-
Notifications
You must be signed in to change notification settings - Fork 26
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
check all / check unless behaviour #109
Comments
If we add
|
I am not fond of adding aliases like this in the syntax if there's already one way to do it. But maybe that would be easier to understand |
I'm exactly on the same position. I hate alias but I think it would make a clearer distinction than the |
the behaviour for check is to look for a set of matching facts, for which all expressions return
true
, and stop there. It can be a bit confusing sometimes because we might expect different behaviours.One common case is the need for a
check all
behaviour: instead of stopping at the first set of facts that succeed, it would validate all of them. More precisely, for every set of fact that unifies, all the expressions should returntrue
.As an example, if we had the facts
test("a"), test("b"), value("a", 1), value("a", 2)
:check if test($c), value($c, $i), $i < 2
would succeed because it would selecttest("a"), value("a", 1)
and stop therecheck all test($c), value($c, $i), $i < 2
, it would accepttest("a"), value("a", 1)
, ignore sets withtest("b")
because it won't unify withvalue
, and ultimately fail becausetest("a"), value("a", 2)
does not validate the expressionAnther way to write would be with a negative: since we have
check if
on one side, we could havecheck unless
, that succeeds if it does not find any set o facts that unifies and validates the expressions. That previous example could be written ascheck unless test($c), value($c, $i), $i >= 2
, but it does not encode the same behaviour: if there are notest
orvalue
fact, the check will succeed. We would like instead to have the facts, and that all of them match the condition.I think
check all
could be a new feature (not replacing the old checks), that would give the token more capabilities (that right now are only possible in the authorizer withdeny
)The text was updated successfully, but these errors were encountered: