test: Use common directory structure for OPA rules

siegfriedweber · siegfriedweber · commit 418ff505d61b · 2025-08-05T09:33:00.000+02:00
diff --git a/tests/templates/kuttl/opa-authorization/trino_rules/trino/actual_permissions.rego b/tests/templates/kuttl/opa-authorization/trino_rules/trino/actual_permissions.rego
@@ -1,7 +1,5 @@
 package trino
 
-import data.util
-
 # This file contains functions to determine the actual permissions
 # defined in the Trino policies for the given user and requested
 # resource.
@@ -41,7 +39,7 @@ default match_any_group(_) := false
 
 match_any_group(group_pattern) if {
 	some group in groups
-	util.match_entire(group_pattern, group)
+	match_entire(group_pattern, group)
 }
 
 default match_user_group(_) := false
@@ -50,7 +48,7 @@ match_user_group(rule) if {
 	user_pattern := object.get(rule, "user", ".*")
 	group_pattern := object.get(rule, "group", ".*")
 
-	util.match_entire(user_pattern, identity.user)
+	match_entire(user_pattern, identity.user)
 	match_any_group(group_pattern)
 }
 
@@ -60,7 +58,7 @@ match_original_user_group(rule) if {
 	user_pattern := object.get(rule, "original_user", ".*")
 	group_pattern := object.get(rule, "original_group", ".*")
 
-	util.match_entire(user_pattern, identity.user)
+	match_entire(user_pattern, identity.user)
 	match_any_group(group_pattern)
 }
 
@@ -72,7 +70,7 @@ first_matching_authorization_rule(grantee_name) := rule if {
 
 		new_user_pattern := object.get(rule, "new_user", ".*")
 
-		util.match_entire(new_user_pattern, grantee_name)
+		match_entire(new_user_pattern, grantee_name)
 	]
 	rule := object.union(
 		{"allow": true},
@@ -92,7 +90,7 @@ first_matching_catalog_rule(catalog_name) := rule if {
 
 		catalog_pattern := object.get(rule, "catalog", ".*")
 
-		util.match_entire(catalog_pattern, catalog_name)
+		match_entire(catalog_pattern, catalog_name)
 	]
 	rule := rules[0]
 }
@@ -119,8 +117,8 @@ first_matching_catalog_session_properties_rule(
 		catalog_pattern := object.get(rule, "catalog", ".*")
 		property_pattern := object.get(rule, "property", ".*")
 
-		util.match_entire(catalog_pattern, catalog_name)
-		util.match_entire(property_pattern, property_name)
+		match_entire(catalog_pattern, catalog_name)
+		match_entire(property_pattern, property_name)
 	]
 	rule := rules[0]
 }
@@ -150,7 +148,7 @@ catalog_visibility(catalog_name) if {
 
 	catalog_pattern := object.get(rule, "catalog", ".*")
 
-	util.match_entire(catalog_pattern, catalog_name)
+	match_entire(catalog_pattern, catalog_name)
 
 	rule.owner == true
 }
@@ -172,7 +170,7 @@ catalog_visibility(catalog_name) if {
 
 	catalog_pattern := object.get(rule, "catalog", ".*")
 
-	util.match_entire(catalog_pattern, catalog_name)
+	match_entire(catalog_pattern, catalog_name)
 
 	count(rule.privileges) != 0
 }
@@ -186,7 +184,7 @@ catalog_visibility(catalog_name) if {
 
 	catalog_pattern := object.get(rule, "catalog", ".*")
 
-	util.match_entire(catalog_pattern, catalog_name)
+	match_entire(catalog_pattern, catalog_name)
 
 	rule.allow == true
 }
@@ -205,9 +203,9 @@ first_matching_function_rule(
 		schema_pattern := object.get(rule, "schema", ".*")
 		function_pattern := object.get(rule, "function", ".*")
 
-		util.match_entire(catalog_pattern, catalog_name)
-		util.match_entire(schema_pattern, schema_name)
-		util.match_entire(function_pattern, function_name)
+		match_entire(catalog_pattern, catalog_name)
+		match_entire(schema_pattern, schema_name)
+		match_entire(function_pattern, function_name)
 	]
 	rule := rules[0]
 }
@@ -251,7 +249,7 @@ first_matching_impersonation_rule(user) := rule if {
 			unsubstituted_new_user_pattern,
 		)
 
