partial eval: built-in function count is not covered when count on a rule generating sets

[t83714]

Expected Behavior

Given the following rules:

package test

sites = [{"name": "prod"}, {"name": "smoke1"}, {"name": "dev"}]
q[name] { name := sites[i].name }

default allow = false

allow {
    count(q) > 1
    input.x.a = "xxxxx"
}

We expect the following when run:

OPA 0.10.7 (commit 0f39c27e, built at 2019-04-09T00:29:06Z)

Run 'help' to see a list of commands.

> unknown input
> data.test.allow
+-----------+--------------------------+
| Query 1   | data.partial.test.allow  |
+-----------+--------------------------+
| Support 1 | package partial.test     |
|           |                          |
|           | allow {                  |
|           |   input.x.a = "xxxxx"    |
|           | }                        |
|           |                          |
|           | default allow = false    |
+-----------+--------------------------+

Actual Behavior

We actually got:

OPA 0.10.7 (commit 0f39c27e, built at 2019-04-09T00:29:06Z)

Run 'help' to see a list of commands.

> unknown input
> data.test.allow
+-----------+--------------------------+
| Query 1   | data.partial.test.allow  |
+-----------+--------------------------+
| Support 1 | package partial.test     |
|           |                          |
|           | allow {                  |
|           |   count(data.test.q) > 1 |
|           |   input.x.a = "xxxxx"    |
|           | }                        |
|           |                          |
|           | default allow = false    |
+-----------+--------------------------+

Additional Info

After more tests, I find that if change rules to:

package test

sites = [{"name": "prod"}, {"name": "smoke1"}, {"name": "dev"}]

default allow = false

allow {
    count(sites) > 1
    input.x.a = "xxxxx"
}

The count is removed from the support:

OPA 0.10.7 (commit 0f39c27e, built at 2019-04-09T00:29:06Z)

Run 'help' to see a list of commands.

> sites = [{"name": "prod"}, {"name": "smoke1"}, {"name": "dev"}]
Rule 'sites' defined in package repl. Type 'show' to see rules.
> default allow = false
Rule 'allow' defined in package repl. Type 'show' to see rules.
> allow {
|     count(sites) > 1
|     input.x.a = "xxxxx"
| }
| 
Rule 'allow' defined in package repl. Type 'show' to see rules.
> unknown input
> allow
+-----------+-------------------------+
| Query 1   | data.partial.repl.allow |
+-----------+-------------------------+
| Support 1 | package partial.repl    |
|           |                         |
|           | allow {                 |
|           |   input.x.a = "xxxxx"   |
|           | }                       |
|           |                         |
|           | default allow = false   |
+-----------+-------------------------+

[tsandall]

@t83714 sorry for the delay! KubeCon EU stole a lot of cycles over the last two weeks.

count(data.test.q) > 1 is saved because data.test.q refers to an incremental rule. In this case, it's a single rule but in the general case, there could be multiple definitions of:

q[1] { input[_] = 1 }`
q[2] { input[_] = 2 }`
q[3] { input[_] = 3 }`
# etc.

To inline these rules we'd have to generate 2^n combinations (where n is the number of rules that depend on unknowns.) If n is really small, that might be OK, but in the general case, it'll be too expensive (which is why we save the expression).

In some cases, it might be fine to partially evaluate the reference. A good example would be if the ref does not depend on unknowns. In this case, we can just inline the result.

[t83714]

Thanks a lot for your comment 👍
I have now understood more on this issue 😄
I think it's fair to save the expression for an incremental rule that depends on unknowns.
Though, as you suggest, it would be good to inline the result and partially evaluate the count when an incremental rule that does not depend on unknowns --- personally I feel count is a useful concise shortcut 😄