Set literal references are not evaluated correctly #149
Closed
Description
If a set literal is referred to with a lookup value containing references to base documents, the evaluation is incorrect. Specifically it will fail because the lookup value will not have embedded references resolved. As a result, the lookup is performed with the reference itself contained in the lookup value, e.g., in pseudocode: set.contains(["a",1,data.foo[2])
instead of set.contains(["a",1,<value-referred-to-by-data.foo[2])
.
For example, below pair1
contains a reference data.foo[2]
which refers to a string value in the x.json
file.
(master)torin:~/go/src/github.com/open-policy-agent/opa$ ./opa_darwin_amd64 run ~/x.json
OPA 0.2.1-dev (commit f56ae0d, built at 2016-11-14T22:07:08Z)
Run 'help' to see a list of commands.
> v = {["a","b"],["c","d"]}
> x = "d"
> pair1 = [data.foo[2], x]
> pair1
[
"c",
"d"
]
> v[pair1]
undefined
But lookup values that only contain ground values are fine:
> pair2 = ["c", "d"]
> v[pair2]
true
As are lookup values that contain references to virtual docs:
> y = "c"
> pair3 = [y, x]
> v[pair3]
true
As are lookup values that contain variables with bindings:
> a="c", b="d", pair4=[a,b], v[pair4]
+-----+-----+-----------+
| a | b | pair4 |
+-----+-----+-----------+
| "c" | "d" | ["c","d"] |
+-----+-----+-----------+