Add Regal for linting Rego (#7038)

Hello CVAT friends! 👋😃

This PR introduces [Regal](https://github.com/styrainc/regal)) for
linting the Rego included in this project. The policy code here is
generally in a really good shape, so the linter did not have too much to
do. Good work on that!

Violations of a few rules were fixed as part of this PR, as they do not
change the semantics of evaluation:

* [line-length](https://docs.styra.com/regal/rules/style/line-length)
*
[unconditional-assignment](https://docs.styra.com/regal/rules/style/unconditional-assignment)
*
[use-assignment-operator](https://docs.styra.com/regal/rules/style/use-assignment-operator)

A few other ones were ignored using Regal's configuration file. Whether
some of them should be fixed in the future I'll leave up to the
project's maintainers.

I've also added Regal as a build workflow, along with some
documentation. Let me know if I missed anything!


Signed-off-by: Anders Eknert <anders@styra.com>

.github/workflows/regallint.yml

@@ -0,0 +1,12 @@
+name: Regal
+on: pull_request
+jobs:
+  Linter:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup Regal
+        uses: StyraInc/setup-regal@v0.2.0
+        with:
+          version: v0.11.0
+      - run: regal lint --format=github cvat/apps/iam/rules

cvat/apps/iam/rules/.regal/config.yaml

@@ -0,0 +1,33 @@
+ignore:
+  files:
+    - "*_test.gen.rego"
+rules:
+  custom:
+    naming-convention:
+      conventions:
+        - pattern: '^[a-z_]+$|^[A-Z_]+$'
+          targets:
+            - rule
+            - function
+            - variable
+      level: error
+  idiomatic:
+    no-defined-entrypoint:
+      # This would likely be the allow rule in each package
+      # Not critical though, so ignoring for the time being
+      level: ignore
+  style:
+    avoid-get-and-list-prefix:
+      # Mainly a style preference
+      # https://docs.styra.com/regal/rules/style/avoid-get-and-list-prefix
+      level: ignore
+    opa-fmt:
+      # https://docs.styra.com/regal/rules/style/opa-fmt
+      level: ignore
+    prefer-snake-case:
+      # Disabled in favor of custom naming-convention rule above
+      level: ignore
+    rule-length:
+      # Many rules longer than the default limit of 30 lines
+      level: error
+      max-rule-length: 60

cvat/apps/iam/rules/analytics.rego

@@ -23,7 +23,7 @@ import data.utils
 #     }
 # }
 
-default allow = false
+default allow := false
 
 allow {
     utils.is_admin

cvat/apps/iam/rules/analytics_reports.rego

@@ -22,7 +22,8 @@ import data.organizations
 #     }
 # }
 
-default allow = false
+default allow := false
+
 allow {
     utils.is_admin
 }

cvat/apps/iam/rules/annotationguides.rego

@@ -47,7 +47,7 @@ is_target_staff {
     is_target_assignee
 }
 
-default allow = false
+default allow := false
 
 allow {
     utils.is_admin

cvat/apps/iam/rules/cloudstorages.rego

@@ -26,7 +26,7 @@ import data.organizations
 #     }
 # }
 
-default allow = false
+default allow := false
 
 # Admin has no restrictions
 allow {
@@ -56,20 +56,20 @@ allow {
     organizations.is_member
 }
 
-filter = [] { # Django Q object to filter list of entries
+filter := [] { # Django Q object to filter list of entries
     utils.is_admin
     utils.is_sandbox
-} else = qobject {
+} else := qobject {
     utils.is_admin
     qobject := [ {"organization": input.auth.organization.id} ]
-} else = qobject {
+} else := qobject {
     utils.has_perm(utils.USER)
     organizations.has_perm(organizations.SUPERVISOR)
     qobject := [ {"organization": input.auth.organization.id} ]
-} else = qobject {
+} else := qobject {
     utils.is_sandbox
     qobject := [ {"owner": input.auth.user.id} ]
-} else = qobject {
+} else := qobject {
     utils.is_organization
     qobject := [ {"owner": input.auth.user.id}, {"organization": input.auth.organization.id}, "&" ]
 }

cvat/apps/iam/rules/comments.rego

@@ -121,7 +121,7 @@ is_comment_staff {
     is_comment_owner
 }
 
-default allow = false
+default allow := false
 
 allow {
     utils.is_admin
@@ -161,18 +161,18 @@ allow {
     organizations.is_member
 }
 
