Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

builtin: Return evalerrors.ErrEvaluationSkipSilently in case the builtin evaluator doesn't match the entity #800

Merged
merged 1 commit into from
Sep 4, 2023
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 9 additions & 11 deletions internal/engine/ingester/builtin/builtin.go
Original file line number Diff line number Diff line change
Expand Up @@ -21,13 +21,13 @@ import (
"encoding/json"
"errors"
"fmt"
"log"
"reflect"
"strings"

"github.com/go-git/go-billy/v5"
"google.golang.org/protobuf/reflect/protoreflect"

evalerrors "github.com/stacklok/mediator/internal/engine/errors"
engif "github.com/stacklok/mediator/internal/engine/interfaces"
"github.com/stacklok/mediator/internal/util"
pb "github.com/stacklok/mediator/pkg/generated/protobuf/go/mediator/v1"
Expand All @@ -42,6 +42,7 @@ const (
// BuiltinRuleDataIngest is the engine for a rule type that uses builtin methods
type BuiltinRuleDataIngest struct {
builtinCfg *pb.BuiltinType
ruleMethods rule_methods.Methods
method string
accessToken string
}
Expand All @@ -55,6 +56,7 @@ func NewBuiltinRuleDataIngest(
builtinCfg: builtinCfg,
accessToken: access_token,
method: builtinCfg.GetMethod(),
ruleMethods: &rule_methods.RuleMethods{},
}, nil
}

Expand All @@ -66,10 +68,10 @@ func (*BuiltinRuleDataIngest) FileContext() billy.Filesystem {

// Ingest calls the builtin method and populates the data to be returned
func (idi *BuiltinRuleDataIngest) Ingest(ctx context.Context, ent protoreflect.ProtoMessage, params map[string]any) (*engif.Result, error) {
// call internal method stored in pkg and method
rm := rule_methods.RuleMethods{}
value := reflect.ValueOf(rm)
method := value.MethodByName(idi.method)
method, err := idi.ruleMethods.GetMethod(idi.method)
if err != nil {
return nil, fmt.Errorf("cannot get method: %w", err)
}

// Check if the method exists
if !method.IsValid() {
Expand All @@ -79,12 +81,8 @@ func (idi *BuiltinRuleDataIngest) Ingest(ctx context.Context, ent protoreflect.P
matches, err := entityMatchesParams(ctx, ent, params)
if err != nil {
return nil, fmt.Errorf("cannot check if entity matches params: %w", err)
}

// TODO: this should be a warning
if !matches {
log.Printf("entity not matching parameters, skipping")
return nil, nil
} else if !matches {
return nil, evalerrors.ErrEvaluationSkipSilently
}

// call method
Expand Down
122 changes: 122 additions & 0 deletions internal/engine/ingester/builtin/builtin_test.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,122 @@
// Copyright 2023 Stacklok, Inc.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.role/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
// Package rule provides the CLI subcommand for managing rules

// Package builtin provides the builtin ingestion engine
// this test is directly in the builtin package because it is testing the internals of the ingestor and setting
// the rule methods to a fake
package builtin
jhrozek marked this conversation as resolved.
Show resolved Hide resolved

import (
"context"
"testing"

"github.com/stretchr/testify/assert"
"google.golang.org/protobuf/reflect/protoreflect"

evalerrors "github.com/stacklok/mediator/internal/engine/errors"
pb "github.com/stacklok/mediator/pkg/generated/protobuf/go/mediator/v1"
)

func TestBuiltInWorks(t *testing.T) {
t.Parallel()

tests := []struct {
name string
methodName string
ent protoreflect.ProtoMessage
params map[string]any
ingested map[string]any
}{
{
name: "passthrough works",
methodName: "Passthrough",
ent: &pb.Artifact{
Name: "test",
},
ingested: map[string]any{
"name": "test",
},
params: map[string]any{
"name": "test",
},
},
}

