Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Partial object rules with "key override" rules cause non-deterministic type-checking #6182

Closed
johanfylling opened this issue Aug 28, 2023 · 0 comments · Fixed by #6183
Closed
Labels

Comments

@johanfylling
Copy link
Contributor

This issue deals with the intermittent type-checker behavior discussed in #6138.

Given the following policy:

package test

obj.foo := 42

obj[k] := v {
    v := ["a", "b", "c"][k]
}

test_obj {
    obj == {
        0: "a",
        1: "b",
        2: "c",
        "foo": 42,
    }
}

compilation will fail intermittently, as rules aren't properly sorted before type-checking occurs. If a partial rule (data.test.obj) has a "child" rule (data.test.obj.foo) declaring a "key override", it is left to chance whether all rules contributing to the partial object's type have been added to the type-tree before type-checking is performed on any dependent rule (data.test.test_obj).

johanfylling added a commit to johanfylling/opa that referenced this issue Aug 28, 2023
In order to properly sort rules according to dependencies before performing type-checking.

Also, properly merging types when type-tree produces multiple types for a given ref.

Fixes: open-policy-agent#6182
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
johanfylling added a commit that referenced this issue Aug 29, 2023
* ast: Including "child" rules when fetching rules by ref

In order to properly sort rules according to dependencies before performing type-checking.

Also, properly merging types when type-tree produces multiple types for a given ref.

Fixes: #6182
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant