Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Added Array, Set and operator 'IN' #110
Added Array, Set and operator 'IN' #110
Changes from 10 commits
32e5d0c
2c1598b
ec25dd0
dcba01b
4df46bb
caa4722
d982522
76f4014
f564fdd
348b0ab
403c28c
d724d4b
e2eac84
7343f85
d669080
ca1996c
8db0765
da66feb
File filter
Filter by extension
Conversations
Jump to
There are no files selected for viewing
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
During development/experimenting this is fine, but we should remove the default implementation.
At some, all visitors need to implement this method, so we can be sure that we can handle collection values.
One of the important ones that is still missing an implementation is the
ExpressionJsonConverter.JsonEncoderVisitor
, without which we can't send the partial expression to the application.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Are there ever
null
values returned fromthis::convert
?I think that would indicate a bug, so filtering them out might be counterproductive, and actually result in an expression that can't be converted being dropped, thereby widening the access policies, which is an undesired effect.
We should prefer erroring out (even if it's a null pointer exception) over accidentally allowing access to data that should have been protected.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This filtering is done because there is an ability to return empty Term for in operation.
Example:
"index": 4, "terms": [ { "type": "ref", "value": [ { "type": "var", "value": "internal" }, { "type": "string", "value": "member_2" } ] }, { "type": "ref", "value": [ { "type": "var", "value": "input" }, { "type": "string", "value": "entity" }, { "type": "string", "value": "accountId" } ] }, { "type": "array", "value": [] # will return null in conversion, cause we need to skip empty in clause } ] }
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
That's why in this place we are filtering empty
in
casesThere was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
All these rego types are unexpected in a scalar collection, so they should throw an exception instead of silently dropping the term.
For example, in rego, you can have a
Ref
in an array, for example, when constructinginput.entity.something in [input.entity.optionA, input.entity.optionB]
That is probably (I didn't check) a valid rego expression, but is not supported as entry in the current
CollectionValue
.It's fine to limit ourselves to only scalar values for now, but we should not drop those terms silently.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I've added support of collection in collection for opa-client (xenit-eu/opa-java-client#28) and for thunx
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Doing this would unpack a rego array
['a', 'b', ['c', 'd']]
into['a', 'b', 'c', 'd']
, which is not a valid conversion.Instead, this would probably need to use the same code as used above to collect scalars, and add the whole resulting
CollectionValue
as a scalar value.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Now SetTerm and ArrayTerm extends Term, that means that SetTerm cannot have SetTerm as a value. If you want to have such case when SetTerm contains SetTerm, then we need to change opa-client, to make SetTerm and ArrayTerm extend ScalarTerm
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I've added support of collection in collection for opa-client (xenit-eu/opa-java-client#28) and for thunx
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Same remark as for the array case, nested sets shouldn't be flattened.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
fixed