# Functions

> The function set available in profile and control expressions, and where it applies.

Source: https://refpoint.dev/docs/rules/functions

This page lists the functions available in expressions, states where an
expression is evaluated, and shows one worked example.

## Scope

| Rule | Detail |
|---|---|
| Evaluated at load time | Variable defaults, `validation` conditions, and the address attribute of a check |
| Not evaluated | Assertion attributes and blocks. The provider decodes them as raw values when the check runs |
| Purity | Every function is pure and deterministic. No filesystem, environment, or clock access |
| Result | A profile evaluates identically wherever it is loaded |

## Catalogue

| Group | Functions |
|---|---|
| Numeric | `abs`, `ceil`, `floor`, `max`, `min`, `parseint` |
| String | `chomp`, `format`, `formatlist`, `indent`, `join`, `lower`, `regex`, `regexall`, `replace`, `split`, `strlen`, `substr`, `title`, `trim`, `trimprefix`, `trimspace`, `trimsuffix`, `upper` |
| Collection | `coalesce`, `coalescelist`, `compact`, `concat`, `contains`, `distinct`, `element`, `flatten`, `keys`, `length`, `lookup`, `merge`, `range`, `reverse`, `slice`, `sort`, `values`, `zipmap` |
| Encoding | `csvdecode`, `jsondecode`, `jsonencode` |

## Example

```hcl
variable "ssh_config_dir" {
  type    = "string"
  default = "/etc/ssh"
}

variable "env" {
  type    = "string"
  default = "prod"

  validation {
    condition     = contains(["prod", "staging"], lower(trimspace(var.env)))
    error_message = "env must be prod or staging."
  }
}

control "ssh-03" {
  title  = "Environment sshd drop-in is owned by root"
  impact = 0.6

  check "dropin-owner" "file" {
    path  = format("%s/sshd_config.d/%s.conf", trimsuffix(var.ssh_config_dir, "/"), lower(var.env))
    owner = "root"
    mode  = "0600"
  }
}
```

| Function | Position | Effect |
|---|---|---|
| `trimspace`, `lower` | validation condition | Normalise the override before checking it. `--var env=" Staging"` passes |
| `contains` | validation condition | Reject any value outside the allowed list at load time |
| `trimsuffix` | address attribute | Strip a trailing slash. `--var ssh_config_dir=/etc/ssh/` does not produce `//` |
| `format` | address attribute | Build the path from the directory and the normalised environment name |

| Input | Resolved `path` |
|---|---|
| Defaults | `/etc/ssh/sshd_config.d/prod.conf` |
| `--var env=Staging` | `/etc/ssh/sshd_config.d/staging.conf` |

`owner` and `mode` are assertions. The `file` provider decodes them as raw
values. A function call in either is not evaluated.