-filter = [] { # Django Q object to filter list of entries
+filter := [] { # Django Q object to filter list of entries
     utils.is_admin
     utils.is_sandbox
-} else = qobject {
+} else := qobject {
     utils.is_admin
     utils.is_organization
     org := input.auth.organization
     qobject := [
         {"issue__job__segment__task__organization": org.id},
         {"issue__job__segment__task__project__organization": org.id}, "|"
     ]
-} else = qobject {
+} else := qobject {
     utils.is_sandbox
     user := input.auth.user
     qobject := [
@@ -185,7 +185,7 @@ filter = [] { # Django Q object to filter list of entries
         {"issue__job__segment__task__project__owner": user.id}, "|",
         {"issue__job__segment__task__project__assignee": user.id}, "|"
     ]
-} else = qobject {
+} else := qobject {
     utils.is_organization
     utils.has_perm(utils.USER)
     organizations.has_perm(organizations.MAINTAINER)
@@ -194,7 +194,7 @@ filter = [] { # Django Q object to filter list of entries
         {"issue__job__segment__task__organization": org.id},
         {"issue__job__segment__task__project__organization": org.id}, "|"
     ]
-} else = qobject {
+} else := qobject {
     organizations.has_perm(organizations.WORKER)
     user := input.auth.user
     org := input.auth.organization

cvat/apps/iam/rules/conflicts.rego

@@ -42,7 +42,7 @@ import data.organizations
 #     }
 # }
 
-default allow = false
+default allow := false
 
 allow {
     utils.is_admin
@@ -58,10 +58,10 @@ allow {
     organizations.is_member
 }
 
-filter = [] { # Django Q object to filter list of entries
+filter := [] { # Django Q object to filter list of entries
     utils.is_admin
     utils.is_sandbox
-} else = qobject {
+} else := qobject {
     utils.is_admin
     utils.is_organization
     org := input.auth.organization
@@ -71,7 +71,7 @@ filter = [] { # Django Q object to filter list of entries
         {"report__task__organization": org.id}, "|",
         {"report__task__project__organization": org.id}, "|",
     ]
-} else = qobject {
+} else := qobject {
     utils.is_sandbox
     user := input.auth.user
     qobject := [
@@ -84,7 +84,7 @@ filter = [] { # Django Q object to filter list of entries
         {"report__task__project__owner_id": user.id}, "|",
         {"report__task__project__assignee_id": user.id}, "|",
     ]
-} else = qobject {
+} else := qobject {
     utils.is_organization
     utils.has_perm(utils.USER)
     organizations.has_perm(organizations.MAINTAINER)
@@ -95,7 +95,7 @@ filter = [] { # Django Q object to filter list of entries
         {"report__task__organization": org.id}, "|",
         {"report__task__project__organization": org.id}, "|",
     ]
-} else = qobject {
+} else := qobject {
     organizations.has_perm(organizations.WORKER)
     user := input.auth.user
     org := input.auth.organization

cvat/apps/iam/rules/events.rego

@@ -21,7 +21,7 @@ import data.organizations
 #     }
 # }
 
-default allow = false
+default allow := false
 
 allow {
     utils.is_admin
@@ -43,22 +43,22 @@ allow {
     organizations.has_perm(organizations.WORKER)
 }
 
-filter = [] {
+filter := [] {
     utils.is_admin
     utils.is_sandbox
-} else = qobject {
+} else := qobject {
     utils.is_admin
     utils.is_organization
     qobject := [ {"org_id": input.auth.organization.id} ]
-} else = qobject {
+} else := qobject {
     utils.is_sandbox
     qobject := [ {"user_id": input.auth.user.id} ]
-} else = qobject {
+} else := qobject {
     utils.is_organization
     utils.has_perm(utils.USER)
     organizations.has_perm(organizations.MAINTAINER)
     qobject := [ {"org_id": input.auth.organization.id} ]
-} else = qobject {
+} else := qobject {
     utils.is_organization
     utils.has_perm(utils.USER)
     organizations.has_perm(organizations.WORKER)

cvat/apps/iam/rules/invitations.rego

@@ -27,7 +27,8 @@ import data.organizations
 #     } or null,
 # }
 
-default allow = false
+default allow := false
+
 allow {
     utils.is_admin
 }
@@ -42,23 +43,23 @@ allow {
     organizations.is_member
 }
 
