What this does

The previous code became hard to follow as we added more edge cases. All these edge cases happened because of our jsonb columns in SQL. This new code removes all those edge cases from the general code, as has the exceptions passed into the package. This code handles our custom jsonb columns:

https://github.com/coder/coder/blob/stevenmasley/rego_to_sql_redo/coderd/rbac/regosql/aclGroupVar.go

The previous code had a lot of stuff like this that was hard to follow. Changing it would cause random side effects, something we don't want in our auth code.

• https://github.com/coder/coder/blob/main/coderd/rbac/query.go#L288-L316
• https://github.com/coder/coder/blob/main/coderd/rbac/query.go#L457-L476
• Werid type: https://github.com/coder/coder/blob/main/coderd/rbac/query.go#L17

Implementation Notes

GetAuthorizedTemplates

I added GetAuthorizedTemplates and added a great unit test which tests all this SQL.

Testing

Testing is critical as this package generates SQL clauses, but does not actually execute the SQL clauses. It is possible the SQL that is generated is either syntactically incorrect for SQL, or behaviorally incorrect. It is up to us to come up with the SQL we desire, and make unit tests with these asserted cases.

Implementing Types

Types implement their supported operations on the types themselves. This is opposed to implementing a nested conditional structure such as:

// Trying to do a = b
switch a.(type) {
  case string:
    switch b.(type): 
      case string:
        return fmt.Sprintf("%s = %s, a, b)
}

This nesting structure blows up quick and becomes very difficult to follow. Implementing it on the type is much more straight forward and easier to understand. It also allows for easy recursion for things like (a = b) = (c = d). This is 2 equalities being compared, and in the structure above things like this become quite a hassle.

The other benefit to this, is that we can override behavior outside the package. The biggest problem in the first implementation is that there is no easy way to handle arbitrary jsonb types. I made an attempt at this by creating a Tree type for variables, but it's unnecessarily complex for the 1 column type we care about that is the exception. In this new design the exception is a custom type passed into the generator. So the generation code does not need to handle these like it did before.