Hey again, We are looking for a way to validate p...
# help
a
Hey again, We are looking for a way to validate policy expressions programatically. We leverage the dynamic backends and create/store policies mostly using the admin API + JSON payloads. We're running into an issue where we can sometimes inadvertently save policies with bad expressions in them. The API still allows us to save the policy, but then during checks the policy will fail to compile/evaluate leading to a nasty error rather than an ALLOW/DENY response. Is there a way to properly validate condition expressions programmatically? Or is the only viable way to catch these errors a save + mock check request to see if it can compile?
this is an example of an expression that is possible to save but will cause a 500 when attempting to check against the matched policy
R.attr.filter[query] == "foo"
the error in Cerbos logs shows query is attempting to be referenced as a variable. In reality, this was a mistake and the expression was supposed to be
R.attr.filter["query"] == "foo"
Errors in the cerbos logs shows something like
Copy code
check for [foobar.default]: policy compilation error: 1 compilation errors:\n<resource.foobar.vdefault/my_scope: Invalid expression `R.attr.filter[query] == \"foo\"`: [undeclared reference to 'query' (in container '')] (invalid expression)"}
p
maybe write policy tests? https://docs.cerbos.dev/cerbos/latest/policies/compile.html#testing cerbos hub has a visual interface to help with those as well