-filter = [] { # Django Q object to filter list of entries
+filter := [] { # Django Q object to filter list of entries
     utils.is_sandbox
     utils.is_admin
-} else = qobject {
+} else := qobject {
     utils.is_sandbox
     user := input.auth.user
     qobject := [ {"owner": user.id}, {"membership__user": user.id}, "|" ]
-} else = qobject {
+} else := qobject {
     utils.is_organization
     utils.is_admin
     qobject := [ {"membership__organization": input.auth.organization.id} ]
-} else = qobject {
+} else := qobject {
     utils.is_organization
     organizations.is_staff
     utils.has_perm(utils.USER)
     qobject := [ {"membership__organization": input.auth.organization.id} ]
-} else = qobject {
+} else := qobject {
     utils.is_organization
     user := input.auth.user
     org_id := input.auth.organization.id

cvat/apps/iam/rules/issues.rego

@@ -114,7 +114,7 @@ is_issue_staff {
     is_issue_assignee
 }
 
-default allow = false
+default allow := false
 
 allow {
     utils.is_admin
@@ -154,18 +154,18 @@ allow {
     organizations.is_member
 }
 
-filter = [] { # Django Q object to filter list of entries
+filter := [] { # Django Q object to filter list of entries
     utils.is_admin
     utils.is_sandbox
-} else = qobject {
+} else := qobject {
     utils.is_admin
     utils.is_organization
     org := input.auth.organization
     qobject := [
         {"job__segment__task__organization": org.id},
         {"job__segment__task__project__organization": org.id}, "|"
     ]
-} else = qobject {
+} else := qobject {
     utils.is_sandbox
     user := input.auth.user
     qobject := [
@@ -176,7 +176,7 @@ filter = [] { # Django Q object to filter list of entries
         {"job__segment__task__project__owner": user.id}, "|",
         {"job__segment__task__project__assignee": user.id}, "|"
     ]
-} else = qobject {
+} else := qobject {
     utils.is_organization
     utils.has_perm(utils.USER)
     organizations.has_perm(organizations.MAINTAINER)
@@ -185,7 +185,7 @@ filter = [] { # Django Q object to filter list of entries
         {"job__segment__task__organization": org.id},
         {"job__segment__task__project__organization": org.id}, "|"
     ]
-} else = qobject {
+} else := qobject {
     organizations.has_perm(organizations.WORKER)
     user := input.auth.user
     org := input.auth.organization

cvat/apps/iam/rules/jobs.rego

@@ -84,7 +84,7 @@ is_job_staff {
     is_job_assignee
 }
 
-default allow = false
+default allow := false
 
 allow {
     utils.is_admin
@@ -101,16 +101,16 @@ allow {
 }
 
 
-filter = [] { # Django Q object to filter list of entries
+filter := [] { # Django Q object to filter list of entries
     utils.is_admin
     utils.is_sandbox
-} else = qobject {
+} else := qobject {
     utils.is_admin
     utils.is_organization
     qobject := [
         {"segment__task__organization": input.auth.organization.id},
         {"segment__task__project__organization": input.auth.organization.id}, "|" ]
-} else = qobject {
+} else := qobject {
     utils.is_sandbox
     user := input.auth.user
     qobject := [
@@ -119,14 +119,14 @@ filter = [] { # Django Q object to filter list of entries
         {"segment__task__assignee_id": user.id}, "|",
         {"segment__task__project__owner_id": user.id}, "|",
         {"segment__task__project__assignee_id": user.id}, "|"]
-} else = qobject {
+} else := qobject {
     utils.is_organization
     utils.has_perm(utils.USER)
     organizations.has_perm(organizations.MAINTAINER)
     qobject := [
         {"segment__task__organization": input.auth.organization.id},
         {"segment__task__project__organization": input.auth.organization.id}, "|"]
-} else = qobject {
+} else := qobject {
     organizations.has_perm(organizations.WORKER)
     user := input.auth.user
     qobject := [