make raw result optional for engine

Signed-off-by: Sylwester Piskozub <sylwesterpiskozub@gmail.com>

Author: Piskoo

app/cli/internal/policydevel/eval.go

@@ -98,6 +98,9 @@ func verifyMaterial(schema *v1.CraftingSchema, material *v12.Attestation_Materia
 	if len(allowedHostnames) > 0 {
 		opts = append(opts, policies.WithAllowedHostnames(allowedHostnames...))
 	}
+
+	opts = append(opts, policies.WithIncludeRawData(debug))
+
 	v := policies.NewPolicyVerifier(schema, nil, logger, opts...)
 	policyEvs, err := v.VerifyMaterial(context.Background(), material, materialPath)
 	if err != nil {

pkg/policies/engine/rego/rego.go

@@ -35,6 +35,8 @@ type Engine struct {
 	// allowedNetworkDomains is a list of network domains that are allowed for the compiler to access
 	// when using http.send built-in function
 	allowedNetworkDomains []string
+	// includeRawData determines whether to collect raw evaluation data
+	includeRawData bool
 }
 
 type EngineOption func(*newEngineOptions)
@@ -51,9 +53,16 @@ func WithAllowedNetworkDomains(domains ...string) EngineOption {
 	}
 }
 
+func WithIncludeRawData(include bool) EngineOption {
+	return func(e *newEngineOptions) {
+		e.includeRawData = include
+	}
+}
+
 type newEngineOptions struct {
 	operatingMode         EnvironmentMode
 	allowedNetworkDomains []string
+	includeRawData        bool
 }
 
 // NewEngine creates a new policy engine with the given options
@@ -78,6 +87,7 @@ func NewEngine(opts ...EngineOption) *Engine {
 		operatingMode: options.operatingMode,
 		// append base allowed network domains to the user provided ones
 		allowedNetworkDomains: append(baseAllowedNetworkDomains, options.allowedNetworkDomains...),
+		includeRawData:        options.includeRawData,
 	}
 }
 
@@ -154,14 +164,17 @@ func (r *Engine) Verify(ctx context.Context, policy *engine.Policy, input []byte
 		return err
 	}
 
-	// Get raw results first
-	if err := executeQuery(getRuleName(parsedModule.Package.Path, ""), r.operatingMode == EnvironmentModeRestrictive); err != nil {
-		return nil, err
-	}
+	var rawData *engine.RawData
+	// Get raw results first if requested
+	if r.includeRawData {
+		if err := executeQuery(getRuleName(parsedModule.Package.Path, ""), r.operatingMode == EnvironmentModeRestrictive); err != nil {
+			return nil, err
+		}
 
-	rawData := &engine.RawData{
-		Input:  decodedInput,
-		Output: regoResultSetToRawResults(res),
+		rawData = &engine.RawData{
+			Input:  decodedInput,
+			Output: regoResultSetToRawResults(res),
+		}
 	}
 
 	// Try the main rule first

pkg/policies/policies.go

@@ -66,12 +66,14 @@ type PolicyVerifier struct {
 	logger           *zerolog.Logger
 	client           v13.AttestationServiceClient
 	allowedHostnames []string
+	includeRawData   bool
 }
 
 var _ Verifier = (*PolicyVerifier)(nil)
 
 type PolicyVerifierOptions struct {
 	AllowedHostnames []string
+	IncludeRawData   bool
 }
 
 type PolicyVerifierOption func(*PolicyVerifierOptions)
@@ -82,13 +84,25 @@ func WithAllowedHostnames(hostnames ...string) PolicyVerifierOption {
 	}
 }
 
+func WithIncludeRawData(include bool) PolicyVerifierOption {
+	return func(o *PolicyVerifierOptions) {
+		o.IncludeRawData = include
+	}
+}
+
 func NewPolicyVerifier(schema *v1.CraftingSchema, client v13.AttestationServiceClient, logger *zerolog.Logger, opts ...PolicyVerifierOption) *PolicyVerifier {
 	options := &PolicyVerifierOptions{}
 	for _, opt := range opts {
 		opt(options)
 	}
 
-	return &PolicyVerifier{schema: schema, client: client, logger: logger, allowedHostnames: options.AllowedHostnames}
+	return &PolicyVerifier{
+		schema:           schema,
+		client:           client,
+		logger:           logger,
+		allowedHostnames: options.AllowedHostnames,
+		includeRawData:   options.IncludeRawData,
+	}
 }
 
 // VerifyMaterial applies all required policies to a material
@@ -175,7 +189,9 @@ func (pv *PolicyVerifier) evaluatePolicyAttachment(ctx context.Context, attachme
 			return nil, NewPolicyError(err)
 		}
 
-		rawResults = append(rawResults, r.RawData)
+		if r.RawData != nil {
+			rawResults = append(rawResults, r.RawData)
+		}
 
 		// Skip if the script explicitly instructs us to ignore it, effectively preventing it from being added to the evaluation results
 		if r.Ignore {
@@ -330,6 +346,10 @@ func (pv *PolicyVerifier) executeScript(ctx context.Context, script *engine.Poli
 		engineOpts = append(engineOpts, rego.WithAllowedNetworkDomains(pv.allowedHostnames...))
 	}
 
+	if pv.includeRawData {
+		engineOpts = append(engineOpts, rego.WithIncludeRawData(true))
+	}
+
 	// verify the policy
 	ng := rego.NewEngine(engineOpts...)
 	res, err := ng.Verify(ctx, script, material, getInputArguments(args))
@@ -668,6 +688,9 @@ func LogPolicyEvaluations(evaluations []*v12.PolicyEvaluation, logger *zerolog.L
 func engineRawResultsToAPIRawResults(rawResults []*engine.RawData) []*structpb.Struct {
 	res := make([]*structpb.Struct, 0)
 	for _, r := range rawResults {
+		if r == nil {
+			continue
+		}
 		// Convert RawData to map
 		m := map[string]interface{}{
 			"input":  r.Input,