refactor: use plain params parameter instead of variadic

Changes Evaluate signature from variadic params to an explicit
map parameter. Callers pass nil when no params are needed,
making the API unambiguous.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: tooky

internal/evaluate/rego.go

@@ -18,7 +18,7 @@ type Result struct {
 // Evaluate evaluates a Rego policy against the given input.
 // The policy must use `package policy` and declare an `allow` rule.
 // An optional params map can be provided to populate data.params in the policy.
-func Evaluate(policySource string, input interface{}, params ...map[string]interface{}) (*Result, error) {
+func Evaluate(policySource string, input interface{}, params map[string]interface{}) (*Result, error) {
 	if err := validatePolicy(policySource); err != nil {
 		return nil, err
 	}
@@ -30,8 +30,8 @@ func Evaluate(policySource string, input interface{}, params ...map[string]inter
 		rego.Module("policy.rego", policySource),
 		rego.Input(input),
 	}
-	if len(params) > 0 && params[0] != nil {
-		store := inmem.NewFromObject(map[string]interface{}{"params": params[0]})
+	if params != nil {
+		store := inmem.NewFromObject(map[string]interface{}{"params": params})
 		opts = append(opts, rego.Store(store))
 	}
 
@@ -54,11 +54,7 @@ func Evaluate(policySource string, input interface{}, params ...map[string]inter
 	result := &Result{Allow: allow}
 
 	if !result.Allow {
-		var p map[string]interface{}
-		if len(params) > 0 {
-			p = params[0]
-		}
-		violations, err := collectViolations(ctx, policySource, input, p)
+		violations, err := collectViolations(ctx, policySource, input, params)
 		if err != nil {
 			return nil, err
 		}

internal/evaluate/rego_test.go

@@ -17,7 +17,7 @@ allow = true
 		},
 	}
 
-	result, err := Evaluate(policy, input)
+	result, err := Evaluate(policy, input, nil)
 	require.NoError(t, err)
 	require.True(t, result.Allow)
 	require.Empty(t, result.Violations)
@@ -38,7 +38,7 @@ violations contains msg if {
 		},
 	}
 
-	result, err := Evaluate(policy, input)
+	result, err := Evaluate(policy, input, nil)
 	require.NoError(t, err)
 	require.False(t, result.Allow)
 	require.Contains(t, result.Violations, "always denied")
@@ -51,7 +51,7 @@ allow = true
 `
 	input := map[string]interface{}{}
 
-	_, err := Evaluate(policy, input)
+	_, err := Evaluate(policy, input, nil)
 	require.Error(t, err)
 	require.Contains(t, err.Error(), "package policy")
 }
@@ -65,7 +65,7 @@ violations contains msg if {
 `
 	input := map[string]interface{}{}
 
-	_, err := Evaluate(policy, input)
+	_, err := Evaluate(policy, input, nil)
 	require.Error(t, err)
 	require.Contains(t, err.Error(), "allow")
 }
@@ -77,7 +77,7 @@ allow = false
 `
 	input := map[string]interface{}{}
 
-	result, err := Evaluate(policy, input)
+	result, err := Evaluate(policy, input, nil)
 	require.NoError(t, err)
 	require.False(t, result.Allow)
 	require.Empty(t, result.Violations)
@@ -90,7 +90,7 @@ allow = "yes"
 `
 	input := map[string]interface{}{}
 
-	_, err := Evaluate(policy, input)
+	_, err := Evaluate(policy, input, nil)
 	require.Error(t, err)
 	require.Contains(t, err.Error(), "boolean")
 }
@@ -102,7 +102,7 @@ allow = {{{
 `
 	input := map[string]interface{}{}
 
-	_, err := Evaluate(policy, input)
+	_, err := Evaluate(policy, input, nil)
 	require.Error(t, err)
 	require.Contains(t, err.Error(), "parse")
 }
@@ -160,7 +160,7 @@ violations contains msg if {
 	}
 
 	// No params — policy uses default threshold of 10
-	result, err := Evaluate(policy, input)
+	result, err := Evaluate(policy, input, nil)
 	require.NoError(t, err)
 	require.False(t, result.Allow, "score 5 should fail default threshold 10")
 	require.Len(t, result.Violations, 1)