test: Pre-compute the user/group policies

Author: siegfriedweber

tests/templates/kuttl/opa-authorization/trino_rules/trino/actual_permissions.rego

@@ -36,6 +36,61 @@ groups := array.concat(
 	[""],
 )
 
+original_user_group_authorization_policies := [rule |
+	some rule in policies.authorization
+	match_original_user_group(rule)
+]
+
+original_user_group_impersonation_policies := [rule |
+	some rule in policies.impersonation
+	match_original_user_group(rule)
+]
+
+user_group_catalog_policies := [rule |
+	some rule in policies.catalogs
+	match_user_group(rule)
+]
+
+user_group_catalog_session_property_policies := [rule |
+	some rule in policies.catalog_session_properties
+	match_user_group(rule)
+]
+
+user_group_function_policies := [rule |
+	some rule in policies.functions
+	match_user_group(rule)
+]
+
+user_group_procedure_policies := [rule |
+	some rule in policies.procedures
+	match_user_group(rule)
+]
+
+user_group_query_policies := [rule |
+	some rule in policies.queries
+	match_user_group(rule)
+]
+
+user_group_schema_policies := [rule |
+	some rule in policies.schemas
+	match_user_group(rule)
+]
+
+user_group_system_information_policies := [rule |
+	some rule in policies.system_information
+	match_user_group(rule)
+]
+
+user_group_system_session_property_policies := [rule |
+	some rule in policies.system_session_properties
+	match_user_group(rule)
+]
+
+user_group_table_policies := [rule |
+	some rule in policies.tables
+	match_user_group(rule)
+]
+
 default match_any_group(_) := false
 
 match_any_group(group_pattern) if {
@@ -65,9 +120,7 @@ match_original_user_group(rule) if {
 
 first_matching_authorization_rule(grantee_name) := rule if {
 	rules := [rule |
-		some rule in policies.authorization
-
-		match_original_user_group(rule)
+		some rule in original_user_group_authorization_policies
 
 		new_user_pattern := object.get(rule, "new_user", ".*")
 
@@ -85,9 +138,7 @@ authorization_permission(grantee_name) := first_matching_authorization_rule(gran
 
 first_matching_catalog_rule(catalog_name) := rule if {
 	rules := [rule |
-		some rule in policies.catalogs
-
-		match_user_group(rule)
+		some rule in user_group_catalog_policies
 
 		catalog_pattern := object.get(rule, "catalog", ".*")
 
@@ -111,9 +162,7 @@ first_matching_catalog_session_properties_rule(
 	property_name,
 ) := rule if {
 	rules := [rule |
-		some rule in policies.catalog_session_properties
-
-		match_user_group(rule)
+		some rule in user_group_catalog_session_property_policies
 
 		catalog_pattern := object.get(rule, "catalog", ".*")
 		property_pattern := object.get(rule, "property", ".*")
@@ -143,9 +192,7 @@ catalog_visibility(catalog_name) if {
 catalog_visibility(catalog_name) if {
 	catalog_access(catalog_name) == {"read-only"}
 
-	some rule in policies.schemas
-
-	match_user_group(rule)
+	some rule in user_group_schema_policies
 
 	catalog_pattern := object.get(rule, "catalog", ".*")
 
@@ -159,16 +206,14 @@ catalog_visibility(catalog_name) if {
 
 	rules := array.concat(
 		array.concat(
-			policies.tables,
-			policies.functions,
+			user_group_table_policies,
+			user_group_function_policies,
 		),
-		policies.procedures,
+		user_group_procedure_policies,
 	)
 
 	some rule in rules
 
-	match_user_group(rule)
-
 	catalog_pattern := object.get(rule, "catalog", ".*")
 
 	match_entire(catalog_pattern, catalog_name)
@@ -179,9 +224,7 @@ catalog_visibility(catalog_name) if {
 catalog_visibility(catalog_name) if {
 	catalog_access(catalog_name) == {"read-only"}
 
-	some rule in policies.catalog_session_properties
-
-	match_user_group(rule)
+	some rule in user_group_catalog_session_property_policies
 
 	catalog_pattern := object.get(rule, "catalog", ".*")
 
