feat: unhide server-side evaluation commands and --server-side flag

cmd/kosli/evaluateHelpers.go

@@ -82,16 +82,10 @@ func (o *commonEvaluateOptions) addFlags(cmd *cobra.Command, policyDesc string)
 }
 
 // addServerSideFlag offers the evaluation to the Kosli server instead of
-// running it here. It is hidden, and stays hidden: it exists to run the two
-// evaluation paths against each other while neither is a contract anyone can
-// rely on, and the two do not yet agree on what a policy may contain or on
-// what a policy sees. Only the trail commands have it, because an evaluation
-// is created from trail references and `evaluate input` has none to send.
+// running it here. Only the trail commands have it, because an evaluation is
+// created from trail references and `evaluate input` has none to send.
 func (o *commonEvaluateOptions) addServerSideFlag(cmd *cobra.Command) {
 	cmd.Flags().BoolVar(&o.serverSide, "server-side", false, serverSideFlag)
-	if err := cmd.Flags().MarkHidden("server-side"); err != nil {
-		logger.Error("failed to hide the server-side flag: %v", err)
-	}
 }
 
 // assertOnDeny resolves the --assert / --no-assert pair into a single bool.

cmd/kosli/evaluatePolicy.go

@@ -170,9 +170,6 @@ func newEvaluatePolicyCmd(out io.Writer) *cobra.Command {
 		RunE: func(cmd *cobra.Command, args []string) error {
 			return o.run(out)
 		},
-		// Hidden while the command is proved out against a server that can run
-		// it. Unhiding it is this line, and it also restores its docs page.
-		Hidden: true,
 	}
 
 	cmd.Flags().StringArrayVar(&o.contexts, "context", []string{}, policyContextFlag)

cmd/kosli/evaluatePolicy_test.go

@@ -27,20 +27,11 @@ func (suite *EvaluatePolicyCommandTestSuite) cmd(host, extra string) string {
 		host, extra)
 }
 
-// Hidden while the command is proved out against a server that can run it.
-func (suite *EvaluatePolicyCommandTestSuite) TestTheCommandIsHiddenForNow() {
+func (suite *EvaluatePolicyCommandTestSuite) TestTheCommandIsListed() {
 	_, listed, _, _, err := executeCommandC("evaluate --help")
 
 	require.NoError(suite.T(), err)
-	require.NotContains(suite.T(), listed, evaluatePolicyShortDesc)
-	for _, sibling := range []string{"trail", "trails", "input"} {
-		require.Contains(suite.T(), listed, sibling, "the rest of the listing still renders")
-	}
-
-	// Its own help still renders, for anyone told to try it.
-	_, help, _, _, err := executeCommandC("evaluate policy --help")
-	require.NoError(suite.T(), err)
-	require.Contains(suite.T(), help, "--context")
+	require.Contains(suite.T(), listed, evaluatePolicyShortDesc)
 }
 
 // The flags that only make sense on this machine are absent rather than

cmd/kosli/evaluateServerSide_test.go

@@ -126,16 +126,13 @@ func (suite *EvaluateServerSideTestSuite) serverSideCmd(host, extra string) stri
 		host, extra)
 }
 
-// The flag is deliberately undocumented: it exists to run the two evaluation
-// paths against each other while neither is a contract anyone can rely on.
-func (suite *EvaluateServerSideTestSuite) TestTheFlagIsHiddenFromHelp() {
+func (suite *EvaluateServerSideTestSuite) TestTheFlagIsInHelp() {
 	for _, command := range []string{"trail", "trails"} {
 		suite.Run(command, func() {
 			_, combined, _, _, err := executeCommandC("evaluate " + command + " --help")
 
 			require.NoError(suite.T(), err)
-			require.NotContains(suite.T(), combined, "--server-side")
-			require.Contains(suite.T(), combined, "--policy", "the rest of the help still renders")
+			require.Contains(suite.T(), combined, "--server-side")
 		})
 	}
 }

