Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Empty package sometimes evaluates as an empty object, sometimes as undefined #1863

Closed
mikol opened this issue Oct 25, 2019 · 0 comments · Fixed by #1865
Closed

Empty package sometimes evaluates as an empty object, sometimes as undefined #1863

mikol opened this issue Oct 25, 2019 · 0 comments · Fixed by #1865
Assignees
Labels

Comments

@mikol
Copy link
Contributor

mikol commented Oct 25, 2019

Expected Behavior

Empty packages should evaluate consistently, ideally as an empty object {}

Actual Behavior

Empty packages evaluate differently depending on how the Rego is written

Steps to Reproduce the Problem

  1. Given an empty package:
package x.y.z
  1. Reference the package elsewhere:
package undefined
z = data.x.y.z
  1. Access data.undefined.z in the REPL:
opa run .
> data.undefined.z
undefined
  1. Reference the package elsewhere using a variable instead of a static reference:
package defined
k = "y"
z = data.x[k].z
  1. Access data.defined.z in the REPL:
opa run .
> data.defined.z
{}

Additional Info

Version: 0.14.2
Build Commit: db9855d
Build Timestamp: 2019-10-04T15:28:33Z
Build Hostname: 65ca4a7c4e81

@tsandall tsandall added the bug label Oct 28, 2019
@tsandall tsandall self-assigned this Oct 28, 2019
tsandall added a commit to tsandall/opa that referenced this issue Oct 28, 2019
This commit fixes a bug in the predicate that checks if a ref refers
to a virtual doc during the rule index build.

Empty packages or packages containing only undefined rules generate an
empty object. The bug was causing refs to empty packages to not be
considered _virtual_ and therefore they could be indexed.

In the issue, the case that passes did so because the ref was
non-ground so the indexer excluded it. The case the failed was ground
and the ref referred to an empty package so the indexer included
it. This could be seen by enabling tracing (the index event showed
zero matching rules so the expression failed.)

The fix updates the virtual predicate to just walk down the rule
tree instead of accumulating rules. If at any point there are no rules
AND there are no children, the ref is not virtual. Otherwise, the ref
is virtual.

Fixes open-policy-agent#1863

Signed-off-by: Torin Sandall <[email protected]>
tsandall added a commit that referenced this issue Oct 28, 2019
This commit fixes a bug in the predicate that checks if a ref refers
to a virtual doc during the rule index build.

Empty packages or packages containing only undefined rules generate an
empty object. The bug was causing refs to empty packages to not be
considered _virtual_ and therefore they could be indexed.

In the issue, the case that passes did so because the ref was
non-ground so the indexer excluded it. The case the failed was ground
and the ref referred to an empty package so the indexer included
it. This could be seen by enabling tracing (the index event showed
zero matching rules so the expression failed.)

The fix updates the virtual predicate to just walk down the rule
tree instead of accumulating rules. If at any point there are no rules
AND there are no children, the ref is not virtual. Otherwise, the ref
is virtual.

Fixes #1863

Signed-off-by: Torin Sandall <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
Archived in project
Development

Successfully merging a pull request may close this issue.

2 participants