"]!.GetValue<string>());
+    }
+
+    [TestMethod]
+    public void AliasRegistry_Denormalize_roundtrips_correctly()
+    {
+        using var registry = new AliasRegistry();
+        registry.LoadJson(StorageAliasesJson);
+
+        // Normalize the ARM resource.
+        var envelope = registry.NormalizeAndWrap(StorageResourceJson);
+        Assert.IsNotNull(envelope);
+
+        // Extract just the normalized resource from the envelope.
+        var doc = JsonNode.Parse(envelope!);
+        var normalizedResource = doc!["resource"]!.ToJsonString();
+
+        // Denormalize back to ARM shape.
+        var denormalized = registry.Denormalize(normalizedResource);
+        Assert.IsNotNull(denormalized, "Denormalize should return a non-null string");
+
+        // The denormalized result should have a "properties" wrapper again.
+        var denormDoc = JsonNode.Parse(denormalized!);
+        Assert.IsNotNull(denormDoc);
+        var props = denormDoc!["properties"];
+        Assert.IsNotNull(props, "denormalized resource should have 'properties'");
+    }
+
+    [TestMethod]
+    public void AliasRegistry_loads_test_aliases_file()
+    {
+        // Load the same aliases file used by the Rust test suite.
+        var aliasesPath = Path.Combine("tests", "azure_policy", "aliases", "test_aliases.json");
+        if (!File.Exists(aliasesPath))
+        {
+            Assert.Inconclusive($"Test aliases file not found at {aliasesPath}");
+            return;
+        }
+
+        var aliasesJson = File.ReadAllText(aliasesPath);
+        using var registry = new AliasRegistry();
+        registry.LoadJson(aliasesJson);
+
+        // The test_aliases.json file contains multiple providers.
+        Assert.IsTrue(registry.Length > 0,
+            "registry should have loaded at least one resource type");
+    }
+}

