Method applySecurityRuleRowFilter

runtime/security.go:688–723

applySecurityRuleRowFilter applies a row filter rule to the resolved security.

(res *ResolvedSecurity, r *runtimev1.Resource, rule *runtimev1.SecurityRuleRowFilter, td parser.TemplateData)

// applySecurityRuleRowFilter applies a row filter rule to the resolved security.
func (p *securityEngine) applySecurityRuleRowFilter(res *ResolvedSecurity, r *runtimev1.Resource, rule *runtimev1.SecurityRuleRowFilter, td parser.TemplateData) error {
	// Determine if the rule should be applied
	apply, err := evaluateConditions(r, rule.ConditionExpression, rule.ConditionKinds, rule.ConditionResources, td)
	if err != nil {
		return err
	}
	if apply != nil && !*apply {
		// there are conditions but not applicable
		return nil
	}

	// Handle raw SQL row filters
	if rule.Sql != "" {
		sql, err := parser.ResolveTemplate(rule.Sql, td, false)
		if err != nil {
			return err
		}

		if res.rowFilter == "" {
			res.rowFilter = sql
		} else {
			res.rowFilter = fmt.Sprintf("(%s) AND (%s)", res.rowFilter, sql)
		}
	}

	// Handle query expression filters
	if rule.Expression != nil {
		if res.queryFilter == nil {
			res.queryFilter = rule.Expression
		} else {
			res.queryFilter = expressionpb.AndAll(res.queryFilter, rule.Expression)
		}
	}

	return nil
}

// expandTransitiveAccessRules expands any transitive access rules in the provided list of rules.
// This involves looking up the referenced resource, determining its dependencies, and adding the necessary access rules for those dependencies.