Cerbos REPL evaluated any as all, fixed in PR 2513

If the Cerbos REPL disagrees with your running PDP on nested any or all conditions, pull a fresh snapshot container with the PR 2513 fix instead of rewriting your policy. The engine was right; only the REPL's condition evaluation was wrong. Also note that if any CEL expression in a condition returns an error, the whole condition counts as not met, which can look like an operator bug.

Context: Issue cerbos/cerbos#2510 (closed): a user reported block condition operators not evaluating correctly in the Cerbos REPL. Maintainer haines traced it to the REPL source: there was no difference in logic between all, any, and none, so the REPL was effectively evaluating any conditions as all. The policy engine in the PDP server did not have the bug, so policies behaved correctly in production while the REPL lied. The fix was merged in PR 2513.

Source: Issue cerbos/cerbos#2510 (closed): a user reported block condition operators not evaluating correctly in the Cerbos REPL. Maintainer haines traced it to the REPL source: there was no difference in logic between all, any, and none, so the REPL was effectively evaluating any conditions as all. The policy engine in the PDP server did not have the bug, so policies behaved correctly in production while the REPL lied. The fix was merged in PR 2513.

Verified resolution: If the Cerbos REPL disagrees with your running PDP on nested any or all conditions, pull a fresh snapshot container with the PR 2513 fix instead of rewriting your policy. The engine was right; only the REPL's condition evaluation was wrong. Also note that if any CEL expression in a condition returns an error, the whole condition counts as not met, which can look like an operator bug.

Source URL: https://github.com/cerbos/cerbos/issues/2510