fix(planner): Lambda body can be a field selection

internal/engine/planner/ast.go

@@ -477,7 +477,9 @@
 			return err
 		}
 		if _, ok := lambda.Node.(*ExprOpExpr); !ok {
-			return fmt.Errorf("expected expression, got %T", lambda.Node)
+			if _, ok := lambda.Node.(*ExprOpVar); !ok {
+				return fmt.Errorf("expected expression or variable, got %T", lambda.Node)
+			}
 		}
 		op := new(ExprOp)
 		err = buildExprImpl(iterRange, op, cur)

internal/test/testdata/query_planner/policies/resource_policy_leave_request.yaml

@@ -194,3 +194,9 @@ resourcePolicy:
       condition:
         match:
           expr: P.attr.teams.all(t, t.startsWith(R.attr.teamId))
+    - actions: ["just-index"]
+      roles: ["user"]
+      effect: EFFECT_ALLOW
+      condition:
+        match:
+          expr: P.attr.account_id in (R.attr.accounts_people.map(ap, ap.account_id))

internal/test/testdata/query_planner/suite/harry.yaml

@@ -11,6 +11,7 @@ principal:
     teams:
       team1: employee
       team2: user
+    account_id: abc123
 tests:
   - action: view
     resource:
@@ -131,3 +132,23 @@ tests:
                         - variable: t
                         - variable: request.resource.attr.teamId
                   - variable: t
+  - action: just-index
+    resource:
+      kind: leave_request
+      policyVersion: default
+    want:
+      kind: KIND_CONDITIONAL
+      condition:
+        expression:
+          operator: in
+          operands:
+            - value: abc123
+            - expression:
+                operator: map
+                operands:
+                  - variable: request.resource.attr.accounts_people
+                  - expression:
+                      operator: lambda
+                      operands:
+                        - variable: ap.account_id
+                        - variable: ap