update

Signed-off-by: hongming <talonwan@yunify.com>

vendor/github.com/open-policy-agent/opa/storage/inmem/index.go

@@ -0,0 +1,350 @@
+// Copyright 2016 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package inmem
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"hash/fnv"
+	"strings"
+	"sync"
+
+	"github.com/open-policy-agent/opa/ast"
+	"github.com/open-policy-agent/opa/storage"
+	"github.com/open-policy-agent/opa/util"
+)
+
+// indices contains a mapping of non-ground references to values to sets of bindings.
+//
+//  +------+------------------------------------+
+//  | ref1 | val1 | bindings-1, bindings-2, ... |
+//  |      +------+-----------------------------+
+//  |      | val2 | bindings-m, bindings-m, ... |
+//  |      +------+-----------------------------+
+//  |      | .... | ...                         |
+//  +------+------+-----------------------------+
+//  | ref2 | .... | ...                         |
+//  +------+------+-----------------------------+
+//  | ...                                       |
+//  +-------------------------------------------+
+//
+// The "value" is the data value stored at the location referred to by the ground
+// reference obtained by plugging bindings into the non-ground reference that is the
+// index key.
+//
+type indices struct {
+	mu    sync.Mutex
+	table map[int]*indicesNode
+}
+
+type indicesNode struct {
+	key  ast.Ref
+	val  *bindingIndex
+	next *indicesNode
+}
+
+func newIndices() *indices {
+	return &indices{
+		table: map[int]*indicesNode{},
+	}
+}
+
+func (ind *indices) Build(ctx context.Context, store storage.Store, txn storage.Transaction, ref ast.Ref) (*bindingIndex, error) {
+
+	ind.mu.Lock()
+	defer ind.mu.Unlock()
+
+	if exist := ind.get(ref); exist != nil {
+		return exist, nil
+	}
+
+	index := newBindingIndex()
+
+	if err := iterStorage(ctx, store, txn, ref, ast.EmptyRef(), ast.NewValueMap(), index.Add); err != nil {
+		return nil, err
+	}
+
+	hashCode := ref.Hash()
+	head := ind.table[hashCode]
+	entry := &indicesNode{
+		key:  ref,
+		val:  index,
+		next: head,
+	}
+
+	ind.table[hashCode] = entry
+
+	return index, nil
+}
+
+func (ind *indices) get(ref ast.Ref) *bindingIndex {
+	node := ind.getNode(ref)
+	if node != nil {
+		return node.val
+	}
+	return nil
+}
+
+func (ind *indices) iter(iter func(ast.Ref, *bindingIndex) error) error {
+	for _, head := range ind.table {
+		for entry := head; entry != nil; entry = entry.next {
+			if err := iter(entry.key, entry.val); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func (ind *indices) getNode(ref ast.Ref) *indicesNode {
+	hashCode := ref.Hash()
+	for entry := ind.table[hashCode]; entry != nil; entry = entry.next {
+		if entry.key.Equal(ref) {
+			return entry
+		}
+	}
+	return nil
+}
+
+func (ind *indices) String() string {
+	buf := []string{}
+	for _, head := range ind.table {
+		for entry := head; entry != nil; entry = entry.next {
+			str := fmt.Sprintf("%v: %v", entry.key, entry.val)
+			buf = append(buf, str)
+		}
+	}
+	return "{" + strings.Join(buf, ", ") + "}"
+}
+
+// bindingIndex contains a mapping of values to bindings.
