Unexpected if keyword error, for basic complete rule example

[sduff]

G'day,

I have been unable to get a simple complete rule working on the Rego Playground,
https://play.openpolicyagent.org/p/43GKuUungG

# https://www.openpolicyagent.org/docs/latest/#complete-rules

package test

import future.keywords.if

deny {
	value := input.value
	print(value)
    
	valid := true if {
		value >= 1
		value <= 10
	}
    	valid != true
}

It gives the error that if is an unexpected keyword, but I am following the same format as in the examples.

1 error occurred: policy.rego:11: rego_parse_error: unexpected if keyword: expected \n or ; or }
	valid := true if {
	              ^

Thanks,
Simon

[srenatus]

Hello.

if in rego is used for defining rules, not as an expression in rule bodies. So you could do

package test

import future.keywords.if

deny if valid != true # a very short rule

valid if { # another rule definition
	value := input.value
	print(value)
	value >= 1
	value <= 10
}

it's equivalent to this, without if:

package test

deny { valid != true } # a very short rule

valid { # another rule definition
	value := input.value
	print(value)
	value >= 1
	value <= 10
}

[sduff]

Thank you, I ended up going with this process. Any issues with this approach?

# Minimum and maximum partition counts
topic_partitions_min := 3
topic_partitions_max := 12

# `or` condition
is_bad(topic) {
  to_number(topic.change.after.partitions_count) < topic_partitions_min
}
is_bad(topic) {
  to_number(topic.change.after.partitions_count) > topic_partitions_max
}

deny[msg] {
  # All new topics
  rc = input.resource_changes[_]
  rc.type == "confluent_kafka_topic"
  rc.mode == "managed"
  rc.change.actions[_] == "create"

  # If using the default, partitions_count is not defined
  # Defaults are always allowed to no need to check further
  # Check if partitions_count is defined, pass if not defined
  rc.change.after["partitions_count"]
  # now check if partitions_count fails either condition
  is_bad(rc)

  # Deny
  msg := sprintf(
    "Topic (%s) does not meet partition requirements",
    [rc.change.after.topic_name],
  )
}

[srenatus]

There's nothing wrong with it. If we're talking cosmetic changes, this is how I'd brush it:

import future.keywords.if
import future.keywords.in
import future.keywords.contains

# Minimum and maximum partition counts
topic_partitions_min := 3
topic_partitions_max := 12

# `or` condition
is_bad(c) if to_number(c) < topic_partitions_min
is_bad(c) if to_number(c) > topic_partitions_max

deny contains msg if {
  # All new topics
  some rc in input.resource_changes
  rc.type == "confluent_kafka_topic"
  rc.mode == "managed"
  "create" in rc.change.actions

  # let's lean into undefined: if the arg isn't defined, the eval will fail, _not_ adding a msg to deny
  is_bad(rc.change.after.partitions_count)

  # Deny
  msg := sprintf(
    "Topic (%s) does not meet partition requirements",
    [rc.change.after.topic_name],
  )
}