Skip to content

Commit 20dc20b

Browse files
jaronoff97jaronoff97
authored
Merge pull request #14 from usetero/jacob/eng-131-create-cloudformation-script
feat: create cloudformation script
2 parents c817f4e + 635da71 commit 20dc20b

6 files changed

Lines changed: 589 additions & 80 deletions

File tree

‎bottlecap/Cargo.lock‎

Lines changed: 3 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎bottlecap/Cargo.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ mime = { version = "0.3", default-features = false }
2323
multipart = { version = "0.18", default-features = false, features = ["server"] }
2424
nix = { version = "0.26", default-features = false, features = ["feature", "fs"] }
2525
ordered_hash_map = { version = "0.4", default-features = false }
26-
policy-rs = { version = "1.1.3", features = ["http", "grpc"] }
26+
policy-rs = { version = "1.2.0", features = ["http", "grpc"] }
2727
regex = { version = "1.10", default-features = false }
2828
reqwest = { version = "0.12.11", features = ["json", "http2"], default-features = false }
2929
serde = { version = "1.0", default-features = false, features = ["derive"] }

‎bottlecap/src/bin/bottlecap/main.rs‎

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -105,7 +105,7 @@ use std::{collections::hash_map, env, path::Path, str::FromStr, sync::Arc};
105105
use tokio::time::{Duration, Instant};
106106
use tokio::{sync::Mutex as TokioMutex, sync::mpsc::Sender, task::JoinHandle};
107107
use tokio_util::sync::CancellationToken;
108-
use tracing::{debug, error, warn};
108+
use tracing::{debug, error, info, warn};
109109
use tracing_subscriber::EnvFilter;
110110
use ustr::Ustr;
111111

@@ -605,11 +605,17 @@ async fn extension_loop_active(
605605
if let Err(e) = registry.subscribe(&provider) {
606606
error!("POLICY | Failed to subscribe provider {}: {}", id, e);
607607
} else {
608-
debug!("POLICY | Registered HTTP provider: {}", id);
608+
info!(
609+
"POLICY | Successfully synced with Tero control plane (provider: {}, url: {})",
610+
id, url
611+
);
609612
}
610613
}
611614
Err(e) => {
612-
error!("POLICY | Failed to create HTTP provider {}: {}", id, e);
615+
error!(
616+
"POLICY | Failed to sync with Tero control plane (provider: {}): {}",
617+
id, e
618+
);
613619
}
614620
}
615621
}
@@ -618,12 +624,15 @@ async fn extension_loop_active(
618624
if let Err(e) = registry.subscribe(&provider) {
619625
error!("POLICY | Failed to subscribe provider {}: {}", id, e);
620626
} else {
621-
debug!("POLICY | Registered File provider: {}", id);
627+
info!("POLICY | Registered file provider: {} (path: {})", id, path);
622628
}
623629
}
624630
}
625631
}
626-
debug!("POLICY | Registered {} policy providers", providers.len());
632+
info!(
633+
"POLICY | Tero policy evaluation enabled with {} provider(s)",
634+
providers.len()
635+
);
627636
}
628637

629638
Some(Arc::new(PolicyEvaluator::new(registry)))

‎bottlecap/src/policy/evaluator.rs‎

Lines changed: 63 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -44,29 +44,41 @@ impl PolicyEvaluator {
4444
/// - `RateLimit`: Keep based on rate limit decision
4545
pub async fn should_keep<M: Matchable>(&self, item: &M) -> bool {
4646
let snapshot = self.registry.snapshot();
47+
let policy_count = snapshot.len();
48+
49+
debug!("POLICY | Evaluating item against {} policies", policy_count);
4750