for _, tt := range tests {
tt := tt

t.Run(tt.name, func(t *testing.T) {
t.Parallel()

bi, err := NewBuiltinRuleDataIngest(nil, "")
assert.NoError(t, err)
bi.method = tt.methodName

res, err := bi.Ingest(context.Background(), tt.ent, tt.params)
assert.NoError(t, err)
assert.Equal(t, tt.ingested, res.Object)
})
}
}

func TestBuiltinErrorCases(t *testing.T) {
t.Parallel()

tests := []struct {
name string
methodName string
expErr error
ent protoreflect.ProtoMessage
params map[string]any
}{
{
name: "entity doesn't match",
methodName: "Passthrough",
expErr: evalerrors.ErrEvaluationSkipSilently,
ent: &pb.Artifact{},
params: map[string]any{
"foo": "bar",
},
},
{
name: "method doesn't match",
methodName: "nosuchmethod",
expErr: nil, // there's no specific error for this
ent: &pb.Artifact{},
params: map[string]any{
"foo": "bar",
},
},
}

for _, tt := range tests {
tt := tt

t.Run(tt.name, func(t *testing.T) {
t.Parallel()

bi, err := NewBuiltinRuleDataIngest(nil, "")
assert.NoError(t, err)
bi.method = tt.methodName

res, err := bi.Ingest(context.Background(), tt.ent, tt.params)
assert.Error(t, err, "expected error")
assert.Nil(t, res)
if tt.expErr != nil {
assert.Equal(t, tt.expErr, err)
}
})
}
}
33 changes: 33 additions & 0 deletions pkg/rule_methods/rule_methods.go
Original file line number Diff line number Diff line change
Expand Up @@ -15,5 +15,38 @@
// Package rule_methods provides the methods that are used by the rules
package rule_methods

import (
"context"
"encoding/json"
"fmt"
"reflect"

"google.golang.org/protobuf/encoding/protojson"
"google.golang.org/protobuf/reflect/protoreflect"
)

// Methods is the interface that is used to get the method by name
type Methods interface {
GetMethod(string) (reflect.Value, error)
}

// RuleMethods is the struct that contains the methods that are used by the rules
type RuleMethods struct{}

// GetMethod gets the method by name from the RuleMethods struct
func (r *RuleMethods) GetMethod(mName string) (reflect.Value, error) {
value := reflect.ValueOf(r)
method := value.MethodByName(mName)

// Check if the method exists
if !method.IsValid() {
return reflect.Value{}, fmt.Errorf("rule method not found")
}

return method, nil
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It would be super-nifty if this returned a typed result that could be invoked without the jiggery-pokery on lines 76-87 of builtin.go (i.e. by moving them here, but other RuleMethodGetter implementations could use actual types).

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think that type would be:

func(context.Context, string, any) (any, error) or maybe func(context.Context, string, any) (json.RawMessage, error)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm probably a bad Go programmer but I couldn't make the conversion from the reflected Value to the function type work.

}
Comment on lines +36 to +47
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this work, or do we just have no methods defined right now?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

currently there's no methods. We used to have the artifact verification method as a single builtin but the method and the builtin ingestor as a whole proved to be too limiting for what we needed to do so I ended up just adding a specialised artifact ingestor.

As I was trying to use the builtin ingestor for artifacts, I noticed this bug that we treat skipped entries as passing policy. That felt like a big enough bug to fix even if the ingestor is unused at the moment.

But at the same time, I think the builtin ingest still has value, so I didn't want to just nuke it completely. Actually, as I was writing this comment I realised that it would be better and make for easier testing if we have at least one method, so I added a "Passthrough" (that we already talked about before).

This also makes for better tests which are needed /especially/ because we don't use the builtin ingestor at the moment.


// Passthrough is a method that passes the entity through, just marshalling it
func (_ *RuleMethods) Passthrough(_ context.Context, _ string, ent protoreflect.ProtoMessage) (json.RawMessage, error) {
return protojson.Marshal(ent)
}