Documentation
¶
Index ¶
- type CatEvaluator
- type CatEvaluatorKind
- type CompareCondRepo
- func (repo *CompareCondRepo) ConvertToCategoryCondition(c condition.Condition, parentScope *ForEachScope) condition.Condition
- func (repo *CompareCondRepo) DiscardEvalCategoryRec(evalCategoryRec *EvalCategoryRec)
- func (repo *CompareCondRepo) NewEvalCategoryRec(eval condition.Operand) *EvalCategoryRec
- type EvalCategoryRec
- type EvalCondFunc
- type ExternalRule
- type ForEachScope
- type GeneralRuleRecord
- type InternalRule
- type LoadOption
- type LoadResult
- type RepoInterface
- type RuleApi
- type RuleEngine
- type RuleEngineMetrics
- type RuleEngineRepo
- func (repo *RuleEngineRepo) GetAppCtx() *types.AppContext
- func (repo *RuleEngineRepo) LoadRules(reader io.Reader, opts ...LoadOption) (*LoadResult, error)
- func (repo *RuleEngineRepo) LoadRulesFromFile(path string, opts ...LoadOption) (*LoadResult, error)
- func (repo *RuleEngineRepo) LoadRulesFromString(content string, opts ...LoadOption) (*LoadResult, error)
- func (repo *RuleEngineRepo) MapScalar(v interface{}) interface{}
- func (repo *RuleEngineRepo) Register(f *InternalRule) uint
- func (repo *RuleEngineRepo) RegisterRuleFromString(rule string, format string) (uint, error)
- func (repo *RuleEngineRepo) RegisterRulesFromFile(path string) ([]uint, error)
- type StringMatcher
- type TestCase
- type TestResult
- type TestSummary
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type CatEvaluator ¶
type CatEvaluator interface {
Evaluate(event *objectmap.ObjectAttributeMap, frames []interface{}) (bool, error)
GetCategory() types.Category
immutable.SetElement
}
type CatEvaluatorKind ¶
type CatEvaluatorKind int8
type CompareCondRepo ¶
type CompareCondRepo struct {
AttributeToCompareCondRecord map[string]*hashset.Set[*EvalCategoryRec]
CondToCompareCondRecord *hashmap.Map[condition.Condition, *EvalCategoryRec]
CondToCategoryMap *hashmap.Map[condition.Condition, *hashmap.Map[condition.Operand, []condition.Operand]]
CondToStringMatcher *hashmap.Map[condition.Condition, *StringMatcher]
EvalCategoryRecs []*EvalCategoryRec
// Categories that must be evaluated even if their attributes aren't in the event
// (e.g., null checks like "field == null", constant expressions like "1 == 1")
AlwaysEvaluateCategories *hashset.Set[*EvalCategoryRec]
// Set of categories that check "field == undefined" (for efficient DefaultCatList)
UndefinedEqualityCategories *hashset.Set[types.Category]
RuleRepo condition.RuleRepo
ObjectAttributeMapper *objectmap.ObjectAttributeMapper
CondFactory *condition.Factory
// contains filtered or unexported fields
}
CompareCondRepo contains mappings between filter Compare Conditions and attributes assigned to them. Identical Compare Conditions will be mapped to the same category.
func RuleEngineRepoToCompareCondRepo ¶
func RuleEngineRepoToCompareCondRepo(repo *RuleEngineRepo) (*CompareCondRepo, error)
func (*CompareCondRepo) ConvertToCategoryCondition ¶
func (repo *CompareCondRepo) ConvertToCategoryCondition(c condition.Condition, parentScope *ForEachScope) condition.Condition
ConvertToCategoryCondition this has to be called from the root condition or and/or/not boolean operator
func (*CompareCondRepo) DiscardEvalCategoryRec ¶
func (repo *CompareCondRepo) DiscardEvalCategoryRec(evalCategoryRec *EvalCategoryRec)
func (*CompareCondRepo) NewEvalCategoryRec ¶
func (repo *CompareCondRepo) NewEvalCategoryRec(eval condition.Operand) *EvalCategoryRec
type EvalCategoryRec ¶
type EvalCategoryRec struct {
Cat types.Category
Eval condition.Operand
AttrKeys []string
IsUndefinedEqualityCheck bool // true if this category checks "field == undefined"
FieldPath string // field path for undefined checks (e.g., "age", "user.name")
}
func (*EvalCategoryRec) Equals ¶
func (v *EvalCategoryRec) Equals(element immutable.SetElement) bool
func (*EvalCategoryRec) Evaluate ¶
func (v *EvalCategoryRec) Evaluate(event *objectmap.ObjectAttributeMap, frames []interface{}) condition.Operand
func (*EvalCategoryRec) GetCategory ¶
func (v *EvalCategoryRec) GetCategory() types.Category
func (*EvalCategoryRec) GetHash ¶
func (v *EvalCategoryRec) GetHash() uint64
type EvalCondFunc ¶
type EvalCondFunc func(event *objectmap.ObjectAttributeMap, frames []interface{}) (bool, error)
type ExternalRule ¶
type ForEachScope ¶
type ForEachScope struct {
// Path, e.g. $.members or $member.children.
// Each path consist of the outer path reference (e.g. $ for root or $member for path to
// the member element) and the path to a nested array element. The address of the denoted
// element is therefore a concatenation of the address of the parent element's path
// and the address of the path of the current element.
Path string
Element string
NestingLevel int
ParentScope *ForEachScope
Evaluator *EvalCategoryRec
AttrDictRec *objectmap.AttrDictionaryRec
}
ForEachScope keeps track of the local scope data. Each for_all, for_some or for_each filter element starts a new scope with its index element and path pointing to the data attribute over which the element iterates in this scope. The scope's element is available from all the nested scopes both during the filter build time as the parentScope parameter and at runtime via array of attribute addresses, one for each ancestor scope.
func (*ForEachScope) ResetEvaluator ¶
func (scope *ForEachScope) ResetEvaluator()
type GeneralRuleRecord ¶
type GeneralRuleRecord struct {
// contains filtered or unexported fields
}
func (*GeneralRuleRecord) GetHash ¶ added in v0.3.2
func (r *GeneralRuleRecord) GetHash() uint64
GetHash returns the cryptographic hash of the rule's compiled condition.
type InternalRule ¶
func (*InternalRule) GetHash ¶ added in v0.3.2
func (rule *InternalRule) GetHash() uint64
GetHash returns the cryptographic hash of the compiled rule condition. The hash uniquely identifies the rule's semantic content and is computed recursively from the entire condition tree structure.
type LoadOption ¶ added in v0.4.0
type LoadOption func(*loadConfig)
LoadOption is a functional option for configuring rule loading
func WithFileFormat ¶ added in v0.4.0
func WithFileFormat(format string) LoadOption
WithFileFormat specifies the file format ("yaml", "json", or "" for auto-detect)
func WithOptimize ¶ added in v0.4.0
func WithOptimize(optimize bool) LoadOption
WithOptimize enables or disables category engine optimizations
func WithRunTests ¶ added in v0.4.0
func WithRunTests(runTests bool) LoadOption
WithRunTests enables or disables test execution during load
func WithValidate ¶ added in v0.4.0
func WithValidate(validate bool) LoadOption
WithValidate enables or disables expression validation during load
type LoadResult ¶ added in v0.3.0
type LoadResult struct {
RuleIDs []uint // IDs of loaded rules
ValidationOK bool // True if all rules validated successfully
TestResults []TestResult // Results from test execution
Errors []error // Validation or test errors
}
LoadResult contains the result of loading rules