cmd/kosli/getRegoPolicy.go

@@ -66,13 +66,11 @@ type getRegoPolicyOptions struct {
 func newGetRegoPolicyCmd(out io.Writer) *cobra.Command {
 	o := new(getRegoPolicyOptions)
 	cmd := &cobra.Command{
-		Use:     "rego-policy IDENTIFIER",
-		Short:   getRegoPolicyShortDesc,
-		Long:    getRegoPolicyLongDesc,
-		Example: getRegoPolicyExample,
-		Args:    cobra.ExactArgs(1),
-		// Hidden while the server gates the endpoint behind is-server-side-evaluation-enabled.
-		Hidden:      true,
+		Use:         "rego-policy IDENTIFIER",
+		Short:       getRegoPolicyShortDesc,
+		Long:        getRegoPolicyLongDesc,
+		Example:     getRegoPolicyExample,
+		Args:        cobra.ExactArgs(1),
 		Annotations: map[string]string{betaCLIAnnotation: ""},
 		PreRunE: func(cmd *cobra.Command, args []string) error {
 			err := RequireGlobalFlags(global, []string{"Org", "ApiToken"})

cmd/kosli/getRegoPolicy_test.go

@@ -40,14 +40,14 @@ func (suite *GetRegoPolicyCommandTestSuite) getCmd(host, args string) string {
 		args, host)
 }
 
-func (suite *GetRegoPolicyCommandTestSuite) TestItIsHiddenAndBeta() {
+func (suite *GetRegoPolicyCommandTestSuite) TestItIsVisibleAndBeta() {
 	root, err := newRootCmd(io.Discard, io.Discard, nil)
 	require.NoError(suite.T(), err)
 	cmd, _, err := root.Find([]string{"get", "rego-policy"})
 	require.NoError(suite.T(), err)
 
 	require.Equal(suite.T(), "rego-policy", cmd.Name())
-	require.True(suite.T(), cmd.Hidden)
+	require.False(suite.T(), cmd.Hidden)
 	require.Contains(suite.T(), cmd.Annotations, betaCLIAnnotation)
 }
 

cmd/kosli/lifecycle_test.go

@@ -51,12 +51,11 @@ func TestLifecycleAttestDecisionIsBetaAndVisible(t *testing.T) {
 	}
 }
 
-// Hidden while the server gates the endpoint behind is-server-side-evaluation-enabled.
-func TestLifecyclePublishRegoPolicyIsBetaAndHidden(t *testing.T) {
+func TestLifecyclePublishRegoPolicyIsBetaAndVisible(t *testing.T) {
 	global = &GlobalOpts{}
 	cmd := newPublishRegoPolicyCmd(io.Discard)
-	if !cmd.Hidden {
-		t.Error("expected publish rego-policy to be Hidden")
+	if cmd.Hidden {
+		t.Error("expected publish rego-policy to be visible (not Hidden)")
 	}
 	if !isBeta(cmd) {
 		t.Error("expected publish rego-policy to be beta")
@@ -70,8 +69,8 @@ func TestLifecyclePublishRegoPolicyIsBetaAndHidden(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if len(pages) > 0 {
-		t.Errorf("expected no docs page for a hidden rego-policy command, got %v", pages)
+	if len(pages) == 0 {
+		t.Error("expected a docs page for the rego-policy commands")
 	}
 }
 

cmd/kosli/listRegoPolicies.go

@@ -65,13 +65,11 @@ type listRegoPoliciesResponse struct {
 func newListRegoPoliciesCmd(out io.Writer) *cobra.Command {
 	o := new(listRegoPoliciesOptions)
 	cmd := &cobra.Command{
-		Use:     "rego-policies",
-		Short:   listRegoPoliciesShortDesc,
-		Long:    listRegoPoliciesLongDesc,
-		Example: listRegoPoliciesExample,
-		Args:    cobra.NoArgs,
-		// Hidden while the server gates the endpoint behind is-server-side-evaluation-enabled.
-		Hidden:      true,
+		Use:         "rego-policies",
+		Short:       listRegoPoliciesShortDesc,
+		Long:        listRegoPoliciesLongDesc,
+		Example:     listRegoPoliciesExample,
+		Args:        cobra.NoArgs,
 		Annotations: map[string]string{betaCLIAnnotation: ""},
 		PreRunE: func(cmd *cobra.Command, args []string) error {
 			err := RequireGlobalFlags(global, []string{"Org", "ApiToken"})

cmd/kosli/listRegoPolicies_test.go

@@ -34,14 +34,14 @@ func (suite *ListRegoPoliciesCommandTestSuite) listCmd(host, args string) string
 		args, host)
 }
 
