From c432a59569a0a608a19eed4da99ecc3db386b682 Mon Sep 17 00:00:00 2001 From: Shiju Date: Fri, 7 Aug 2026 21:01:49 +0530 Subject: [PATCH] perf(supervisor-network): avoid reparsing native policy input Convert the existing Serde JSON policy input directly into Regorus. Preserve conversion errors while avoiding JSON string allocation and parsing. Signed-off-by: Shiju --- crates/openshell-supervisor-network/src/l7/relay.rs | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/crates/openshell-supervisor-network/src/l7/relay.rs b/crates/openshell-supervisor-network/src/l7/relay.rs index fa2eab4ad7..4df2bfb92e 100644 --- a/crates/openshell-supervisor-network/src/l7/relay.rs +++ b/crates/openshell-supervisor-network/src/l7/relay.rs @@ -1929,7 +1929,7 @@ fn evaluate_l7_request_once( )); } - let input_json = serde_json::json!({ + let input = serde_json::json!({ "network": { "host": ctx.host, "port": ctx.port, @@ -1953,9 +1953,10 @@ fn evaluate_l7_request_once( .lock() .map_err(|_| miette!("OPA engine lock poisoned"))?; - engine - .set_input_json(&input_json.to_string()) - .map_err(|e| miette!("{e}"))?; + // Regorus's infallible `From` maps conversion errors to `Undefined`. + // Convert fallibly so failures remain evaluator errors instead of becoming policy input. + let input = serde_json::from_value::(input).map_err(|e| miette!("{e}"))?; + engine.set_input(input); let allowed = engine .eval_rule("data.openshell.sandbox.allow_request".into())