feat(azure-policy): add policy rule and policy definition parsers by anakrish · Pull Request #660 · microsoft/regorus

anakrish · 2026-04-04T15:03:26Z

Extend the Azure Policy parser to handle complete policyRule and
policyDefinition JSON structures, not just standalone constraints.

Policy rule parser (policy_rule.rs):

Parse top-level { "if": ..., "then": ... } objects
Extract effect kind (deny, audit, append, modify, etc.) into typed AST
Parse "details" structurally when it's an object to pull out
existenceCondition as a first-class Constraint; fall back to opaque
JSON for non-object details (e.g. append's array form)
Detect duplicate/missing keys for "if", "then", "effect", "details"

Policy definition parser (policy_definition.rs):

Handle both wrapped ARM envelope ({ "properties": { ... } }) and
unwrapped (properties-level keys at top level) forms
Type-extract displayName, description, mode, metadata, parameters,
and policyRule; everything else goes into extra
Parse parameter definitions with type, defaultValue, allowedValues,
and metadata; detect duplicate parameter names
Duplicate key detection throughout

Grammar documentation (docs/azure-policy/azurepolicy.ebnf):

Add formal EBNF grammar covering policy-rule, then-block,
constraints, conditions, all 20 operators, count expressions,
JSON values, and ARM template expressions

Test harness changes:

Add parse_level field to YAML test cases: "constraint" (default),
"policy_rule", or "policy_definition"
Un-skip three parse_errors cases that needed policy_rule-level parsing
Add policy_rule.yaml with 12 cases covering all 9 effect kinds,
existenceCondition, parameterized effects, complex conditions, and
extra key handling
Add policy_definition.yaml with wrapped, unwrapped, parameterized,
and missing-policyRule error cases

Copilot

Pull request overview

Adds new Azure Policy parsing entry points for full policyRule and full policy definition envelopes, extending the existing constraint-only parser and broadening the YAML-driven test harness to run at different parse “levels”.

Changes:

Introduce parse_policy_rule() (top-level "if" + "then", effect handling, existenceCondition extraction).
Introduce parse_policy_definition() (wrapped/unwrapped envelope handling, parameter definitions, policyRule parsing).
Extend YAML test harness with parse_level and add new test suites for policy rules/definitions.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
tests/azure_policy/parser_tests/mod.rs	Adds `parse_level` switching to run tests against constraint/policy_rule/policy_definition parsers.
tests/azure_policy/parser_tests/cases/policy_rule.yaml	New YAML cases exercising full `policyRule` parsing.
tests/azure_policy/parser_tests/cases/policy_definition.yaml	New YAML cases exercising full policy definition envelope parsing.
tests/azure_policy/parser_tests/cases/parse_errors.yaml	Un-skips policy_rule-level error cases by switching them to `parse_level: policy_rule`.
src/languages/azure_policy/parser/policy_rule.rs	New policy rule + then-block parser and existenceCondition extraction.
src/languages/azure_policy/parser/policy_definition.rs	New policy definition parser plus JSON re-serialization helpers for reparsing `policyRule`.
src/languages/azure_policy/parser/mod.rs	Exposes new public APIs and updates module docs.
src/languages/azure_policy/ast/mod.rs	Updates `EffectKind::Other` to carry a string payload; updates parameter doc comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

tests/azure_policy/parser_tests/mod.rs

src/languages/azure_policy/parser/policy_rule.rs

src/languages/azure_policy/parser/policy_definition.rs

src/languages/azure_policy/ast/mod.rs

src/languages/azure_policy/parser/mod.rs

src/languages/azure_policy/parser/policy_rule.rs

src/languages/azure_policy/parser/policy_definition.rs

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 7 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

src/languages/azure_policy/parser/mod.rs

src/languages/azure_policy/parser/policy_definition.rs

src/languages/azure_policy/parser/policy_rule.rs

tests/azure_policy/parser_tests/mod.rs

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

src/languages/azure_policy/parser/policy_rule.rs

src/languages/azure_policy/parser/policy_definition.rs

src/languages/azure_policy/ast/mod.rs

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

src/languages/azure_policy/parser/policy_definition.rs

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

src/languages/azure_policy/parser/policy_definition.rs

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

src/languages/azure_policy/parser/policy_definition.rs

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

src/languages/azure_policy/parser/policy_definition.rs

Copilot

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

docs/azure-policy/azurepolicy.ebnf

Copilot

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

src/languages/azure_policy/parser/policy_definition.rs

docs/azure-policy/azurepolicy.ebnf

Copilot

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-05T16:09:40Z

tests/azure_policy/parser_tests/mod.rs

+                let constraint_json =
+                    extract_if_json(&policy_rule_json).unwrap_or_else(|| policy_rule_json.clone());


In the constraint parse_level branch, unwrap_or_else(|| policy_rule_json.clone()) clones the entire JSON string on the fallback path. This can be avoided by restructuring to move policy_rule_json into constraint_json when extraction fails (e.g., using a match on extract_if_json(...)) so the error-path tests don’t pay an extra allocation for large inputs.

