Hi I have question about

lambda

in resource planner: https://docs.cerbos.dev/cerbos/latest/api/index.html#resources-query-plan From our tests and the provided examples, there are a few implied, but not explicit assumptions that I wanted to verify 1. a

lambda

would only appear as a child of another expression and never directly as a child of

filter.condition

2. the

variable

in a lambda is never an attribute, it's always a name for how the variable would be referenced inside the lambda 3. the actual attribute that a lambda

variable

refers to is always the

variable

in the parent expression. Are these assumptions correct?

Hi @Cosmin Marginean sorry for the delay, could you share with me an example of a policy and an example of a request you're sending to get that response? I want to make sure we're looking at the same thing before I make any false assumptions

Hi Alex, I can't share the policy, but what I need to know is how to deal with the variables in the lambda and if the above assumptions are correct in general. Here's an example of a response though (redacted) where a lambda appears under an

exists

expression

"expression": {
              "operator": "exists",
              "operands": [
                {
                  "variable": "request.resource.attr.profiles"
                },
                {
                  "expression": {
                    "operator": "lambda",
                    "operands": [
                      {
                        "expression": {
                          "operator": "and",
                          "operands": [
                            {
                              "expression": {
                                "operator": "in",
                                "operands": [
                                  {
                                    "value": "admin"
                                  },
                                  {
                                    "variable": "prof.roles"
                                  }
                                ]
                              }
                            },
                            {
                              "expression": {
                                "operator": "eq",
                                "operands": [
                                  {
                                    "variable": "prof.tenancyId"
                                  },
                                  {
                                    "value": "12345"
                                  }
                                ]
                              }
                            }
                          ]
                        }
                      },
                      {
                        "variable": "prof"
                      }
                    ]
                  }
                }
              ]
            }

Yes, a lambda is always an argument to a function (operator) call over a list or a map. Your understanding is correct with a note that the lambda variable is a reference to a single value from a list or a map designated by the parent variable. Another note is that in some functions a lambda can take two arguments: index/key and value. Check https://docs.cerbos.dev/cerbos/latest/policies/conditions#_lists_and_maps for details.

Great, thanks! Appreciate it!