Cerbos REPL evaluated any as all, fixed in PR 2513

TL;DR

If the Cerbos REPL disagrees with your running PDP on nested any or all conditions, pull a fresh snapshot container with the PR 2513 fix instead of rewriting your policy. The fix was merged in PR 2513.

Steps

1. If the Cerbos REPL disagrees with your running PDP on nested any or all conditions, pull a fresh snapshot container with the PR 2513 fix instead of rewriting your policy. The engine was right; only the REPL's condition evaluation was wrong. Also note that if any CEL expression in a condition returns an error, the whole condition counts as not met, which can look like an operator bug.

When to use

You are seeing this: The engine was right; only the REPL's condition evaluation was wrong. Use this skill when you run into "Cerbos REPL evaluated any as all, fixed in PR 2513".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Edge cases

• Also note that if any CEL expression in a condition returns an error, the whole condition counts as not met, which can look like an operator bug.

Source: Issue cerbos/cerbos#2510 (closed): a user reported block condition operators not evaluating correctly in the Cerbos REPL. Maintainer haines traced it to the REPL source: there was no difference in logic between all, any, and none, so the REPL was effectively evaluating any conditions as all. The policy engine in the PDP server did not have the bug, so policies behaved correctly in production while the REPL lied. The fix was merged in PR 2513.

Verified resolution: If the Cerbos REPL disagrees with your running PDP on nested any or all conditions, pull a fresh snapshot container with the PR 2513 fix instead of rewriting your policy. The engine was right; only the REPL's condition evaluation was wrong. Also note that if any CEL expression in a condition returns an error, the whole condition counts as not met, which can look like an operator bug.

Source URL: https://github.com/cerbos/cerbos/issues/2510