How to GLob properly

[chippyash]

Globbing has received quite a lot of documentation in the docs but I still don't understand it, despite 40 odd years of doing this stuff!.

I assume that if I set a glob (glob.match(p.resource, [], resource)) where p.resource == "portal:user" and resource == "portal:config" to fail, but it returns true.

My use case:
my input comes in as

{
  "user": "bob",
  "permission": "portal:config:bar"
}

I parse .permission into 2 separate parts:

 - action
 - resource

e.g.

perm_parts := split(input.permission, ":")
    # parse the action
    action := perm_parts[2]
    # parse the resource
    resource := concat(":", array.slice(perm_parts,0,2))

Then I run

bits.and(to_number(glob.match(p.resource, [], resource)), to_number(glob.match(p.action, [], action)))

Is OPA globbing doing something different?

Should I be using regexes instead?

full code:

default allow := false
allow if {
    # split the permission
    perm_parts := split(input.permission, ":")
    # parse the action
    action := perm_parts[2]
    # parse the resource
    resource := concat(":", array.slice(perm_parts,0,2))
    print("Query User:", input.user, "Resource:", resource, "Action:", action)
    # lookup the list of roles for the user
    roles := user_roles[input.user]
    # for each role in that list
    r := roles[_]
        print("Checking Role:", r)
        # lookup the permissions list for role r
        permissions := role_permissions[r]
        # for each permission
        p := permissions[_]
            # check if the permission granted to r matches the user's request
            print("Evaluating:", p)
            bits.and(to_number(glob.match(p.resource, [], resource)), to_number(glob.match(p.action, [], action)))
            # p == {"action": action, "resource": resource}
}

Any help appreciated.

[charlieegan3]

Hey @chippyash, I've responded to your query on the other thread, but here's a simple example showing how globbing works:

https://play.openpolicyagent.org/p/JELG8geA7n

glob_ok := glob.match("portal:**", [":"], "portal:config:bar")
glob_not_ok := glob.match("portal:*", [":"], "portal:config:bar")

glob_not_ok is false since the * only matches a single part.

Would you be able to have a go at setting up an example on https://play.openpolicyagent.org so we can see the data too? https://play.openpolicyagent.org

[chippyash]

hi @charlieegan3 I will do that but give me a couple of days. It's past gin time here in UK.
Cheers chap. And thanks for quick response

[charlieegan3]

yeah that's fine, no worries!

[chippyash]

@charlieegan3 Please see https://play.openpolicyagent.org/p/WWGTeO2jT1

[charlieegan3]

Hey, just getting caught up here. Are you all clear on this glob matter now?

[charlieegan3]

I see the answer is accepted, but just wanted to check.