rego_parse_error when using "every" keyword.

[robhafner]

I'm attempting to use the "every" keyword as described in the documentation found here. However, I'm receiving the following rego parse error when I do.

1 error occurred: policy.rego:21: rego_parse_error: unexpected identifier token: missing body
group != "ProhibitedGroup"

Any help on what I may be doing incorrectly would be appreciated! Thanks in advance!

https://play.openpolicyagent.org/p/pLXIx1FC0m

[srenatus]

Your playground example read

deny if {
	every group in claims.authorities
	group != "ProhibitedGroup"
}

Try adding { ... }:

deny if {
	every group in claims.authorities {
		group != "ProhibitedGroup"
	}
}

every only applies to the expressing within its { ... } block. That is because it's not ever valid to do something like this:

# invalid
deny contains group if {
	every group in claims.authorities
	group != "ProhibitedGroup"
}

Since every is true when the domain (claims.authorities) is empty, we wouldn't have any group to use, although the expression is true.

Note that you can drop the outermost { .. }, and go with this here:

deny if every group in claims.authorities {
	group != "ProhibitedGroup"
}

[robhafner]

Thanks for the quick response and explanation! The braces resolved the issue and your explanation helped me understand the syntax further. Much appreciated!