Suggested change

let constraint_json =

extract_if_json(&policy_rule_json).unwrap_or_else(|| policy_rule_json.clone());

let constraint_json = match extract_if_json(&policy_rule_json) {

Some(constraint_json) => constraint_json,

None => policy_rule_json,

};

Copilot

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-05T16:23:28Z

src/languages/azure_policy/parser/policy_definition.rs

+        self.expect_symbol("{")?;
+
+        let mut seen_keys: Vec<String> = Vec::new();
+


parse_properties_fields creates a fresh seen_keys list, so duplicate detection for recognized properties (e.g., displayName, mode, policyRule, parameters) does not apply across the outer object and the inner properties object. If a wrapped ARM envelope contains a recognized key before properties (or inside extra) and the same key appears inside properties, the later parse will overwrite the earlier typed field without producing ParseError::DuplicateKey, contradicting “duplicate key detection throughout”. Consider sharing a single case-insensitive seen_keys set between the outer loop and parse_properties_fields (or explicitly rejecting/extra-ifying recognized keys once properties is detected) so cross-scope duplicates can’t silently overwrite.

Copilot

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

src/languages/azure_policy/parser/policy_definition.rs

tests/azure_policy/parser_tests/mod.rs

Copilot

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Extend the Azure Policy parser to handle complete policyRule and policyDefinition JSON structures, not just standalone constraints. Policy rule parser (policy_rule.rs): - Parse top-level { "if": ..., "then": ... } objects - Extract effect kind (deny, audit, append, modify, etc.) into typed AST - Parse "details" structurally when it is an object to pull out existenceCondition as a first-class Constraint; fall back to opaque JSON for non-object details (e.g. append array form) - Detect duplicate/missing keys for "if", "then", "effect", "details" Policy definition parser (policy_definition.rs): - Handle both wrapped ARM envelope ({ "properties": { ... } }) and unwrapped (properties-level keys at top level) forms - Type-extract displayName, description, mode, metadata, parameters, and policyRule; everything else goes into extra - Parse parameter definitions with type, defaultValue, allowedValues, and metadata; detect duplicate parameter names - Duplicate key detection throughout Grammar documentation (docs/azure-policy/azurepolicy.ebnf): - Add formal EBNF grammar covering policy-rule, then-block, constraints, conditions, all 19 operators, count expressions, JSON values, and ARM template expressions Test harness changes: - Add parse_level field to YAML test cases: "constraint" (default), "policy_rule", or "policy_definition" - Un-skip three parse_errors cases that needed policy_rule-level parsing - Add policy_rule.yaml with 12 cases covering all 9 effect kinds, existenceCondition, parameterized effects, complex conditions, and extra key handling - Add policy_definition.yaml with wrapped, unwrapped, parameterized, missing-policyRule, and duplicate-key error cases

Copilot

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

src/languages/azure_policy/parser/mod.rs

anakrish requested a review from Copilot April 4, 2026 15:54

Copilot started reviewing on behalf of anakrish April 4, 2026 15:54 View session

Copilot AI reviewed Apr 4, 2026

View reviewed changes

anakrish force-pushed the azure-policy-parser branch 2 times, most recently from a20db77 to 270f8b6 Compare April 4, 2026 18:42

anakrish requested a review from Copilot April 4, 2026 19:49

Copilot started reviewing on behalf of anakrish April 4, 2026 19:50 View session

Copilot AI reviewed Apr 4, 2026

View reviewed changes

anakrish force-pushed the azure-policy-parser branch from 270f8b6 to d69f24c Compare April 4, 2026 20:20

anakrish requested a review from Copilot April 4, 2026 20:50

Copilot started reviewing on behalf of anakrish April 4, 2026 20:51 View session

Copilot AI reviewed Apr 4, 2026

View reviewed changes

src/languages/azure_policy/parser/policy_rule.rs Outdated Show resolved Hide resolved

src/languages/azure_policy/parser/policy_definition.rs Outdated Show resolved Hide resolved

src/languages/azure_policy/ast/mod.rs Show resolved Hide resolved

anakrish force-pushed the azure-policy-parser branch from d69f24c to 77cca59 Compare April 4, 2026 21:22

anakrish requested a review from Copilot April 4, 2026 21:34

Copilot started reviewing on behalf of anakrish April 4, 2026 21:35 View session

Copilot AI reviewed Apr 4, 2026

View reviewed changes

src/languages/azure_policy/parser/policy_definition.rs Show resolved Hide resolved

src/languages/azure_policy/parser/policy_definition.rs Outdated Show resolved Hide resolved

anakrish force-pushed the azure-policy-parser branch from 77cca59 to 7c5eddd Compare April 4, 2026 22:04

