Support equality and inequality operators in YAML access policy conditions
- Dominant language
- Rust
- Stars
- 20.8k
- Forks
- 2.1k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 181
Description
**Is your feature request related to a problem? Please describe.**
In [data access policies](https://cube.dev/docs/reference/data-modeling/data-access-policies#conditions), the `if` expression of an `access_policy` condition supports a different set of operators depending on the data model format:
- In **JavaScript** data models, the `if` expression is evaluated as a JavaScript expression, so comparison operators such as `===`, `!==`, `==`, and `!=` work.
- In **YAML** data models, the `{ ... }` expression is evaluated as a Python expression by Cube's expression transpiler, which currently supports only logical operators (`and`, `or`, `not`), member access, and method calls. Comparison operators are **not** supported.
For example, this works in a JavaScript model:
```javascript
conditions: [
{ if: securityContext.region === `EMEA` }
]
```
But the equivalent YAML fails to compile:
```yaml
conditions:
- if: "{ securityContext.region == 'EMEA' }"
```
with an error like:
```
Failed to parse Python expression. Most likely this type of syntax isn't supported yet: Unsupported Python multiple children node: Comp_opContext: ==
```
This is the most common gap: comparing a security context value to a literal (e.g. `securityContext.region == 'EMEA'`) is a very natural way to express a condition, and today it can only be done in JavaScript models. Users on YAML models have to work around it by pushing the comparison into a boolean user attribute or method call.
**Describe the solution you'd like**
Support equality and inequality operators (`==`, `!=`) in the YAML `if` expressions of access policy conditions, transpiling them to their JavaScript equivalents (`===`, `!==`), so that YAML and JavaScript models are at parity for these operators.
**Describe alternatives you've considered**
- Using a JavaScript data model instead of YAML (works, but not always desirable).
- Precomputing the comparison as a boolean user attribute in the security context (works, but pushes model logic out of the data model).
**Additional context**
This is tracked from the docs side: the [supported operators table](https://cube.dev/docs/reference/data-modeling/data-access-policies#conditions) now documents which operators work in each format. Comparison, arithmetic, and other operators are similarly unsupported in YAML, but equality/inequality is the most impactful gap. Please 👍 or comment if you'd like this — it helps us prioritize.
Contributor guide
Research direction
Start with the expression transpiler used for YAML access-policy `if` conditions and trace the unsupported `Comp_opContext: ==` error. Verify that `==` and `!=` are accepted in YAML conditions and transpile to `===` and `!==`, while existing logical operators remain supported.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust, yaml
- Domain
- authorization
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 58/100