+type bindingIndex struct {
+	table map[int]*indexNode
+}
+
+type indexNode struct {
+	key  interface{}
+	val  *bindingSet
+	next *indexNode
+}
+
+func newBindingIndex() *bindingIndex {
+	return &bindingIndex{
+		table: map[int]*indexNode{},
+	}
+}
+
+func (ind *bindingIndex) Add(val interface{}, bindings *ast.ValueMap) {
+
+	node := ind.getNode(val)
+	if node != nil {
+		node.val.Add(bindings)
+		return
+	}
+
+	hashCode := hash(val)
+	bindingsSet := newBindingSet()
+	bindingsSet.Add(bindings)
+
+	entry := &indexNode{
+		key:  val,
+		val:  bindingsSet,
+		next: ind.table[hashCode],
+	}
+
+	ind.table[hashCode] = entry
+}
+
+func (ind *bindingIndex) Lookup(_ context.Context, _ storage.Transaction, val interface{}, iter storage.IndexIterator) error {
+	node := ind.getNode(val)
+	if node == nil {
+		return nil
+	}
+	return node.val.Iter(iter)
+}
+
+func (ind *bindingIndex) getNode(val interface{}) *indexNode {
+	hashCode := hash(val)
+	head := ind.table[hashCode]
+	for entry := head; entry != nil; entry = entry.next {
+		if util.Compare(entry.key, val) == 0 {
+			return entry
+		}
+	}
+	return nil
+}
+
+func (ind *bindingIndex) String() string {
+
+	buf := []string{}
+
+	for _, head := range ind.table {
+		for entry := head; entry != nil; entry = entry.next {
+			str := fmt.Sprintf("%v: %v", entry.key, entry.val)
+			buf = append(buf, str)
+		}
+	}
+
+	return "{" + strings.Join(buf, ", ") + "}"
+}
+
+type bindingSetNode struct {
+	val  *ast.ValueMap
+	next *bindingSetNode
+}
+
+type bindingSet struct {
+	table map[int]*bindingSetNode
+}
+
+func newBindingSet() *bindingSet {
+	return &bindingSet{
+		table: map[int]*bindingSetNode{},
+	}
+}
+
+func (set *bindingSet) Add(val *ast.ValueMap) {
+	node := set.getNode(val)
+	if node != nil {
+		return
+	}
+	hashCode := val.Hash()
+	head := set.table[hashCode]
+	set.table[hashCode] = &bindingSetNode{val, head}
+}
+
+func (set *bindingSet) Iter(iter func(*ast.ValueMap) error) error {
+	for _, head := range set.table {
+		for entry := head; entry != nil; entry = entry.next {
+			if err := iter(entry.val); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func (set *bindingSet) String() string {
+	buf := []string{}
+	set.Iter(func(bindings *ast.ValueMap) error {
+		buf = append(buf, bindings.String())
+		return nil
+	})
+	return "{" + strings.Join(buf, ", ") + "}"
+}
+
+func (set *bindingSet) getNode(val *ast.ValueMap) *bindingSetNode {
+	hashCode := val.Hash()
+	for entry := set.table[hashCode]; entry != nil; entry = entry.next {
+		if entry.val.Equal(val) {
+			return entry
+		}
+	}
+	return nil
+}
+
+func hash(v interface{}) int {
+	switch v := v.(type) {
+	case []interface{}:
+		var h int
+		for _, e := range v {
+			h += hash(e)
+		}
+		return h
+	case map[string]interface{}:
+		var h int
+		for k, v := range v {
+			h += hash(k) + hash(v)
+		}
+		return h
+	case string:
+		h := fnv.New64a()
+		h.Write([]byte(v))
+		return int(h.Sum64())
+	case bool:
+		if v {
+			return 1
+		}
+		return 0
+	case nil:
+		return 0
+	case json.Number:
+		h := fnv.New64a()
+		h.Write([]byte(v))
+		return int(h.Sum64())
+	}
+	panic(fmt.Sprintf("illegal argument: %v (%T)", v, v))
+}
+
+func iterStorage(ctx context.Context, store storage.Store, txn storage.Transaction, nonGround, ground ast.Ref, bindings *ast.ValueMap, iter func(interface{}, *ast.ValueMap)) error {
+
+	if len(nonGround) == 0 {
+		path, err := storage.NewPathForRef(ground)
+		if err != nil {
+			return err
+		}
+		node, err := store.Read(ctx, txn, path)
+		if err != nil {
+			if storage.IsNotFound(err) {
+				return nil
+			}
+			return err
+		}
+		iter(node, bindings)
+		return nil
+	}
+
+	head := nonGround[0]
+	tail := nonGround[1:]
+
+	headVar, isVar := head.Value.(ast.Var)
+
+	if !isVar || len(ground) == 0 {
+		ground = append(ground, head)
+		return iterStorage(ctx, store, txn, tail, ground, bindings, iter)
+	}
+
+	path, err := storage.NewPathForRef(ground)
+	if err != nil {
+		return err
+	}
+
+	node, err := store.Read(ctx, txn, path)
+	if err != nil {
+		if storage.IsNotFound(err) {
+			return nil
+		}
+		return err
+	}
+
+	switch node := node.(type) {
+	case map[string]interface{}:
+		for key := range node {
+			ground = append(ground, ast.StringTerm(key))
+			cpy := bindings.Copy()
+			cpy.Put(headVar, ast.String(key))
+			err := iterStorage(ctx, store, txn, tail, ground, cpy, iter)
+			if err != nil {
+				return err
+			}
+			ground = ground[:len(ground)-1]
+		}
+	case []interface{}:
+		for i := range node {
+			idx := ast.IntNumberTerm(i)
+			ground = append(ground, idx)
+			cpy := bindings.Copy()
+			cpy.Put(headVar, idx.Value)
+			err := iterStorage(ctx, store, txn, tail, ground, cpy, iter)
+			if err != nil {
+				return err
+			}
+			ground = ground[:len(ground)-1]
+		}
+	}
+
+	return nil
+}

vendor/github.com/open-policy-agent/opa/storage/inmem/inmem.go

@@ -0,0 +1,287 @@
+// Copyright 2016 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+// Package inmem implements an in-memory version of the policy engine's storage
+// layer.
+//
+// The in-memory store is used as the default storage layer implementation. The
+// in-memory store supports multi-reader/single-writer concurrency with
+// rollback.
+//
+// Callers should assume the in-memory store does not make copies of written
+// data. Once data is written to the in-memory store, it should not be modified
+// (outside of calling Store.Write). Furthermore, data read from the in-memory
+// store should be treated as read-only.
+package inmem
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"sync"
+	"sync/atomic"
+
+	"github.com/open-policy-agent/opa/ast"
+	"github.com/open-policy-agent/opa/storage"
+	"github.com/open-policy-agent/opa/util"
+)
+
+// New returns an empty in-memory store.
+func New() storage.Store {
+	return &store{
+		data:     map[string]interface{}{},
+		triggers: map[*handle]storage.TriggerConfig{},
+		policies: map[string][]byte{},
+		indices:  newIndices(),
+	}
+}
+
+// NewFromObject returns a new in-memory store from the supplied data object.
+func NewFromObject(data map[string]interface{}) storage.Store {
+	db := New()
+	ctx := context.Background()
+	txn, err := db.NewTransaction(ctx, storage.WriteParams)
+	if err != nil {
+		panic(err)
+	}
+	if err := db.Write(ctx, txn, storage.AddOp, storage.Path{}, data); err != nil {
+		panic(err)
+	}
+	if err := db.Commit(ctx, txn); err != nil {
+		panic(err)
+	}
+	return db
+}
+
+// NewFromReader returns a new in-memory store from a reader that produces a
+// JSON serialized object. This function is for test purposes.
+func NewFromReader(r io.Reader) storage.Store {
+	d := util.NewJSONDecoder(r)
+	var data map[string]interface{}
+	if err := d.Decode(&data); err != nil {
+		panic(err)
+	}
+	return NewFromObject(data)
+}
+
+type store struct {
+	rmu      sync.RWMutex                      // reader-writer lock
+	wmu      sync.Mutex                        // writer lock
+	xid      uint64                            // last generated transaction id
+	data     map[string]interface{}            // raw data
+	policies map[string][]byte                 // raw policies
+	triggers map[*handle]storage.TriggerConfig // registered triggers
+	indices  *indices                          // data ref indices
+}
+
+type handle struct {
+	db *store
+}
+
+func (db *store) NewTransaction(ctx context.Context, params ...storage.TransactionParams) (storage.Transaction, error) {
+	var write bool
+	var context *storage.Context
+	if len(params) > 0 {
+		write = params[0].Write
+		context = params[0].Context
+	}
+	xid := atomic.AddUint64(&db.xid, uint64(1))
+	if write {
+		db.wmu.Lock()
+	} else {
+		db.rmu.RLock()
+	}
+	return newTransaction(xid, write, context, db), nil
+}
+
+func (db *store) Commit(ctx context.Context, txn storage.Transaction) error {
+	underlying, err := db.underlying(txn)
+	if err != nil {
+		return err
+	}
+	if underlying.write {
+		db.rmu.Lock()
+		event := underlying.Commit()
+		db.indices = newIndices()
+		db.runOnCommitTriggers(ctx, txn, event)
+		// Mark the transaction stale after executing triggers so they can
+		// perform store operations if needed.
+		underlying.stale = true
+		db.rmu.Unlock()
+		db.wmu.Unlock()
+	} else {
+		db.rmu.RUnlock()
+	}
+	return nil
+}
+
+func (db *store) Abort(ctx context.Context, txn storage.Transaction) {
+	underlying, err := db.underlying(txn)
+	if err != nil {
+		panic(err)
+	}
+	underlying.stale = true
+	if underlying.write {
+		db.wmu.Unlock()
+	} else {
+		db.rmu.RUnlock()
+	}
+}
+
+func (db *store) ListPolicies(_ context.Context, txn storage.Transaction) ([]string, error) {
+	underlying, err := db.underlying(txn)
+	if err != nil {
+		return nil, err
+	}
+	return underlying.ListPolicies(), nil
+}
+
+func (db *store) GetPolicy(_ context.Context, txn storage.Transaction, id string) ([]byte, error) {
+	underlying, err := db.underlying(txn)
+	if err != nil {
+		return nil, err
+	}
+	return underlying.GetPolicy(id)
+}
+
+func (db *store) UpsertPolicy(_ context.Context, txn storage.Transaction, id string, bs []byte) error {
+	underlying, err := db.underlying(txn)
+	if err != nil {
+		return err
+	}
+	return underlying.UpsertPolicy(id, bs)
+}
+
+func (db *store) DeletePolicy(_ context.Context, txn storage.Transaction, id string) error {
+	underlying, err := db.underlying(txn)
+	if err != nil {
+		return err
+	}
+	if _, err := underlying.GetPolicy(id); err != nil {
+		return err
+	}
+	return underlying.DeletePolicy(id)
+}
+
+func (db *store) Register(ctx context.Context, txn storage.Transaction, config storage.TriggerConfig) (storage.TriggerHandle, error) {
+	underlying, err := db.underlying(txn)
+	if err != nil {
+		return nil, err
+	}
+	if !underlying.write {
+		return nil, &storage.Error{
+			Code:    storage.InvalidTransactionErr,
+			Message: "triggers must be registered with a write transaction",
+		}
+	}
+	h := &handle{db}
+	db.triggers[h] = config
+	return h, nil
+}
+
+func (db *store) Read(ctx context.Context, txn storage.Transaction, path storage.Path) (interface{}, error) {
+	underlying, err := db.underlying(txn)
+	if err != nil {
+		return nil, err
+	}
+	return underlying.Read(path)
+}
+
+func (db *store) Write(ctx context.Context, txn storage.Transaction, op storage.PatchOp, path storage.Path, value interface{}) error {