anakrish requested a review from Copilot April 4, 2026 22:13

Copilot started reviewing on behalf of anakrish April 4, 2026 22:14 View session

Copilot AI reviewed Apr 4, 2026

View reviewed changes

src/languages/azure_policy/parser/policy_definition.rs Outdated Show resolved Hide resolved

src/languages/azure_policy/parser/policy_definition.rs Outdated Show resolved Hide resolved

src/languages/azure_policy/parser/policy_definition.rs Show resolved Hide resolved

anakrish force-pushed the azure-policy-parser branch from 7c5eddd to 99c9eaf Compare April 4, 2026 23:07

anakrish requested a review from Copilot April 4, 2026 23:15

Copilot started reviewing on behalf of anakrish April 4, 2026 23:16 View session

Copilot AI reviewed Apr 4, 2026

View reviewed changes

src/languages/azure_policy/parser/policy_definition.rs Outdated Show resolved Hide resolved

anakrish force-pushed the azure-policy-parser branch from 99c9eaf to 2afcc6e Compare April 4, 2026 23:36

anakrish requested a review from Copilot April 4, 2026 23:42

Copilot started reviewing on behalf of anakrish April 4, 2026 23:43 View session

Copilot AI reviewed Apr 4, 2026

View reviewed changes

src/languages/azure_policy/parser/policy_definition.rs Show resolved Hide resolved

anakrish requested a review from Copilot April 4, 2026 23:49

Copilot started reviewing on behalf of anakrish April 4, 2026 23:50 View session

anakrish force-pushed the azure-policy-parser branch 2 times, most recently from 4b4118e to 949ca8a Compare April 5, 2026 02:47

anakrish requested a review from Copilot April 5, 2026 02:49

Copilot started reviewing on behalf of anakrish April 5, 2026 02:49 View session

Copilot AI reviewed Apr 5, 2026

View reviewed changes

docs/azure-policy/azurepolicy.ebnf Show resolved Hide resolved

anakrish force-pushed the azure-policy-parser branch from 949ca8a to f36aab3 Compare April 5, 2026 03:15

anakrish requested a review from Copilot April 5, 2026 03:16

Copilot AI reviewed Apr 5, 2026

View reviewed changes

src/languages/azure_policy/parser/policy_definition.rs Show resolved Hide resolved

docs/azure-policy/azurepolicy.ebnf Outdated Show resolved Hide resolved

docs/azure-policy/azurepolicy.ebnf Show resolved Hide resolved

anakrish force-pushed the azure-policy-parser branch from f36aab3 to 00f00d6 Compare April 5, 2026 14:36

anakrish requested a review from Copilot April 5, 2026 15:09

Copilot started reviewing on behalf of anakrish April 5, 2026 15:10 View session

Copilot AI reviewed Apr 5, 2026

View reviewed changes

anakrish requested a review from Copilot April 5, 2026 16:06

Copilot started reviewing on behalf of anakrish April 5, 2026 16:07 View session

Copilot AI reviewed Apr 5, 2026

View reviewed changes

anakrish requested a review from Copilot April 5, 2026 16:19

Copilot started reviewing on behalf of anakrish April 5, 2026 16:20 View session

Copilot AI reviewed Apr 5, 2026

View reviewed changes

anakrish requested a review from Copilot April 5, 2026 16:50

Copilot started reviewing on behalf of anakrish April 5, 2026 16:50 View session

anakrish force-pushed the azure-policy-parser branch from 00f00d6 to 4a25982 Compare April 5, 2026 16:52

Copilot AI reviewed Apr 5, 2026

View reviewed changes

src/languages/azure_policy/parser/policy_definition.rs Show resolved Hide resolved

tests/azure_policy/parser_tests/mod.rs Outdated Show resolved Hide resolved

anakrish requested a review from Copilot April 5, 2026 17:02

Copilot started reviewing on behalf of anakrish April 5, 2026 17:03 View session

Copilot AI reviewed Apr 5, 2026

View reviewed changes

anakrish force-pushed the azure-policy-parser branch from 4a25982 to 7219f55 Compare April 5, 2026 17:35

anakrish requested a review from Copilot April 5, 2026 17:36

Copilot started reviewing on behalf of anakrish April 5, 2026 17:37 View session

Copilot AI reviewed Apr 5, 2026

View reviewed changes

src/languages/azure_policy/parser/mod.rs Show resolved Hide resolved

		let constraint_json =
		extract_if_json(&policy_rule_json).unwrap_or_else(\|\| policy_rule_json.clone());

-                let constraint_json =
-                    extract_if_json(&policy_rule_json).unwrap_or_else(|| policy_rule_json.clone());
+                let constraint_json = match extract_if_json(&policy_rule_json) {
+                    Some(constraint_json) => constraint_json,
+                    None => policy_rule_json,
+                };

		self.expect_symbol("{")?;

		let mut seen_keys: Vec<String> = Vec::new();

Conversation

anakrish commented Apr 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

anakrish commented Apr 4, 2026 •

edited

Loading