synced/coder
1
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2025-07-03 16:13:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore: Compile rego once to save CPU cycles in testing (#4169)

Browse Source 
Compiling rego isn't very fast, so this should speed up tests in CI!
This commit is contained in:
Kyle Carberry
2022-09-23 11:26:04 -05:00
committed by GitHub
parent 1e1967e0db
commit 8738755ffc
4 changed files with 33 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files

46
coderd/rbac/authz.go
View File

@ -4,6 +4,7 @@ import (
"context"
_ "embed"
"fmt"
"sync"
"github.com/open-policy-agent/opa/rego"
"go.opentelemetry.io/otel/attribute"
@ -66,32 +67,37 @@ type RegoAuthorizer struct {
var _ Authorizer = (*RegoAuthorizer)(nil)
// Load the policy from policy.rego in this directory.
//
//go:embed policy.rego
var policy string
var (
// Load the policy from policy.rego in this directory.
//
//go:embed policy.rego
policy string
queryOnce sync.Once
query rego.PreparedEvalQuery
)
const (
rolesOkCheck = "role_ok"
scopeOkCheck = "scope_ok"
)
func NewAuthorizer() (*RegoAuthorizer, error) {
ctx := context.Background()
query, err := rego.New(
// Bind the results to 2 variables for easy checking later.
rego.Query(
fmt.Sprintf("%s := data.authz.role_allow "+
"%s := data.authz.scope_allow",
rolesOkCheck, scopeOkCheck),
),
rego.Module("policy.rego", policy),
).PrepareForEval(ctx)
if err != nil {
return nil, xerrors.Errorf("prepare query: %w", err)
}
return &RegoAuthorizer{query: query}, nil
func NewAuthorizer() *RegoAuthorizer {
queryOnce.Do(func() {
var err error
query, err = rego.New(
// Bind the results to 2 variables for easy checking later.
rego.Query(
fmt.Sprintf("%s := data.authz.role_allow "+
"%s := data.authz.scope_allow",
rolesOkCheck, scopeOkCheck),
),
rego.Module("policy.rego", policy),
).PrepareForEval(context.Background())
if err != nil {
panic(xerrors.Errorf("compile rego: %w", err))
}
})
return &RegoAuthorizer{query: query}
}
type authSubject struct {