-		util.match_entire(new_user_pattern, user)
+		match_entire(new_user_pattern, user)
 	]
 	rule := object.union(
 		{"allow": true},
@@ -289,9 +287,9 @@ first_matching_procedure_rule(
 		schema_pattern := object.get(rule, "schema", ".*")
 		procedure_pattern := object.get(rule, "procedure", ".*")
 
-		util.match_entire(catalog_pattern, catalog_name)
-		util.match_entire(schema_pattern, schema_name)
-		util.match_entire(procedure_pattern, function_name)
+		match_entire(catalog_pattern, catalog_name)
+		match_entire(schema_pattern, schema_name)
+		match_entire(procedure_pattern, function_name)
 	]
 	rule := rules[0]
 }
@@ -331,7 +329,7 @@ first_matching_query_owned_by_rule(user) := rule if {
 
 		query_owner_pattern := object.get(rule, "queryOwner", ".*")
 
-		util.match_entire(query_owner_pattern, user)
+		match_entire(query_owner_pattern, user)
 	]
 	rule := rules[0]
 }
@@ -358,8 +356,8 @@ first_matching_schema_rule(catalog_name, schema_name) := rule if {
 		catalog_pattern := object.get(rule, "catalog", ".*")
 		schema_pattern := object.get(rule, "schema", ".*")
 
-		util.match_entire(catalog_pattern, catalog_name)
-		util.match_entire(schema_pattern, schema_name)
+		match_entire(catalog_pattern, catalog_name)
+		match_entire(schema_pattern, schema_name)
 	]
 	rule := rules[0]
 }
@@ -397,8 +395,8 @@ schema_visibility(catalog_name, schema_name) if {
 	catalog_pattern := object.get(rule, "catalog", ".*")
 	schema_pattern := object.get(rule, "schema", ".*")
 
-	util.match_entire(catalog_pattern, catalog_name)
-	util.match_entire(schema_pattern, schema_name)
+	match_entire(catalog_pattern, catalog_name)
+	match_entire(schema_pattern, schema_name)
 
 	count(rule.privileges) != 0
 }
@@ -432,9 +430,9 @@ first_matching_table_rule(
 		schema_pattern := object.get(rule, "schema", ".*")
 		table_pattern := object.get(rule, "table", ".*")
 
-		util.match_entire(catalog_pattern, catalog_name)
-		util.match_entire(schema_pattern, schema_name)
-		util.match_entire(table_pattern, table_name)
+		match_entire(catalog_pattern, catalog_name)
+		match_entire(schema_pattern, schema_name)
+		match_entire(table_pattern, table_name)
 	]
 	rule := object.union(
 		{
@@ -545,7 +543,7 @@ first_matching_system_session_properties_rule(property_name) := rule if {
 
 		property_name_pattern := object.get(rule, "property", ".*")
 
-		util.match_entire(property_name_pattern, property_name)
+		match_entire(property_name_pattern, property_name)
 	]
 	rule := rules[0]
 }
diff --git a/tests/templates/kuttl/opa-authorization/trino_rules/trino/actual_permissions_test.rego b/tests/templates/kuttl/opa-authorization/trino_rules/trino/actual_permissions_test.rego
@@ -1,4 +1,4 @@
-package actual_permissions_test
+package trino_test
 
 import data.trino
 
diff --git a/tests/templates/kuttl/opa-authorization/trino_rules/trino/policies.rego b/tests/templates/kuttl/opa-authorization/trino_rules/trino/policies.rego
@@ -1,7 +1,5 @@
 package trino
 
-import data.util
-
 # The final policies are a combination of policies offered by Stackable,
 # policies provided externally, and default policies.
 # Stackable's policies form the beginnings of the rule lists, i.e. they
diff --git a/tests/templates/kuttl/opa-authorization/trino_rules/trino/policies_test.rego b/tests/templates/kuttl/opa-authorization/trino_rules/trino/policies_test.rego
@@ -1,4 +1,4 @@
-package policies_test
+package trino_test
 
 import data.trino
 
diff --git a/tests/templates/kuttl/opa-authorization/trino_rules/trino/requested_permissions.rego b/tests/templates/kuttl/opa-authorization/trino_rules/trino/requested_permissions.rego
diff --git a/tests/templates/kuttl/opa-authorization/trino_rules/trino/requested_permissions_test.rego b/tests/templates/kuttl/opa-authorization/trino_rules/trino/requested_permissions_test.rego
@@ -1,4 +1,4 @@
-package requested_permissions_test
+package trino_test
 
 import data.trino
 
diff --git a/tests/templates/kuttl/opa-authorization/trino_rules/trino/util.rego b/tests/templates/kuttl/opa-authorization/trino_rules/trino/util.rego
@@ -1,6 +1,4 @@
-# METADATA
-# description: Utility package which extends the built-in functions
-package util
+package trino
 
