Why are only two values returned why in the wrong order?

[firstdorsal]

Hi :)

Please see:
https://play.openpolicyagent.org/p/whnzyVdSSH

The rr_set contains 3 values, but only 2 are returned.
This happens when the values are the same. How can I return them even if they are redundant/the same.

Why is the order not preserved?
How can I preserve the order?

[anderseknert]

That's just the characteristics of the set data type (unordered, unique items). This often maps well to the policy domain, where you have things like roles and permissions, and duplicates rarely make sense (e.g. what's the meaning of having two roles named admin?) and order is normally not important.

If that's not what you want, you would instead use arrays. Rego doesn't have "array generating rules" like the rule generating a set in your example, but you could use an array comprehension to create an array out of items from the input:

rr_array := [y | x := input.rr_sets[_]
                 y := {"name": x.name}]

[firstdorsal]

thank you!

[firstdorsal]

What would be the complete rule?
I'm still not getting it.

[firstdorsal]

i found out.
https://play.openpolicyagent.org/p/1kOLtoWp7w
but why is it now returning 2 values in the rr_sets array when it should return 3?

[firstdorsal]

thats strange/unexpected:
when hardcoding false into the object:
https://play.openpolicyagent.org/p/yYlvAQryLx

package pektin_policy

default api_method=false
default ip=false
default utc_millis=false
default user_agent=false
default return_policy_results=false

rr_sets=rr_array{    
	rr_array := [y | rr_set := input.rr_sets[_]
                 y := {
                 "name": false, // HERE
                 "rr_type": true,
                 "ttl": true,
                 "value":true 
                 }
                ]
}

rr_name(name) {
	startswith(name,"_acme-challenge.")
    endswith(name,".") 
}

it returns 3 array values

but when using the function rr_name that returns a boolean:
https://play.openpolicyagent.org/p/EkxOxQb2IS

package pektin_policy

default api_method=false
default ip=false
default utc_millis=false
default user_agent=false
default return_policy_results=false

rr_sets=rr_array{    
	rr_array := [y | rr_set := input.rr_sets[_]
                 y := {
                 "name": rr_name(rr_set.name),
                 "rr_type": true,
                 "ttl": true,
                 "value":true 
                 }
                ]
}

rr_name(name) {
	startswith(name,"_acme-challenge.")
    endswith(name,".") 
}

it only returns two elements with a not matching name

this cannot be intended

[anderseknert]

A boolean function or rule returns true if all the conditions in the body are true. It does however not return false if the conditions aren't true, but rather it returns nothing.. i.e. undefined... and Rego will halt evaluation when encountering undefined - hence why there's only two items in the resulting array. That's what the default assignments to false is about. For functions you can't currently use default (there's an open issue for that here) but you could use the else construct instead to return false.

rr_name(name) {
    startswith(name,"_acme-challenge.")
    endswith(name,".") 
} else = false

[firstdorsal]

ahh okay, thanks a lot!

[firstdorsal]

this is the final result:
https://play.openpolicyagent.org/p/l1JQ44TTil

[anderseknert]

Nice! Thanks for sharing 🙂