+	underlying, err := db.underlying(txn)
+	if err != nil {
+		return err
+	}
+	val := util.Reference(value)
+	if err := util.RoundTrip(val); err != nil {
+		return err
+	}
+	return underlying.Write(op, path, *val)
+}
+
+func (db *store) Build(ctx context.Context, txn storage.Transaction, ref ast.Ref) (storage.Index, error) {
+	underlying, err := db.underlying(txn)
+	if err != nil {
+		return nil, err
+	}
+	if underlying.write {
+		return nil, &storage.Error{
+			Code:    storage.IndexingNotSupportedErr,
+			Message: "in-memory store does not support indexing on write transactions",
+		}
+	}
+	return db.indices.Build(ctx, db, txn, ref)
+}
+
+func (h *handle) Unregister(ctx context.Context, txn storage.Transaction) {
+	underlying, err := h.db.underlying(txn)
+	if err != nil {
+		panic(err)
+	}
+	if !underlying.write {
+		panic(&storage.Error{
+			Code:    storage.InvalidTransactionErr,
+			Message: "triggers must be unregistered with a write transaction",
+		})
+	}
+	delete(h.db.triggers, h)
+}
+
+func (db *store) runOnCommitTriggers(ctx context.Context, txn storage.Transaction, event storage.TriggerEvent) {
+	for _, t := range db.triggers {
+		t.OnCommit(ctx, txn, event)
+	}
+}
+
+func (db *store) underlying(txn storage.Transaction) (*transaction, error) {
+	underlying, ok := txn.(*transaction)
+	if !ok {
+		return nil, &storage.Error{
+			Code:    storage.InvalidTransactionErr,
+			Message: fmt.Sprintf("unexpected transaction type %T", txn),
+		}
+	}
+	if underlying.db != db {
+		return nil, &storage.Error{
+			Code:    storage.InvalidTransactionErr,
+			Message: "unknown transaction",
+		}
+	}
+	if underlying.stale {
+		return nil, &storage.Error{
+			Code:    storage.InvalidTransactionErr,
+			Message: "stale transaction",
+		}
+	}
+	return underlying, nil
+}
+
+var doesNotExistMsg = "document does not exist"
+var rootMustBeObjectMsg = "root must be object"
+var rootCannotBeRemovedMsg = "root cannot be removed"
+var outOfRangeMsg = "array index out of range"
+var arrayIndexTypeMsg = "array index must be integer"
+
+func invalidPatchError(f string, a ...interface{}) *storage.Error {
+	return &storage.Error{
+		Code:    storage.InvalidPatchErr,
+		Message: fmt.Sprintf(f, a...),
+	}
+}
+
+func notFoundError(path storage.Path) *storage.Error {
+	return notFoundErrorHint(path, doesNotExistMsg)
+}
+
+func notFoundErrorHint(path storage.Path, hint string) *storage.Error {
+	return notFoundErrorf("%v: %v", path.String(), hint)
+}
+
+func notFoundErrorf(f string, a ...interface{}) *storage.Error {
+	msg := fmt.Sprintf(f, a...)
+	return &storage.Error{
+		Code:    storage.NotFoundErr,
+		Message: msg,
+	}
+}

vendor/github.com/open-policy-agent/opa/storage/inmem/txn.go

@@ -0,0 +1,444 @@
+// Copyright 2017 The OPA Authors.  All rights reserved.
+// Use of this source code is governed by an Apache2
+// license that can be found in the LICENSE file.
+
+package inmem
+
+import (
+	"container/list"
+	"encoding/json"
+	"strconv"
+
+	"github.com/open-policy-agent/opa/storage"
+)
+
+// transaction implements the low-level read/write operations on the in-memory
+// store and contains the state required for pending transactions.
+//
+// For write transactions, the struct contains a logical set of updates
+// performed by write operations in the transaction. Each write operation
+// compacts the set such that two updates never overlap:
+//
+// - If new update path is a prefix of existing update path, existing update is
+// removed, new update is added.
+//
+// - If existing update path is a prefix of new update path, existing update is
+// modified.
+//
+// - Otherwise, new update is added.
