Ensure all resources are returned for relation check when caveats are specified - #2027
Conversation
github-actions
Bot
added
area/tooling
There was a problem hiding this comment.
Understanding check:
The issue is that we were short-circuiting when we found a single relation which matched the check but whose caveat was false and calling it false.
This fix says that when we have a caveat, we must find all relations that match the check so that we can evaluate the caveats on all of them and then OR them together so that we can decide whether the overall check was true.
The more efficient fix would be to continue evaluating relationships that match the check until we find one that also matches the caveat or we exhaust the set.
There was a problem hiding this comment.
Ah I'm reading slack and realizing that my "more efficient fix" isn't how it would work for the caching reasons described.
There was a problem hiding this comment.
Correct. We cannot just eval here because we build the full caveat expression and then evaluate outside of the dispatcher.
0e4c99e to
20855de
Compare
ecordell
left a comment
ecordell
left a comment
There was a problem hiding this comment.
it would be nice if there were a helper that could assert that two cel expressions are equivalent, instead of providing two options in the test
3 participants
Fixes #2026