func (*LoadResult) GetFailedTests ¶ added in v0.3.0
func (r *LoadResult) GetFailedTests() []TestResult
GetFailedTests returns only the tests that failed
func (*LoadResult) GetTestSummary ¶ added in v0.3.0
func (r *LoadResult) GetTestSummary() TestSummary
GetTestSummary returns statistics about test execution
type RepoInterface ¶
type RepoInterface interface {
Register(f *InternalRule)
}
type RuleApi ¶
type RuleApi struct {
// contains filtered or unexported fields
}
func NewRuleApi ¶
func NewRuleApi(ctx *types.AppContext) *RuleApi
type RuleEngine ¶
type RuleEngine struct {
Metrics RuleEngineMetrics
// contains filtered or unexported fields
}
func NewRuleEngine ¶
func NewRuleEngine(repo *RuleEngineRepo) (*RuleEngine, error)
func (*RuleEngine) GetRuleDefinition ¶
func (f *RuleEngine) GetRuleDefinition(ruleId uint) *InternalRule
func (*RuleEngine) MatchEvent ¶
func (f *RuleEngine) MatchEvent(v interface{}) []condition.RuleIdType
type RuleEngineMetrics ¶
type RuleEngineMetrics struct {
NumCatEvals uint64
}
type RuleEngineRepo ¶
type RuleEngineRepo struct {
Rules []*GeneralRuleRecord
Optimize bool // If true, apply category engine optimizations (default: true)
// contains filtered or unexported fields
}
func NewRuleEngineRepo ¶
func NewRuleEngineRepo() *RuleEngineRepo
func (*RuleEngineRepo) GetAppCtx ¶
func (repo *RuleEngineRepo) GetAppCtx() *types.AppContext
func (*RuleEngineRepo) LoadRules ¶ added in v0.3.0
func (repo *RuleEngineRepo) LoadRules(reader io.Reader, opts ...LoadOption) (*LoadResult, error)
LoadRules loads rules from an io.Reader with optional configuration
func (*RuleEngineRepo) LoadRulesFromFile ¶ added in v0.3.0
func (repo *RuleEngineRepo) LoadRulesFromFile(path string, opts ...LoadOption) (*LoadResult, error)
LoadRulesFromFile is a convenience wrapper for LoadRules that loads from a file
func (*RuleEngineRepo) LoadRulesFromString ¶ added in v0.3.0
func (repo *RuleEngineRepo) LoadRulesFromString(content string, opts ...LoadOption) (*LoadResult, error)
LoadRulesFromString is a convenience wrapper for LoadRules that loads from a string
func (*RuleEngineRepo) MapScalar ¶
func (repo *RuleEngineRepo) MapScalar(v interface{}) interface{}
MapScalar Implement MapperConfig interface
func (*RuleEngineRepo) Register ¶
func (repo *RuleEngineRepo) Register(f *InternalRule) uint
func (*RuleEngineRepo) RegisterRuleFromString ¶
func (repo *RuleEngineRepo) RegisterRuleFromString(rule string, format string) (uint, error)
func (*RuleEngineRepo) RegisterRulesFromFile ¶ added in v0.2.0
func (repo *RuleEngineRepo) RegisterRulesFromFile(path string) ([]uint, error)
type StringMatcher ¶
type StringMatcher struct {
// contains filtered or unexported fields
}
func NewStringMatcher ¶
func NewStringMatcher() *StringMatcher
func (*StringMatcher) AddPattern ¶
func (sm *StringMatcher) AddPattern(pattern string, category condition.Operand)
func (*StringMatcher) Build ¶
func (sm *StringMatcher) Build()
type TestCase ¶ added in v0.3.0
type TestCase struct {
Name string `json:"name" yaml:"name"`
Event map[string]interface{} `json:"event" yaml:"event"`
Expect bool `json:"expect" yaml:"expect"`
}
TestCase defines a test case for a rule
type TestResult ¶ added in v0.3.0
type TestResult struct {
RuleID string // Rule ID from metadata
TestName string // Test case name
Passed bool // Whether test passed
Expected bool // Expected result
Actual bool // Actual result
Event map[string]interface{} // Test event data
Error error // Error if test execution failed
}
TestResult contains the result of executing a single test case
func (*TestResult) FormatTestResult ¶ added in v0.3.0
func (tr *TestResult) FormatTestResult() string
FormatTestResult returns a human-readable string for a single test result
type TestSummary ¶ added in v0.3.0
type TestSummary struct {
Total int // Total number of tests
Passed int // Number of tests that passed
Failed int // Number of tests that failed
Errors int // Number of tests that had execution errors
}
TestSummary contains statistics about test execution
func (*TestSummary) FormatTestSummary ¶ added in v0.3.0
func (s *TestSummary) FormatTestSummary() string
FormatTestSummary returns a human-readable summary of test results