+//
+// Read transactions do not require any special handling and simply passthrough
+// to the underlying store. Read transactions do not support upgrade.
+type transaction struct {
+	xid      uint64
+	write    bool
+	stale    bool
+	db       *store
+	updates  *list.List
+	policies map[string]policyUpdate
+	context  *storage.Context
+}
+
+type policyUpdate struct {
+	value  []byte
+	remove bool
+}
+
+func newTransaction(xid uint64, write bool, context *storage.Context, db *store) *transaction {
+	return &transaction{
+		xid:      xid,
+		write:    write,
+		db:       db,
+		policies: map[string]policyUpdate{},
+		updates:  list.New(),
+		context:  context,
+	}
+}
+
+func (txn *transaction) ID() uint64 {
+	return txn.xid
+}
+
+func (txn *transaction) Write(op storage.PatchOp, path storage.Path, value interface{}) error {
+
+	if !txn.write {
+		return &storage.Error{
+			Code:    storage.InvalidTransactionErr,
+			Message: "data write during read transaction",
+		}
+	}
+
+	if len(path) == 0 {
+		return txn.updateRoot(op, value)
+	}
+
+	for curr := txn.updates.Front(); curr != nil; {
+		update := curr.Value.(*update)
+
+		// Check if new update masks existing update exactly. In this case, the
+		// existing update can be removed and no other updates have to be
+		// visited (because no two updates overlap.)
+		if update.path.Equal(path) {
+			if update.remove {
+				if op != storage.AddOp {
+					return notFoundError(path)
+				}
+			}
+			txn.updates.Remove(curr)
+			break
+		}
+
+		// Check if new update masks existing update. In this case, the
+		// existing update has to be removed but other updates may overlap, so
+		// we must continue.
+		if update.path.HasPrefix(path) {
+			remove := curr
+			curr = curr.Next()
+			txn.updates.Remove(remove)
+			continue
+		}
+
+		// Check if new update modifies existing update. In this case, the
+		// existing update is mutated.
+		if path.HasPrefix(update.path) {
+			if update.remove {
+				return notFoundError(path)
+			}
+			suffix := path[len(update.path):]
+			newUpdate, err := newUpdate(update.value, op, suffix, 0, value)
+			if err != nil {
+				return err
+			}
+			update.value = newUpdate.Apply(update.value)
+			return nil
+		}
+
+		curr = curr.Next()
+	}
+
+	update, err := newUpdate(txn.db.data, op, path, 0, value)
+	if err != nil {
+		return err
+	}
+
+	txn.updates.PushFront(update)
+	return nil
+}
+
+func (txn *transaction) updateRoot(op storage.PatchOp, value interface{}) error {
+	if op == storage.RemoveOp {
+		return invalidPatchError(rootCannotBeRemovedMsg)
+	}
+	if _, ok := value.(map[string]interface{}); !ok {
+		return invalidPatchError(rootMustBeObjectMsg)
+	}
+	txn.updates.Init()
+	txn.updates.PushFront(&update{
+		path:   storage.Path{},
+		remove: false,
+		value:  value,
+	})
+	return nil
+}
+
+func (txn *transaction) Commit() (result storage.TriggerEvent) {
+	result.Context = txn.context
+	for curr := txn.updates.Front(); curr != nil; curr = curr.Next() {
+		action := curr.Value.(*update)
+		updated := action.Apply(txn.db.data)
+		txn.db.data = updated.(map[string]interface{})
+
+		result.Data = append(result.Data, storage.DataEvent{
+			Path:    action.path,
+			Data:    action.value,
+			Removed: action.remove,
+		})
+	}
+	for id, update := range txn.policies {
+		if update.remove {
+			delete(txn.db.policies, id)
+		} else {
