Repository navigation
Compiler / type checker to fail on impossible (or constant) conditions #6998
Description
Dusting off some old notes I found, and this one still seems relevant.
package p
import rego.v1
deny contains "noooo" if {
# ... conditions
}
allow if {
not deny # should be a type error, as the "comparison" is invalid
}
# also quite "common" in tests, where `count(deny)` should have been used
test_deny if {
not deny with ...
}While it's unlikely that this code would make it to production, it's happened quite a few times that developers make this mistake in the policy authoring process, and will have to spend time troubleshooting rather than having fun.
We already have rules in Regal to catch some of these mistakes, like impossible-not, or constant-condition.. but I think it begs the question why the compiler should refuse 1 == "1" but allow equally impossible not my_set.
Activity
stale commentedon Oct 6, 2024
This issue has been automatically marked as inactive because it has not had any activity in the last 30 days. Although currently inactive, the issue could still be considered and actively worked on in the future. More details about the use-case this issue attempts to address, the value provided by completing it or possible solutions to resolve it would help to prioritize the issue.
ast: Reject negations that can never succeed
ast: Reject negations that can never succeed