fix evaluation issues

Signed-off-by: Sylwester Piskozub <sylwesterpiskozub@gmail.com>

Author: Piskoo

pkg/policies/engine/engine.go

@@ -26,8 +26,8 @@ type PolicyEngine interface {
 	Verify(ctx context.Context, policy *Policy, input []byte, args map[string]any) (*EvaluationResult, error)
 	// MatchesParameters evaluates the matches_parameters rule to determine if evaluation parameters match expected parameters
 	MatchesParameters(ctx context.Context, policy *Policy, evaluationParams, expectedParams map[string]string) (bool, error)
-	// MatchesEvaluation evaluates the matches_evaluation rule using a PolicyEvaluation result and evaluation parameters
-	MatchesEvaluation(ctx context.Context, policy *Policy, evaluation *EvaluationResult, evaluationParams map[string]string) (bool, error)
+	// MatchesEvaluation evaluates the matches_evaluation rule using policy violations and expected parameters
+	MatchesEvaluation(ctx context.Context, policy *Policy, violations []string, expectedParams map[string]string) (bool, error)
 }
 
 type EvaluationResult struct {

pkg/policies/engine/rego/rego.go

@@ -112,7 +112,7 @@ const (
 	EnvironmentModePermissive EnvironmentMode = 1
 	inputArgs                                 = "args"
 	expectedArgs                              = "expected_args"
-	evalResult                                = "evaluation_result"
+	violationsResult                          = "violations"
 	inputElements                             = "elements"
 	deprecatedRule                            = "violations"
 	mainRule                                  = "result"
@@ -400,8 +400,16 @@ func (r *Engine) MatchesParameters(ctx context.Context, policy *engine.Policy, e
 
 	// Create input with policy and expected parameters
 	inputMap := make(map[string]interface{})
-	inputMap[inputArgs] = evaluationParams
-	inputMap[expectedArgs] = expectedParams
+	if evaluationParams == nil {
+		inputMap[inputArgs] = map[string]string{}
+	} else {
+		inputMap[inputArgs] = evaluationParams
+	}
+	if expectedParams == nil {
+		inputMap[expectedArgs] = map[string]string{}
+	} else {
+		inputMap[expectedArgs] = expectedParams
+	}
 
 	// Evaluate matches_parameters rule
 	matchesParameters, err := r.evaluateMatchingRule(ctx, getRuleName(parsedModule.Package.Path, matchesParametersRule), parsedModule, inputMap)
@@ -414,20 +422,27 @@ func (r *Engine) MatchesParameters(ctx context.Context, policy *engine.Policy, e
 }
 
 // MatchesEvaluation evaluates the matches_evaluation rule in a rego policy.
-// The function creates an input object with policy parameters and evaluation result.
+// The function creates an input object with expected parameters and policy violations.
 // Returns true if the policy's matches_evaluation rule evaluates to true, false otherwise.
-// If the rule is not found or evaluation fails, it defaults to false.
-func (r *Engine) MatchesEvaluation(ctx context.Context, policy *engine.Policy, ev *engine.EvaluationResult, evaluationParams map[string]string) (bool, error) {
+func (r *Engine) MatchesEvaluation(ctx context.Context, policy *engine.Policy, violations []string, expectedParams map[string]string) (bool, error) {
 	policyString := string(policy.Source)
 	parsedModule, err := ast.ParseModule(policy.Name, policyString)
 	if err != nil {
 		return false, fmt.Errorf("failed to parse rego policy: %w", err)
 	}
 
-	// Create input with the policy evaluation data
+	// Create input expected parameters and policy violations
 	inputMap := make(map[string]interface{})
-	inputMap[inputArgs] = evaluationParams
-	inputMap[evalResult] = ev
+	if expectedParams == nil {
+		inputMap[expectedArgs] = map[string]string{}
+	} else {
+		inputMap[expectedArgs] = expectedParams
+	}
+	if violations == nil {
+		inputMap[violationsResult] = []string{}
+	} else {
+		inputMap[violationsResult] = violations
+	}
 
 	// Evaluate matches_parameters rule
 	matchesEvaluation, err := r.evaluateMatchingRule(ctx, getRuleName(parsedModule.Package.Path, matchesEvaluationRule), parsedModule, inputMap)

pkg/policies/engine/rego/rego_test.go

@@ -393,44 +393,25 @@ func TestRego_MatchesEvaluation(t *testing.T) {
 	}
 
 	t.Run("evaluation with violations and high severity matches", func(t *testing.T) {
-		evaluation := &engine.EvaluationResult{
-			Violations: []*engine.PolicyViolation{
-				{Subject: "test", Violation: "test violation"},
-			},
-			Skipped:    false,
-			SkipReason: "",
-			Ignore:     false,
-		}
+		violations := []string{"test violation"}
 		evaluationParams := map[string]string{"severity": "high"}
-		matches, err := r.MatchesEvaluation(context.TODO(), policy, evaluation, evaluationParams)
+		matches, err := r.MatchesEvaluation(context.TODO(), policy, violations, evaluationParams)
 		require.NoError(t, err)
 		assert.True(t, matches)
 	})
 
 	t.Run("evaluation without violations does not match", func(t *testing.T) {
-		evaluation := &engine.EvaluationResult{
-			Violations: []*engine.PolicyViolation{},
-			Skipped:    false,
-			SkipReason: "",
-			Ignore:     false,
-		}
+		violations := []string{}
 		evaluationParams := map[string]string{"severity": "high"}
-		matches, err := r.MatchesEvaluation(context.TODO(), policy, evaluation, evaluationParams)
+		matches, err := r.MatchesEvaluation(context.TODO(), policy, violations, evaluationParams)
 		require.NoError(t, err)
 		assert.False(t, matches)
 	})
 
 	t.Run("evaluation with violations but wrong severity does not match", func(t *testing.T) {
-		evaluation := &engine.EvaluationResult{
-			Violations: []*engine.PolicyViolation{
-				{Subject: "test", Violation: "test violation"},
-			},
-			Skipped:    false,
-			SkipReason: "",
-			Ignore:     false,
-		}
+		violations := []string{"test violation"}
 		evaluationParams := map[string]string{"severity": "low"}
-		matches, err := r.MatchesEvaluation(context.TODO(), policy, evaluation, evaluationParams)
+		matches, err := r.MatchesEvaluation(context.TODO(), policy, violations, evaluationParams)
 		require.NoError(t, err)
 		assert.False(t, matches)
 	})
@@ -443,16 +424,9 @@ func TestRego_MatchesEvaluation(t *testing.T) {
 	})
 
 	t.Run("empty evaluation params", func(t *testing.T) {
-		evaluation := &engine.EvaluationResult{
-			Violations: []*engine.PolicyViolation{
-				{Subject: "test", Violation: "test violation"},
-			},
-			Skipped:    false,
-			SkipReason: "",
-			Ignore:     false,
-		}
+		violations := []string{"test violation"}
 		evaluationParams := map[string]string{}
-		matches, err := r.MatchesEvaluation(context.TODO(), policy, evaluation, evaluationParams)
+		matches, err := r.MatchesEvaluation(context.TODO(), policy, violations, evaluationParams)
 		require.NoError(t, err)
 		assert.False(t, matches)
 	})

pkg/policies/engine/rego/testfiles/matches_evaluation.rego

@@ -2,10 +2,10 @@ package test_matches_evaluation
 
 matches_evaluation := result {
     # Check if the evaluation contains violations 
-    count(input.evaluation_result.violations) > 0
+    count(input.violations) > 0
 
     # Check if we have the expected parameter
-    input.args.severity == "high"
+    input.expected_args.severity == "high"
 
     # If both conditions are met, return true
     result := true