ewilliams28/releases
1
0
Fork 0
mirror of https://github.com/open-policy-agent/opa.git synced 2026-08-12 19:32:48 -06:00
Code Issues Packages Projects Releases Wiki Activity

docs: Clarify glob.match indexing requirements (#8935)

Browse Source 
### Why the changes in this PR are needed?

The rule indexing docs say the indexer recognizes the normal `*`
operator, but two further conditions gate indexing and neither is
documented: the `*` must form a complete delimiter-separated segment,
and a `null` delimiter is never indexed. Policies that follow the
documented rule can silently miss the index fast path.

Fixes #8209

### What are the changes in this PR?

Docs only. Three sentences and three rows added to the "Glob statements"
section of `docs/docs/policy-performance.md`. The other table rows are
unchanged apart from pipe realignment, which markdownlint requires
because the new row is wider than the column.

### Notes to assist PR review:

Behavior confirmed against `globPatternToArray`,
`globDelimiterToString`, and `splitStringEscaped` in `v1/ast/index.go`.

### Further comments:

None.

---------

Signed-off-by: Roshan <rosh.s568@gmail.com>
This commit is contained in:
Roshan Singh
2026-08-05 19:05:18 +05:30
committed by GitHub
parent 40dd2b90d2
commit 346f288c32
1 changed files with 9 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/docs/policy-performance.md
+9 -6
View File
@@ -135,13 +135,16 @@ For simple equality statements (`=` and `==`) to be indexed one side must be a n
#### Glob statements
For `glob.match(pattern, delimiter, match)` statements to be indexed the pattern must be recognized by the indexer and the match be a non-nested reference that does not contain any variables. The indexer recognizes patterns containing the normal glob (`*`) operator but not the super glob (`**`) or character pattern matching operators.
For `glob.match(pattern, delimiter, match)` statements to be indexed the pattern must be recognized by the indexer and the match be a non-nested reference that does not contain any variables. The indexer recognizes patterns containing the normal glob (`*`) operator but not the super glob (`**`) or character pattern matching operators. The `*` operator is only recognized when it forms a complete delimiter-separated segment of the pattern; for example, `"a*"` with delimiter `[":"]` is not indexed because the `*` is embedded in a larger segment. When several delimiters are given, any of them separates a segment. Statements that pass `null` as the delimiter are never indexed.
| Expression | Indexed | Notes |
| -------------------------------------------- | ------- | -------------------------- |
| `glob.match("foo:*:bar", [":"], input.x)` | yes | |
| `glob.match("foo:**:bar", [":"], input.x)` | no | pattern contains `**` |
| `glob.match("foo:*:bar", [":"], input.x[i])` | no | match contains variable(s) |
| Expression | Indexed | Notes |
| ---------------------------------------------- | ------- | -------------------------- |
| `glob.match("foo:*:bar", [":"], input.x)` | yes | |
| `glob.match("foo:**:bar", [":"], input.x)` | no | pattern contains `**` |
| `glob.match("foo:*:bar", [":"], input.x[i])` | no | match contains variable(s) |
| `glob.match("a*", [":"], input.x)` | no | `*` embedded in a segment |
| `glob.match("foo:*/bar", [":", "/"], input.x)` | yes | any delimiter separates |
| `glob.match("foo:*:bar", null, input.x)` | no | delimiter is `null` |
#### Membership (`in`) statements