4851
match self.engine.evaluate(&snapshot, item).await {
49-
Ok(result) => match result {
50-
EvaluateResult::NoMatch | EvaluateResult::Keep { .. } => true,
51-
EvaluateResult::Drop { .. } => {
52-
debug!("POLICY | Dropping item due to policy");
53-
false
54-
}
55-
EvaluateResult::Sample {
56-
keep, percentage, ..
57-
} => {
58-
if !keep {
59-
debug!("POLICY | Dropping item due to sampling ({}%)", percentage);
52+
Ok(result) => {
53+
debug!("POLICY | Evaluation result: {:?}", result);
54+
match result {
55+
EvaluateResult::NoMatch => {
56+
debug!("POLICY | No matching policy, keeping item");
57+
true
6058
}
61-
keep
62-
}
63-
EvaluateResult::RateLimit { allowed, .. } => {
64-
if !allowed {
65-
debug!("POLICY | Dropping item due to rate limit");
59+
EvaluateResult::Keep { .. } => {
60+
debug!("POLICY | Policy matched, keeping item");
61+
true
62+
}
63+
EvaluateResult::Drop { .. } => {
64+
debug!("POLICY | Dropping item due to policy");
65+
false
66+
}
67+
EvaluateResult::Sample {
68+
keep, percentage, ..
69+
} => {
70+
debug!(
71+
"POLICY | Sampling decision: keep={}, percentage={}%",
72+
keep, percentage
73+
);
74+
keep
75+
}
76+
EvaluateResult::RateLimit { allowed, .. } => {
77+
debug!("POLICY | Rate limit decision: allowed={}", allowed);
78+
allowed
6679
}
67-
allowed
6880
}
69-
},
81+
}
7082
Err(e) => {
7183
// Fail open: keep the item if evaluation fails
7284
warn!("POLICY | Evaluation error, keeping item: {}", e);
@@ -84,29 +96,44 @@ impl PolicyEvaluator {
8496
#[must_use]
8597
pub fn should_keep_sync<M: Matchable>(&self, item: &M) -> bool {
8698
let snapshot = self.registry.snapshot();
99+
let policy_count = snapshot.len();
100+
101+
debug!(
102+
"POLICY | Evaluating item (sync) against {} policies",
103+
policy_count
104+
);
87105

88106
match futures::executor::block_on(self.engine.evaluate(&snapshot, item)) {
89-
Ok(result) => match result {
90-
EvaluateResult::NoMatch | EvaluateResult::Keep { .. } => true,
91-
EvaluateResult::Drop { .. } => {
92-
debug!("POLICY | Dropping item due to policy");
93-
false
94-
}
95-
EvaluateResult::Sample {
96-
keep, percentage, ..
97-
} => {
98-
if !keep {
99-
debug!("POLICY | Dropping item due to sampling ({}%)", percentage);
107+
Ok(result) => {
108+
debug!("POLICY | Evaluation result: {:?}", result);
109+
match result {
110+
EvaluateResult::NoMatch => {
111+
debug!("POLICY | No matching policy, keeping item");
112+
true
100113
}
101-
keep
102-
}
103-
EvaluateResult::RateLimit { allowed, .. } => {
104-
if !allowed {
105-
debug!("POLICY | Dropping item due to rate limit");
114+
EvaluateResult::Keep { .. } => {
115+
debug!("POLICY | Policy matched, keeping item");
116+
true
117+
}
118+
EvaluateResult::Drop { .. } => {
119+
debug!("POLICY | Dropping item due to policy");
120+
false
121+
}
122+
EvaluateResult::Sample {
123+
keep, percentage, ..
124+
} => {
125+
debug!(
126+
"POLICY | Sampling decision: keep={}, percentage={}%",
127+
keep, percentage
128+
);
129+
keep
130+
}
131+
EvaluateResult::RateLimit { allowed, .. } => {
132+
debug!("POLICY | Rate limit decision: allowed={}", allowed);
133+
allowed
106134
}
107-
allowed
108135
}
109-
},
136+
}
110137
Err(e) => {
111138
// Fail open: keep the item if evaluation fails
112139
warn!("POLICY | Evaluation error, keeping item: {}", e);

0 commit comments

Comments
 (0)