feat(evaluator): implement graph builtins - #197
Conversation
Port graph reachability and path traversal semantics from OPA so JVM evaluations can execute policies that use graph.reachable and graph.reachable_paths. Fixes: open-policy-agent#132 Signed-off-by: Dang Zitou <dengzitao888@163.com>
|
Could a maintainer please rerun the failed PR Check workflow? Both attempts failed in Check what files changed while Thanks! |
sspaink
left a comment
sspaink
left a comment
There was a problem hiding this comment.
opa-builtins/README.md:106 still lists graph.* as unimplemented, so the table now contradicts this PR. #191 was a dedicated commit to fix this same table drifting, so probably worth folding into this change:
| `bits.*`, `units.*`, `http.send` | No |
...plus a Yes row for graph.reachable, graph.reachable_paths.
| return new RegoSet(false, new LinkedHashSet<>(sortedPaths)); | ||
| } | ||
|
|
||
| private static void buildPaths( |
There was a problem hiding this comment.
buildPaths recurses once per path node, so deep graphs blow the JVM stack — measured on this branch, a 10k-node chain throws StackOverflowError (12k+ gives OutOfMemoryError), where OPA Go returns the 20,001-element path fine since goroutine stacks grow.
Evaluator.invokeBuiltin only catches TypeError/BuiltinError, so the Error escapes evaluate() entirely instead of surfacing as an OpaException — and the graph can come from data. Worth making this iterative with an explicit work stack, or at minimum bounding depth and throwing BuiltinError.
Signed-off-by: Dang Zitou <dengzitao888@163.com>
2 participants
Summary
Reproduction
On current main, the focused registry tests failed 2/2 on three consecutive runs because both graph builtin names were absent.
Verification
Fixes #132