cube-js / cube-js/cube

Support equality and inequality operators in YAML access policy conditions

Open
#11,117 2 comments 1 reaction 0 assignees View on GitHub
data modeling:access policies
Dominant language
Rust
Stars
20.8k
Forks
2.1k
Avg merge
1d 2h
Merged PRs (30d)
181

Description

**Is your feature request related to a problem? Please describe.**

In [data access policies](https://cube.dev/docs/reference/data-modeling/data-access-policies#conditions), the `if` expression of an `access_policy` condition supports a different set of operators depending on the data model format:

- In **JavaScript** data models, the `if` expression is evaluated as a JavaScript expression, so comparison operators such as `===`, `!==`, `==`, and `!=` work.
- In **YAML** data models, the `{ ... }` expression is evaluated as a Python expression by Cube's expression transpiler, which currently supports only logical operators (`and`, `or`, `not`), member access, and method calls. Comparison operators are **not** supported.

For example, this works in a JavaScript model:

```javascript
conditions: [
{ if: securityContext.region === `EMEA` }
]
```

But the equivalent YAML fails to compile:

```yaml
conditions:
- if: "{ securityContext.region == 'EMEA' }"
```

with an error like:

```
Failed to parse Python expression. Most likely this type of syntax isn't supported yet: Unsupported Python multiple children node: Comp_opContext: ==
```

This is the most common gap: comparing a security context value to a literal (e.g. `securityContext.region == 'EMEA'`) is a very natural way to express a condition, and today it can only be done in JavaScript models. Users on YAML models have to work around it by pushing the comparison into a boolean user attribute or method call.

**Describe the solution you'd like**

Support equality and inequality operators (`==`, `!=`) in the YAML `if` expressions of access policy conditions, transpiling them to their JavaScript equivalents (`===`, `!==`), so that YAML and JavaScript models are at parity for these operators.

**Describe alternatives you've considered**

- Using a JavaScript data model instead of YAML (works, but not always desirable).
- Precomputing the comparison as a boolean user attribute in the security context (works, but pushes model logic out of the data model).

**Additional context**

This is tracked from the docs side: the [supported operators table](https://cube.dev/docs/reference/data-modeling/data-access-policies#conditions) now documents which operators work in each format. Comparison, arithmetic, and other operators are similarly unsupported in YAML, but equality/inequality is the most impactful gap. Please 👍 or comment if you'd like this — it helps us prioritize.

Contributor guide

Open the contributing guide

Research direction

Start with the expression transpiler used for YAML access-policy `if` conditions and trace the unsupported `Comp_opContext: ==` error. Verify that `==` and `!=` are accepted in YAML conditions and transpile to `===` and `!==`, while existing logical operators remain supported.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust, yaml
Domain
authorization
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.