policy: allow array.flatten and template strings

Enable new builtins from OPA v1.14. The template_strings parser
feature was already active via ast.Features, but evaluating the
$"..." syntax also requires the internal.template_string builtin
to be present in the capabilities allowlist.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>

policy/builtins.go

@@ -55,6 +55,7 @@ func builtins() []*ast.Builtin {
 
 		// Arrays
 		ast.ArrayConcat,
+		ast.ArrayFlatten,
 		ast.ArraySlice,
 		ast.ArrayReverse,
 
@@ -196,6 +197,9 @@ func builtins() []*ast.Builtin {
 		// Printing
 		ast.Print,
 		ast.InternalPrint,
+
+		// Internal implementation for template strings.
+		ast.InternalTemplateString,
 	}
 	return b
 }

policy/validate_test.go

@@ -917,6 +917,35 @@ decision := {
 	}, caps)
 }
 
+func TestPolicyOPA114Builtins(t *testing.T) {
+	p := NewPolicy(Opt{
+		Files: []File{{
+			Filename: "policy.rego",
+			Data: []byte(`
+package docker
+
+segments := array.flatten([["exec"], ["proxy"]])
+
+decision := {
+	"allow": true,
+	"caps": {
+		"exec.proxy": true,
+	},
+} if {
+	msg := $"execute {segments[0]}.{segments[1]}"
+	msg == "execute exec.proxy"
+}
+`),
+		}},
+	})
+
+	caps, err := p.CheckCaps(context.Background())
+	require.NoError(t, err)
+	require.Equal(t, Caps{
+		CapExecProxy: true,
+	}, caps)
+}
+
 func TestCheckCapsMalformedCaps(t *testing.T) {
 	p := NewPolicy(Opt{
 		Files: []File{{