Checkpoint

policy/func.go

@@ -15,17 +15,25 @@ import (
 	"github.com/open-policy-agent/opa/v1/types"
 
 	"git.maze.io/maze/styx/dataset"
+	"git.maze.io/maze/styx/internal/timeutil"
 	"git.maze.io/maze/styx/logger"
 )
 
-var netLookupIPAddrDecl = types.NewFunction(
+var lookupIPAddrFunc = &rego.Function{
+	Name:             "styx.lookup_ip_addr",
+	Decl:             lookupIPAddrDecl,
+	Memoize:          true,
+	Nondeterministic: true,
+}
+
+var lookupIPAddrDecl = types.NewFunction(
 	types.Args(
 		types.Named("name", types.S).Description("Host name to lookup"),
 	),
 	types.Named("result", types.SetOfStr).Description("set(string) of IP address"),
 )
 
-func netLookupIPAddrImpl(bc rego.BuiltinContext, nameTerm *ast.Term) (*ast.Term, error) {
+func lookupIPAddr(bc rego.BuiltinContext, nameTerm *ast.Term) (*ast.Term, error) {
 	log := logger.StandardLog.Value("func", "styx.lookup_ip_addr")
 	log.Trace("Call function")
 
@@ -61,6 +69,57 @@ func netLookupIPAddrImpl(bc rego.BuiltinContext, nameTerm *ast.Term) (*ast.Term,
 	return ast.SetTerm(terms...), nil
 }
 
+var timebetweenFunc = &rego.Function{
+	Name:             "styx.time_between",
+	Decl:             timeBetweenDecl,
+	Nondeterministic: false,
+}
+
+var timeBetweenDecl = types.NewFunction(
+	types.Args(
+		types.Named("start", types.S).Description("Start time"),
+		types.Named("end", types.S).Description("End time"),
+	),
+	types.Named("result", types.B).Description("`true` if the current local time is between `start` and `end`"),
+)
+
+func timeBetween(bc rego.BuiltinContext, startTerm, endTerm *ast.Term) (*ast.Term, error) {
+	log := logger.StandardLog.Value("func", "styx.time_between")
+	log.Trace("Call function")
+
+	start, err := parseTimeTerm(startTerm)
+	if err != nil {
+		log.Err(err).Debug("Invalid start time")
+		return nil, err
+	}
+	end, err := parseTimeTerm(endTerm)
+	if err != nil {
+		log.Err(err).Debug("Invalid end time")
+		return nil, err
+	}
+
+	now := timeutil.Now()
+	if start.Before(end) {
+		return ast.BooleanTerm((now.Eq(start) || now.After(start)) && now.Before(end)), nil
+	}
+	return ast.BooleanTerm(now.Eq(end) || now.After(end) || now.Before(start)), nil
+}
+
+func parseTimeTerm(term *ast.Term) (timeutil.Time, error) {
+	timeArg, ok := term.Value.(ast.String)
+	if !ok {
+		return timeutil.Time{}, errors.New("expected string argument")
+	}
+	return timeutil.ParseTime(strings.Trim(timeArg.String(), `"`))
+}
+
+var domainContainsFunc = &rego.Function{
+	Name:             "styx.domains_contain",
+	Decl:             domainContainsDecl,
+	Memoize:          true,
+	Nondeterministic: true,
+}
+
 var domainContainsDecl = types.NewFunction(
 	types.Args(
 		types.Named("list", types.S).Description("Domain list to check against"),
@@ -69,8 +128,8 @@ var domainContainsDecl = types.NewFunction(
 	types.Named("result", types.B).Description("`true` if `name` is contained within `list`"),
 )
 
-func domainContainsImpl(bc rego.BuiltinContext, listTerm, nameTerm *ast.Term) (*ast.Term, error) {
-	log := logger.StandardLog.Value("func", "styx.in_domains")
+func domainContains(bc rego.BuiltinContext, listTerm, nameTerm *ast.Term) (*ast.Term, error) {
+	log := logger.StandardLog.Value("func", "styx.domains_contain")
 	log.Trace("Call function")
 
 	list, err := parseDomainListTerm(listTerm)
@@ -91,6 +150,13 @@ func domainContainsImpl(bc rego.BuiltinContext, listTerm, nameTerm *ast.Term) (*
 	return ast.BooleanTerm(list.Contains(name)), nil
 }
 
+var networkContainsFunc = &rego.Function{
+	Name:             "styx.networks_contain",
+	Decl:             networkContainsDecl,
+	Memoize:          true,
+	Nondeterministic: true,
+}
+
 var networkContainsDecl = types.NewFunction(
 	types.Args(
 		types.Named("list", types.S).Description("Network list to check against"),
@@ -99,8 +165,8 @@ var networkContainsDecl = types.NewFunction(
 	types.Named("result", types.B).Description("`true` if `ip` is contained within `list`"),
 )
 
-func networkContainsImpl(bc rego.BuiltinContext, listTerm, ipTerm *ast.Term) (*ast.Term, error) {
-	log := logger.StandardLog.Value("func", "styx.in_networks")
+func networkContains(bc rego.BuiltinContext, listTerm, ipTerm *ast.Term) (*ast.Term, error) {
+	log := logger.StandardLog.Value("func", "styx.networks_contain")
 
 	list, err := parseNetworkListTerm(listTerm)
 	if err != nil {