 # METADATA
 # description: |
@@ -11,6 +9,7 @@ package util
 #
 #   Returns:
 #     result (boolean)
+# scope: document
 match_entire(pattern, value) if {
 	pattern == `.*`
 }
diff --git a/tests/templates/kuttl/opa-authorization/trino_rules/trino/util_test.rego b/tests/templates/kuttl/opa-authorization/trino_rules/trino/util_test.rego
@@ -0,0 +1,14 @@
+package trino_test
+
+import data.trino
+
+test_match_entire if {
+	trino.match_entire(`.*`, "a")
+	trino.match_entire(`a`, "a")
+	trino.match_entire(`^a`, "a")
+	trino.match_entire(`a$`, "a")
+	trino.match_entire(`^a$`, "a")
+	not trino.match_entire(`a`, "abc")
+	not trino.match_entire(`b`, "abc")
+	not trino.match_entire(`c`, "abc")
+}
diff --git a/tests/templates/kuttl/opa-authorization/trino_rules/trino/verification.rego b/tests/templates/kuttl/opa-authorization/trino_rules/trino/verification.rego
diff --git a/tests/templates/kuttl/opa-authorization/trino_rules/trino/verification_test.rego b/tests/templates/kuttl/opa-authorization/trino_rules/trino/verification_test.rego
@@ -1,4 +1,4 @@
-package verification_test
+package trino_test
 
 import data.trino
 
diff --git a/tests/templates/kuttl/opa-authorization/trino_rules/util_test.rego b/tests/templates/kuttl/opa-authorization/trino_rules/util_test.rego

