Blocks after every but not after some?

[mladedav]

I have just started learning the language and I want to ask why there are no braces (or more precisely they are disallowed) after some here:

any_public_networks := true if {
    some net in input.networks # some network exists and..
    net.public                 # it is public.
}

while here they are compulsory after every:

all_public_networks if {
    every net in input.networks {
        net.public
    }
}

Is there a reason for this? Cannot the braces be used (and not omitted) for both cases?

[anderseknert]

Hi there! That's a very good question :) The reason every requires a block is described briefly in the original issue for the feature: open-policy-agent/opa#2090 ... perhaps a word or two could be added about this in the docs for the every keyword 🤔

[mladedav]

I may misunderstand the issue for the feature, but I feel like it mostly talks about the domain, in my example the input.networks part in both examples. My question is why after that there needs to be an explicit block for one and not for the other.

The feature issue also does not use braces for body where the every is evaluated. There is an example like this:

allow {
  every x in { some x; input.containers[x] }
  startswith(input.containers[x].image, "hooli.com/")
}

But this does not work in current versions of OPA because of some in the domain block.

My question is about why this works:

> every x in [1, 2, 3]
| { x > 0 }
|
true

While this does not work:

> every x in [1, 2, 3]
| x > 0
|
1 error occurred: 2:1: rego_parse_error: unexpected ident token: missing body
        x > 0
        ^

End equivalently this works without braces:

> some x in [1, 2, 3] ; x == 1
+---+
| x |
+---+
| 1 |
+---+

While this does not:

> some x in [1, 2, 3] { x == 1 }
+---+
| x |
+---+
| 1 |
| 2 |
| 3 |
+---+
1 error occurred: 1:23: rego_unsafe_var_error: var x is unsafe

But if there is a semicolon before the block it actually kind of does:

> some x in [1, 2, 3] ; { x == 1 }
+---+------------+
| x | { x == 1 } |
+---+------------+
| 1 | [true]     |
| 2 | [false]    |
| 3 | [false]    |
+---+------------+

I as a new user would expect some ... in ... and every ... in ... to work in the same way syntactically, the difference being just that one is existential quantifier while the other is universal quantifier. But I am trying to understand why the grammar is so different for these two.

[tsandall]

hey @mladedav, this is a perfectly reasonable question. Take a look at the RFC for the every keyword that was published earlier this year: https://docs.google.com/document/d/1-yfgXBFVoAa2tuPTO2PYaAizjYwAnfSoLdFtVTz8oqw/edit#heading=h.4fsodqpdff07

[mladedav]

Thank you, the discussion at the end of the document is exactly what I was looking for. The reasoning makes sense although I wish these two were more similar.