fix(planner): Lambda body can be a field selection (#1720)

lambda body can be a field selection Signed-off-by: Dennis Buduev <dbuduev@users.noreply.github.com> Co-authored-by: Dennis Buduev <dbuduev@users.noreply.github.com>
cerbos · Aug 2, 2023 · 6b09c62 · 6b09c62
1 parent 4e7d22c
commit 6b09c62
Show file tree

Hide file tree

Showing 3 changed files with 30 additions and 1 deletion.
diff --git a/internal/engine/planner/ast.go b/internal/engine/planner/ast.go
@@ -477,7 +477,9 @@ func buildExprImpl(cur *exprpb.Expr, acc *enginev1.PlanResourcesFilter_Expressio
 			return err
 		}
 		if _, ok := lambda.Node.(*ExprOpExpr); !ok {
-			return fmt.Errorf("expected expression, got %T", lambda.Node)
+			if _, ok := lambda.Node.(*ExprOpVar); !ok {
+				return fmt.Errorf("expected expression or variable, got %T", lambda.Node)
+			}
 		}
 		op := new(ExprOp)
 		err = buildExprImpl(iterRange, op, cur)

diff --git a/internal/test/testdata/query_planner/policies/resource_policy_leave_request.yaml b/internal/test/testdata/query_planner/policies/resource_policy_leave_request.yaml
@@ -194,3 +194,9 @@ resourcePolicy:
       condition:
         match:
           expr: P.attr.teams.all(t, t.startsWith(R.attr.teamId))
+    - actions: ["just-index"]
+      roles: ["user"]
+      effect: EFFECT_ALLOW
+      condition:
+        match:
+          expr: P.attr.account_id in (R.attr.accounts_people.map(ap, ap.account_id))
diff --git a/internal/test/testdata/query_planner/suite/harry.yaml b/internal/test/testdata/query_planner/suite/harry.yaml
@@ -11,6 +11,7 @@ principal:
     teams:
       team1: employee
       team2: user
+    account_id: abc123
 tests:
   - action: view
     resource:
@@ -131,3 +132,23 @@ tests:
                         - variable: t
                         - variable: request.resource.attr.teamId
                   - variable: t
+  - action: just-index
+    resource:
+      kind: leave_request
+      policyVersion: default
+    want:
+      kind: KIND_CONDITIONAL
+      condition:
+        expression:
+          operator: in
+          operands:
+            - value: abc123
+            - expression:
+                operator: map
+                operands:
+                  - variable: request.resource.attr.accounts_people
+                  - expression:
+                      operator: lambda
+                      operands:
+                        - variable: ap.account_id
+                        - variable: ap