Original file line number	Diff line number	Diff line change
`@@ -1,7 +1,5 @@`
`1`	`1`	`package trino`
`2`	`2`
`3`		`-import data.util`
`4`		`-`
`5`	`3`	`# This file contains functions to determine the actual permissions`
`6`	`4`	`# defined in the Trino policies for the given user and requested`
`7`	`5`	`# resource.`
`@@ -41,7 +39,7 @@ default match_any_group(_) := false`
`41`	`39`
`42`	`40`	`match_any_group(group_pattern) if {`
`43`	`41`	`some group in groups`
`44`		`- util.match_entire(group_pattern, group)`
	`42`	`+ match_entire(group_pattern, group)`
`45`	`43`	`}`
`46`	`44`
`47`	`45`	`default match_user_group(_) := false`
`@@ -50,7 +48,7 @@ match_user_group(rule) if {`
`50`	`48`	`user_pattern := object.get(rule, "user", ".*")`
`51`	`49`	`group_pattern := object.get(rule, "group", ".*")`
`52`	`50`
`53`		`- util.match_entire(user_pattern, identity.user)`
	`51`	`+ match_entire(user_pattern, identity.user)`
`54`	`52`	`match_any_group(group_pattern)`
`55`	`53`	`}`
`56`	`54`
`@@ -60,7 +58,7 @@ match_original_user_group(rule) if {`
`60`	`58`	`user_pattern := object.get(rule, "original_user", ".*")`
`61`	`59`	`group_pattern := object.get(rule, "original_group", ".*")`
`62`	`60`
`63`		`- util.match_entire(user_pattern, identity.user)`
	`61`	`+ match_entire(user_pattern, identity.user)`
`64`	`62`	`match_any_group(group_pattern)`
`65`	`63`	`}`
`66`	`64`
`@@ -72,7 +70,7 @@ first_matching_authorization_rule(grantee_name) := rule if {`
`72`	`70`
`73`	`71`	`new_user_pattern := object.get(rule, "new_user", ".*")`
`74`	`72`
`75`		`- util.match_entire(new_user_pattern, grantee_name)`
	`73`	`+ match_entire(new_user_pattern, grantee_name)`
`76`	`74`	`]`
`77`	`75`	`rule := object.union(`
`78`	`76`	`{"allow": true},`
`@@ -92,7 +90,7 @@ first_matching_catalog_rule(catalog_name) := rule if {`
`92`	`90`
`93`	`91`	`catalog_pattern := object.get(rule, "catalog", ".*")`
`94`	`92`
`95`		`- util.match_entire(catalog_pattern, catalog_name)`
	`93`	`+ match_entire(catalog_pattern, catalog_name)`
`96`	`94`	`]`
`97`	`95`	`rule := rules[0]`
`98`	`96`	`}`
`@@ -119,8 +117,8 @@ first_matching_catalog_session_properties_rule(`
`119`	`117`	`catalog_pattern := object.get(rule, "catalog", ".*")`
`120`	`118`	`property_pattern := object.get(rule, "property", ".*")`
`121`	`119`
`122`		`- util.match_entire(catalog_pattern, catalog_name)`
`123`		`- util.match_entire(property_pattern, property_name)`
	`120`	`+ match_entire(catalog_pattern, catalog_name)`
	`121`	`+ match_entire(property_pattern, property_name)`
`124`	`122`	`]`
`125`	`123`	`rule := rules[0]`
`126`	`124`	`}`
`@@ -150,7 +148,7 @@ catalog_visibility(catalog_name) if {`
`150`	`148`
`151`	`149`	`catalog_pattern := object.get(rule, "catalog", ".*")`
`152`	`150`
`153`		`- util.match_entire(catalog_pattern, catalog_name)`
	`151`	`+ match_entire(catalog_pattern, catalog_name)`
`154`	`152`
`155`	`153`	`rule.owner == true`
`156`	`154`	`}`
`@@ -172,7 +170,7 @@ catalog_visibility(catalog_name) if {`
`172`	`170`
`173`	`171`	`catalog_pattern := object.get(rule, "catalog", ".*")`
`174`	`172`
`175`		`- util.match_entire(catalog_pattern, catalog_name)`
	`173`	`+ match_entire(catalog_pattern, catalog_name)`
`176`	`174`
`177`	`175`	`count(rule.privileges) != 0`
`178`	`176`	`}`
`@@ -186,7 +184,7 @@ catalog_visibility(catalog_name) if {`
`186`	`184`
`187`	`185`	`catalog_pattern := object.get(rule, "catalog", ".*")`
`188`	`186`
`189`		`- util.match_entire(catalog_pattern, catalog_name)`
	`187`	`+ match_entire(catalog_pattern, catalog_name)`
`190`	`188`
`191`	`189`	`rule.allow == true`
`192`	`190`	`}`
`@@ -205,9 +203,9 @@ first_matching_function_rule(`
`205`	`203`	`schema_pattern := object.get(rule, "schema", ".*")`
`206`	`204`	`function_pattern := object.get(rule, "function", ".*")`
`207`	`205`
`208`		`- util.match_entire(catalog_pattern, catalog_name)`
`209`		`- util.match_entire(schema_pattern, schema_name)`
`210`		`- util.match_entire(function_pattern, function_name)`
	`206`	`+ match_entire(catalog_pattern, catalog_name)`
	`207`	`+ match_entire(schema_pattern, schema_name)`
	`208`	`+ match_entire(function_pattern, function_name)`
`211`	`209`	`]`
`212`	`210`	`rule := rules[0]`
`213`	`211`	`}`
`@@ -251,7 +249,7 @@ first_matching_impersonation_rule(user) := rule if {`
`251`	`249`	`unsubstituted_new_user_pattern,`