+			txn.db.policies[id] = update.value
+		}
+
+		result.Policy = append(result.Policy, storage.PolicyEvent{
+			ID:      id,
+			Data:    update.value,
+			Removed: update.remove,
+		})
+	}
+	return result
+}
+
+func (txn *transaction) Read(path storage.Path) (interface{}, error) {
+
+	if !txn.write {
+		return ptr(txn.db.data, path)
+	}
+
+	merge := []*update{}
+
+	for curr := txn.updates.Front(); curr != nil; curr = curr.Next() {
+
+		update := curr.Value.(*update)
+
+		if path.HasPrefix(update.path) {
+			if update.remove {
+				return nil, notFoundError(path)
+			}
+			return ptr(update.value, path[len(update.path):])
+		}
+
+		if update.path.HasPrefix(path) {
+			merge = append(merge, update)
+		}
+	}
+
+	data, err := ptr(txn.db.data, path)
+
+	if err != nil {
+		return nil, err
+	}
+
+	if len(merge) == 0 {
+		return data, nil
+	}
+
+	cpy := deepCopy(data)
+
+	for _, update := range merge {
+		cpy = update.Relative(path).Apply(cpy)
+	}
+
+	return cpy, nil
+}
+
+func (txn *transaction) ListPolicies() []string {
+	var ids []string
+	for id := range txn.db.policies {
+		if _, ok := txn.policies[id]; !ok {
+			ids = append(ids, id)
+		}
+	}
+	for id, update := range txn.policies {
+		if !update.remove {
+			ids = append(ids, id)
+		}
+	}
+	return ids
+}
+
+func (txn *transaction) GetPolicy(id string) ([]byte, error) {
+	if update, ok := txn.policies[id]; ok {
+		if !update.remove {
+			return update.value, nil
+		}
+		return nil, notFoundErrorf("policy id %q", id)
+	}
+	if exist, ok := txn.db.policies[id]; ok {
+		return exist, nil
+	}
+	return nil, notFoundErrorf("policy id %q", id)
+}
+
+func (txn *transaction) UpsertPolicy(id string, bs []byte) error {
+	if !txn.write {
+		return &storage.Error{
+			Code:    storage.InvalidTransactionErr,
+			Message: "policy write during read transaction",
+		}
+	}
+	txn.policies[id] = policyUpdate{bs, false}
+	return nil
+}
+
+func (txn *transaction) DeletePolicy(id string) error {
+	if !txn.write {
+		return &storage.Error{
+			Code:    storage.InvalidTransactionErr,
+			Message: "policy write during read transaction",
+		}
+	}
+	txn.policies[id] = policyUpdate{nil, true}
+	return nil
+}
+
+// update contains state associated with an update to be applied to the
+// in-memory data store.
+type update struct {
+	path   storage.Path // data path modified by update
+	remove bool         // indicates whether update removes the value at path
+	value  interface{}  // value to add/replace at path (ignored if remove is true)
+}
+
+func newUpdate(data interface{}, op storage.PatchOp, path storage.Path, idx int, value interface{}) (*update, error) {
+
+	switch data := data.(type) {
+	case map[string]interface{}:
+		return newUpdateObject(data, op, path, idx, value)
+
+	case []interface{}:
+		return newUpdateArray(data, op, path, idx, value)
+
+	case nil, bool, json.Number, string:
+		return nil, notFoundError(path)
+	}
+
+	return nil, &storage.Error{
+		Code:    storage.InternalErr,
+		Message: "invalid data value encountered",
+	}
+}
+
+func newUpdateArray(data []interface{}, op storage.PatchOp, path storage.Path, idx int, value interface{}) (*update, error) {
+
+	if idx == len(path)-1 {
+		if path[idx] == "-" {
+			if op != storage.AddOp {
+				return nil, invalidPatchError("%v: invalid patch path", path)
+			}
+			cpy := make([]interface{}, len(data)+1)