examples/regorus/azure_policy.rs

@@ -0,0 +1,140 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+//! Azure Policy evaluation subcommand for the regorus example binary.
+//!
+//! Demonstrates parsing an Azure Policy definition JSON, compiling it to
+//! RVM bytecode, normalizing an ARM resource through the alias registry,
+//! and evaluating the compiled policy against the normalized input.
+//!
+//! Usage:
+//!   cargo run --example regorus --features azure_policy -- \
+//!     azure-policy-eval \
+//!       --policy-definition policy.json \
+//!       --resource resource.json \
+//!       --aliases aliases.json \
+//!       [--parameters '{"sku": "Standard_D2s_v3"}'] \
+//!       [--api-version 2023-01-01]
+
+use anyhow::{bail, Result};
+
+use regorus::languages::azure_policy::aliases::normalizer;
+use regorus::languages::azure_policy::aliases::AliasRegistry;
+use regorus::languages::azure_policy::compiler;
+use regorus::languages::azure_policy::parser;
+use regorus::rvm::RegoVM;
+use regorus::Source;
+use regorus::Value;
+
+/// Evaluate an Azure Policy definition against a resource.
+///
+/// This mirrors the pipeline used in production:
+/// 1. Load aliases and build the alias registry
+/// 2. Parse the policy definition JSON
+/// 3. Compile to RVM bytecode (with alias-aware field resolution)
+/// 4. Normalize the ARM resource through the alias registry
+/// 5. Run the compiled program in the Rego VM
+pub fn azure_policy_eval(
+    policy_definition: String,
+    resource: String,
+    aliases: String,
+    parameters_json: Option<String>,
+    api_version: Option<String>,
+) -> Result<()> {
+    // 1. Load alias registry.
+    let aliases_json = std::fs::read_to_string(&aliases)
+        .map_err(|e| anyhow::anyhow!("failed to read aliases file {aliases}: {e}"))?;
+    let mut registry = AliasRegistry::new();
+    registry.load_from_json(&aliases_json)?;
+    println!(
+        "Loaded {} resource type(s) from alias registry",
+        registry.len()
+    );
+
+    // 2. Parse the policy definition.
+    let defn_json = std::fs::read_to_string(&policy_definition)
+        .map_err(|e| anyhow::anyhow!("failed to read policy file {policy_definition}: {e}"))?;
+    let source = Source::from_contents(policy_definition.clone(), defn_json)?;
+    let defn = parser::parse_policy_definition(&source)
+        .map_err(|e| anyhow::anyhow!("parse error: {e}"))?;
+    println!("Parsed policy definition from {policy_definition}");
+
+    // 3. Compile to RVM bytecode.
+    let program = compiler::compile_policy_definition_with_aliases(
+        &defn,
+        registry.alias_map(),
+        registry.alias_modifiable_map(),
+    )?;
+    println!("Compiled policy to RVM bytecode");
+
+    // 4. Build normalized input.
+    let resource_json = std::fs::read_to_string(&resource)
+        .map_err(|e| anyhow::anyhow!("failed to read resource file {resource}: {e}"))?;
+    let raw_resource = Value::from_json_str(&resource_json)?;
+    let normalized = normalizer::normalize(&raw_resource, Some(&registry), api_version.as_deref());
+    println!("Normalized resource ({} top-level fields)", {
+        normalized.as_object().map(|m| m.len()).unwrap_or(0)
+    });
+
+    // Build the input envelope: { resource, parameters }
+    let parameters = if let Some(ref params) = parameters_json {
+        Value::from_json_str(params)?
+    } else {
+        Value::new_object()
+    };
+    let mut input = Value::new_object();
+    {
+        let map = input.as_object_mut()?;
+        map.insert(Value::from("resource"), normalized);
+        map.insert(Value::from("parameters"), parameters);
+    }
+
+    // Build a default context.
+    let context = Value::from_json_str(
+        r#"{
+            "resourceGroup": { "name": "exampleRG", "location": "eastus" },
+            "subscription": { "subscriptionId": "00000000-0000-0000-0000-000000000000" }
+        }"#,
+    )?;
+
+    // 5. Execute in the Rego VM.
+    let mut vm = RegoVM::new();
+    vm.load_program(program);
+    vm.set_input(input);
+    vm.set_context(context);
+
+    let result = vm.execute_entry_point_by_name("main")?;
+    println!("\nPolicy evaluation result:");
+    println!("{}", serde_json::to_string_pretty(&result)?);
+
+    Ok(())
+}
+
+/// List available aliases for a resource type.
+pub fn azure_policy_aliases(aliases: String, resource_type: Option<String>) -> Result<()> {
+    let aliases_json = std::fs::read_to_string(&aliases)
+        .map_err(|e| anyhow::anyhow!("failed to read aliases file {aliases}: {e}"))?;
+    let mut registry = AliasRegistry::new();
+    registry.load_from_json(&aliases_json)?;
+
+    println!("Alias registry: {} resource type(s)", registry.len());
+
+    if let Some(ref rt) = resource_type {
+        let rt_lower = rt.to_lowercase();
+        let mut found = false;
+        for (alias_name, _) in registry.alias_map() {
+            if alias_name.to_lowercase().starts_with(&rt_lower) {
+                println!("  {alias_name}");
+                found = true;
+            }
+        }
+        if !found {
+            bail!("no aliases found for resource type '{rt}'");
+        }
+    } else {
+        for (alias_name, _) in registry.alias_map() {
+            println!("  {alias_name}");
+        }
+    }
+    Ok(())
+}

examples/regorus/azure_policy_data/compliant_storage.json

@@ -0,0 +1,15 @@
+{
+  "type": "Microsoft.Storage/storageAccounts",
+  "name": "securestorageaccount",
+  "location": "eastus",
+  "kind": "StorageV2",
+  "properties": {
+    "supportsHttpsTrafficOnly": true,
+    "minimumTlsVersion": "TLS1_2",
+    "encryption": {
+      "services": {
+        "blob": { "enabled": true }
+      }
+    }
+  }
+}