-func (suite *ListRegoPoliciesCommandTestSuite) TestItIsHiddenAndBeta() {
+func (suite *ListRegoPoliciesCommandTestSuite) TestItIsVisibleAndBeta() {
 	root, err := newRootCmd(io.Discard, io.Discard, nil)
 	require.NoError(suite.T(), err)
 	cmd, _, err := root.Find([]string{"list", "rego-policies"})
 	require.NoError(suite.T(), err)
 
 	require.Equal(suite.T(), "rego-policies", cmd.Name())
-	require.True(suite.T(), cmd.Hidden)
+	require.False(suite.T(), cmd.Hidden)
 	require.Contains(suite.T(), cmd.Annotations, betaCLIAnnotation)
 }
 

cmd/kosli/publishRegoPolicy.go

@@ -108,13 +108,11 @@ type publishRegoPolicyOptions struct {
 func newPublishRegoPolicyCmd(out io.Writer) *cobra.Command {
 	o := new(publishRegoPolicyOptions)
 	cmd := &cobra.Command{
-		Use:     "rego-policy IDENTIFIER",
-		Short:   publishRegoPolicyShortDesc,
-		Long:    publishRegoPolicyLongDesc,
-		Example: publishRegoPolicyExample,
-		Args:    cobra.ExactArgs(1),
-		// Hidden while the server gates the endpoint behind is-server-side-evaluation-enabled.
-		Hidden:      true,
+		Use:         "rego-policy IDENTIFIER",
+		Short:       publishRegoPolicyShortDesc,
+		Long:        publishRegoPolicyLongDesc,
+		Example:     publishRegoPolicyExample,
+		Args:        cobra.ExactArgs(1),
 		Annotations: map[string]string{betaCLIAnnotation: ""},
 		PreRunE: func(cmd *cobra.Command, args []string) error {
 			err := RequireGlobalFlags(global, []string{"Org", "ApiToken"})

cmd/kosli/publishRegoPolicy_test.go

@@ -111,13 +111,11 @@ func (suite *PublishRegoPolicyCommandTestSuite) publishCmd(host, args string) st
 		args, host)
 }
 
-// The publish verb has no visible subcommand, so it is hidden as well.
-func (suite *PublishRegoPolicyCommandTestSuite) TestItIsHiddenFromHelp() {
+func (suite *PublishRegoPolicyCommandTestSuite) TestItIsListedInHelp() {
 	_, combined, _, _, err := executeCommandC("--help")
 
 	require.NoError(suite.T(), err)
-	require.NotContains(suite.T(), combined, "publish")
-	require.Contains(suite.T(), combined, "create", "the rest of the help still renders")
+	require.Contains(suite.T(), combined, publishDesc)
 }
 
 func (suite *PublishRegoPolicyCommandTestSuite) TestItIsNoLongerACreateCommand() {

cmd/kosli/root.go

@@ -148,7 +148,7 @@ Paths the list already matches stay excluded whatever is later added there, so k
 	templateArtifactName            = "The name of the artifact in the yml template file."
 	flowNamesFlag                   = "[defaulted] The comma separated list of Kosli flows. Defaults to all flows of the org."
 	outputFlag                      = "[defaulted] The format of the output. Valid formats are: [table, json]."
-	serverSideFlag                  = "[hidden] Evaluate the policy on the Kosli server rather than on this machine. Unsupported and subject to change."
+	serverSideFlag                  = "[optional] Evaluate the policy on the Kosli server rather than on this machine. Cannot be combined with --attestations, --show-input or --output-rule."
 	policyParamsFlag                = "[optional] Policy parameters as inline JSON or @file.json. Available in policies as data.params."
 	policyOutputRuleFlag            = "[optional] [experimental] Name of a policy rule to add to the JSON output, next to allow and violations. Can be repeated, or given as a comma-separated list. Subject to change."
 	policyAssertFlag                = "[optional] Exit with a non-zero status when the policy denies. Without it the verdict is printed and the command exits 0."