Every Keyword

[tsandall]

In Rego, by default, variables are "existentially quantified". This means that when you want to express assertions over every member of a collection you need to either use double-negation or comprehensions and aggregates. This often trips up new users and in some cases leads to bugs where the author thinks they's expressed "for all elements in x ..." but have not.

To address this issue we could introduce a new keyword that declares universally quantified variables along with their domain. For example:

allow {
  every x in { some x; input.containers[x] }
  startswith(input.containers[x].image, "hooli.com/")
}

Note, it's important that users declare the domain because otherwise it's ambiguous. For example:

every x   # is p a subset of q or vice versa or are they equal?
p[x]
q[x]

Similarly, while it's appealing to omit the domain, even simple cases could be confusing. For example:

every x
startswith(input.containers[x].image, "hooli.com/")

What is the domain of x here? It could be interpreted as all containers in input, all containers in input with an image field (some may not include an image field), or all containers in the input with an image field that start with...

[srenatus]

Would we want to allow further constraints?

The following

every x { input.containers[x]; input.containers[x].label }

could limit the domain of x to those containers that have a label, omitting those that don't...?

[srenatus]

For tracking purposes: the remaining bits are

• better tracing of the every evaluation
• fix IR/wasm exceptions
• documentation

[srenatus]

This will ship with the next release. 🎉