+			copy(cpy, data)
+			cpy[len(data)] = value
+			return &update{path[:len(path)-1], false, cpy}, nil
+		}
+
+		pos, err := validateArrayIndex(data, path[idx], path)
+		if err != nil {
+			return nil, err
+		}
+
+		if op == storage.AddOp {
+			cpy := make([]interface{}, len(data)+1)
+			copy(cpy[:pos], data[:pos])
+			copy(cpy[pos+1:], data[pos:])
+			cpy[pos] = value
+			return &update{path[:len(path)-1], false, cpy}, nil
+
+		} else if op == storage.RemoveOp {
+			cpy := make([]interface{}, len(data)-1)
+			copy(cpy[:pos], data[:pos])
+			copy(cpy[pos:], data[pos+1:])
+			return &update{path[:len(path)-1], false, cpy}, nil
+
+		} else {
+			cpy := make([]interface{}, len(data))
+			copy(cpy, data)
+			cpy[pos] = value
+			return &update{path[:len(path)-1], false, cpy}, nil
+		}
+	}
+
+	pos, err := validateArrayIndex(data, path[idx], path)
+	if err != nil {
+		return nil, err
+	}
+
+	return newUpdate(data[pos], op, path, idx+1, value)
+}
+
+func newUpdateObject(data map[string]interface{}, op storage.PatchOp, path storage.Path, idx int, value interface{}) (*update, error) {
+
+	if idx == len(path)-1 {
+		switch op {
+		case storage.ReplaceOp, storage.RemoveOp:
+			if _, ok := data[path[idx]]; !ok {
+				return nil, notFoundError(path)
+			}
+		}
+		return &update{path, op == storage.RemoveOp, value}, nil
+	}
+
+	if data, ok := data[path[idx]]; ok {
+		return newUpdate(data, op, path, idx+1, value)
+	}
+
+	return nil, notFoundError(path)
+}
+func (u *update) Apply(data interface{}) interface{} {
+	if len(u.path) == 0 {
+		return u.value
+	}
+	parent, err := ptr(data, u.path[:len(u.path)-1])
+	if err != nil {
+		panic(err)
+	}
+	key := u.path[len(u.path)-1]
+	if u.remove {
+		obj := parent.(map[string]interface{})
+		delete(obj, key)
+		return data
+	}
+	switch parent := parent.(type) {
+	case map[string]interface{}:
+		parent[key] = u.value
+	case []interface{}:
+		idx, err := strconv.Atoi(key)
+		if err != nil {
+			panic(err)
+		}
+		parent[idx] = u.value
+	}
+	return data
+}
+
+func (u *update) Relative(path storage.Path) *update {
+	cpy := *u
+	cpy.path = cpy.path[len(path):]
+	return &cpy
+}
+
+func deepCopy(val interface{}) interface{} {
+	switch val := val.(type) {
+	case []interface{}:
+		cpy := make([]interface{}, len(val))
+		for i := range cpy {
+			cpy[i] = deepCopy(val[i])
+		}
+		return cpy
+	case map[string]interface{}:
+		cpy := make(map[string]interface{}, len(val))
+		for k := range val {
+			cpy[k] = deepCopy(val[k])
+		}
+		return cpy
+	default:
+		return val
+	}
+}
+
+func ptr(data interface{}, path storage.Path) (interface{}, error) {
+
+	node := data
+	for i := range path {
+		key := path[i]
+		switch curr := node.(type) {
+		case map[string]interface{}:
+			var ok bool
+			if node, ok = curr[key]; !ok {
+				return nil, notFoundError(path)
+			}
+		case []interface{}:
+			pos, err := validateArrayIndex(curr, key, path)
+			if err != nil {
+				return nil, err
+			}
+			node = curr[pos]
+		default:
+			return nil, notFoundError(path)
+		}
+	}
+
+	return node, nil
+}
+
+func validateArrayIndex(arr []interface{}, s string, path storage.Path) (int, error) {
+	idx, err := strconv.Atoi(s)
+	if err != nil {
+		return 0, notFoundErrorHint(path, arrayIndexTypeMsg)
+	}
+	if idx < 0 || idx >= len(arr) {
+		return 0, notFoundErrorHint(path, outOfRangeMsg)
+	}
+	return idx, nil
+}