`252`	`250`	`)`
`253`	`251`
`254`		`- util.match_entire(new_user_pattern, user)`
	`252`	`+ match_entire(new_user_pattern, user)`
`255`	`253`	`]`
`256`	`254`	`rule := object.union(`
`257`	`255`	`{"allow": true},`
`@@ -289,9 +287,9 @@ first_matching_procedure_rule(`
`289`	`287`	`schema_pattern := object.get(rule, "schema", ".*")`
`290`	`288`	`procedure_pattern := object.get(rule, "procedure", ".*")`
`291`	`289`
`292`		`- util.match_entire(catalog_pattern, catalog_name)`
`293`		`- util.match_entire(schema_pattern, schema_name)`
`294`		`- util.match_entire(procedure_pattern, function_name)`
	`290`	`+ match_entire(catalog_pattern, catalog_name)`
	`291`	`+ match_entire(schema_pattern, schema_name)`
	`292`	`+ match_entire(procedure_pattern, function_name)`
`295`	`293`	`]`
`296`	`294`	`rule := rules[0]`
`297`	`295`	`}`
`@@ -331,7 +329,7 @@ first_matching_query_owned_by_rule(user) := rule if {`
`331`	`329`
`332`	`330`	`query_owner_pattern := object.get(rule, "queryOwner", ".*")`
`333`	`331`
`334`		`- util.match_entire(query_owner_pattern, user)`
	`332`	`+ match_entire(query_owner_pattern, user)`
`335`	`333`	`]`
`336`	`334`	`rule := rules[0]`
`337`	`335`	`}`
`@@ -358,8 +356,8 @@ first_matching_schema_rule(catalog_name, schema_name) := rule if {`
`358`	`356`	`catalog_pattern := object.get(rule, "catalog", ".*")`
`359`	`357`	`schema_pattern := object.get(rule, "schema", ".*")`
`360`	`358`
`361`		`- util.match_entire(catalog_pattern, catalog_name)`
`362`		`- util.match_entire(schema_pattern, schema_name)`
	`359`	`+ match_entire(catalog_pattern, catalog_name)`
	`360`	`+ match_entire(schema_pattern, schema_name)`
`363`	`361`	`]`
`364`	`362`	`rule := rules[0]`
`365`	`363`	`}`
`@@ -397,8 +395,8 @@ schema_visibility(catalog_name, schema_name) if {`
`397`	`395`	`catalog_pattern := object.get(rule, "catalog", ".*")`
`398`	`396`	`schema_pattern := object.get(rule, "schema", ".*")`
`399`	`397`
`400`		`- util.match_entire(catalog_pattern, catalog_name)`
`401`		`- util.match_entire(schema_pattern, schema_name)`
	`398`	`+ match_entire(catalog_pattern, catalog_name)`
	`399`	`+ match_entire(schema_pattern, schema_name)`
`402`	`400`
`403`	`401`	`count(rule.privileges) != 0`
`404`	`402`	`}`
`@@ -432,9 +430,9 @@ first_matching_table_rule(`
`432`	`430`	`schema_pattern := object.get(rule, "schema", ".*")`
`433`	`431`	`table_pattern := object.get(rule, "table", ".*")`
`434`	`432`
`435`		`- util.match_entire(catalog_pattern, catalog_name)`
`436`		`- util.match_entire(schema_pattern, schema_name)`
`437`		`- util.match_entire(table_pattern, table_name)`
	`433`	`+ match_entire(catalog_pattern, catalog_name)`
	`434`	`+ match_entire(schema_pattern, schema_name)`
	`435`	`+ match_entire(table_pattern, table_name)`
`438`	`436`	`]`
`439`	`437`	`rule := object.union(`
`440`	`438`	`{`
`@@ -545,7 +543,7 @@ first_matching_system_session_properties_rule(property_name) := rule if {`
`545`	`543`
`546`	`544`	`property_name_pattern := object.get(rule, "property", ".*")`
`547`	`545`
`548`		`- util.match_entire(property_name_pattern, property_name)`
	`546`	`+ match_entire(property_name_pattern, property_name)`
`549`	`547`	`]`
`550`	`548`	`rule := rules[0]`
`551`	`549`	`}`
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-package actual_permissions_test`
	`1`	`+package trino_test`
`2`	`2`
`3`	`3`	`import data.trino`
`4`	`4`
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-package policies_test`
	`1`	`+package trino_test`
`2`	`2`
`3`	`3`	`import data.trino`
`4`	`4`
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-package requested_permissions_test`
	`1`	`+package trino_test`
`2`	`2`
`3`	`3`	`import data.trino`
`4`	`4`
Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,4 @@`
`1`		`-# METADATA`
`2`		`-# description: Utility package which extends the built-in functions`
`3`		`-package util`
	`1`	`+package trino`
`4`	`2`
`5`	`3`	`# METADATA`
`6`	`4`	`# description: \|`
`@@ -11,6 +9,7 @@ package util`
`11`	`9`	`#`
`12`	`10`	`# Returns:`
`13`	`11`	`# result (boolean)`
	`12`	`+# scope: document`
`14`	`13`	`match_entire(pattern, value) if {`
`15`	`14`	pattern == `.*`
`16`	`15`	`}`
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-package verification_test`
	`1`	`+package trino_test`
`2`	`2`
`3`	`3`	`import data.trino`
`4`	`4`