@@ -196,9 +239,7 @@ first_matching_function_rule(
 	function_name,
 ) := rule if {
 	rules := [rule |
-		some rule in policies.functions
-
-		match_user_group(rule)
+		some rule in user_group_function_policies
 
 		catalog_pattern := object.get(rule, "catalog", ".*")
 		schema_pattern := object.get(rule, "schema", ".*")
@@ -227,9 +268,7 @@ function_privileges(
 
 first_matching_impersonation_rule(user) := rule if {
 	rules := [rule |
-		some rule in policies.impersonation
-
-		match_original_user_group(rule)
+		some rule in original_user_group_impersonation_policies
 
 		original_user_pattern := object.get(rule, "original_user", ".*")
 		unsubstituted_new_user_pattern := object.get(rule, "new_user", ".*")
@@ -280,9 +319,7 @@ first_matching_procedure_rule(
 	function_name,
 ) := rule if {
 	rules := [rule |
-		some rule in policies.procedures
-
-		match_user_group(rule)
+		some rule in user_group_procedure_policies
 
 		catalog_pattern := object.get(rule, "catalog", ".*")
 		schema_pattern := object.get(rule, "schema", ".*")
@@ -309,24 +346,15 @@ procedure_privileges(
 	).privileges
 }
 
-first_matching_query_rule := rule if {
-	rules := [rule |
-		some rule in policies.queries
-
-		match_user_group(rule)
-	]
-	rule := rules[0]
-}
+first_matching_query_rule := user_group_query_policies[0]
 
 default query_access := set()
 
 query_access := {access | some access in first_matching_query_rule.allow}
 
 first_matching_query_owned_by_rule(user) := rule if {
 	rules := [rule |
-		some rule in policies.queries
-
-		match_user_group(rule)
+		some rule in user_group_query_policies
 
 		query_owner_pattern := object.get(rule, "queryOwner", ".*")
 
@@ -350,9 +378,7 @@ query_owned_by_access(user) := access if {
 
 first_matching_schema_rule(catalog_name, schema_name) := rule if {
 	rules := [rule |
-		some rule in policies.schemas
-
-		match_user_group(rule)
+		some rule in user_group_schema_policies
 
 		catalog_pattern := object.get(rule, "catalog", ".*")
 		schema_pattern := object.get(rule, "schema", ".*")
@@ -383,16 +409,14 @@ schema_visibility(catalog_name, schema_name) if {
 
 	rules := array.concat(
 		array.concat(
-			policies.tables,
-			policies.functions,
+			user_group_table_policies,
+			user_group_function_policies,
 		),
-		policies.procedures,
+		user_group_procedure_policies,
 	)
 
 	some rule in rules
 
-	match_user_group(rule)
-
 	catalog_pattern := object.get(rule, "catalog", ".*")
 	match_entire(catalog_pattern, catalog_name)
 
@@ -423,9 +447,7 @@ first_matching_table_rule(
 ) := rule if {
 	schema_name != "information_schema"
 	rules := [rule |
-		some rule in policies.tables
-
-		match_user_group(rule)
+		some rule in user_group_table_policies
 
 		catalog_pattern := object.get(rule, "catalog", ".*")
 		schema_pattern := object.get(rule, "schema", ".*")
@@ -521,14 +543,7 @@ column_access(
 	access := column.allow
 }
 
-first_matching_system_information_rule := rule if {
-	rules := [rule |
-		some rule in policies.system_information
-
-		match_user_group(rule)
-	]
-	rule := rules[0]
-}
+first_matching_system_information_rule := user_group_system_information_policies[0]
 
 default system_information_access := set()
 
@@ -538,9 +553,7 @@ system_information_access := {access |
 
 first_matching_system_session_properties_rule(property_name) := rule if {
 	rules := [rule |
-		some rule in policies.system_session_properties
-
-		match_user_group(rule)
+		some rule in user_group_system_session_property_policies
 
 		property_name_pattern := object.get(rule, "property", ".*")