fix(policy): make MatchSubjectMappings operator agnostic

service/integration/subject_mappings_test.go

@@ -834,7 +834,7 @@ func (s *SubjectMappingsSuite) TestGetMatchedSubjectMappings_InOne() {
 	s.Equal(fixtureScs.ID, sm[0].GetSubjectConditionSet().GetId())
 }
 
-func (s *SubjectMappingsSuite) TestGetMatchedSubjectMappings_DoesNotReturnNotInWhenMatches() {
+func (s *SubjectMappingsSuite) TestGetMatchedSubjectMappings_ReturnsNotInWhenMatches() {
 	fixtureScs := s.f.GetSubjectConditionSetKey("subject_condition_simple_not_in")
 	externalSelectorValue := fixtureScs.Condition.SubjectSets[0].ConditionGroups[0].Conditions[0].SubjectExternalSelectorValue
 	externalValues := fixtureScs.Condition.SubjectSets[0].ConditionGroups[0].Conditions[0].SubjectExternalValues
@@ -849,7 +849,7 @@ func (s *SubjectMappingsSuite) TestGetMatchedSubjectMappings_DoesNotReturnNotInW
 	smList, err := s.db.PolicyClient.GetMatchedSubjectMappings(context.Background(), props)
 	s.Require().NoError(err)
 	s.NotZero(smList)
-	s.Empty(smList)
+	s.Equal(fixtureScs.ID, smList[0].GetSubjectConditionSet().GetId())
 }
 
 func (s *SubjectMappingsSuite) TestGetMatchedSubjectMappings_NotInOneMatch() {
@@ -1003,7 +1003,7 @@ func (s *SubjectMappingsSuite) TestGetMatchedSubjectMappings_NotInMultiple() {
 	smList, err := s.db.PolicyClient.GetMatchedSubjectMappings(context.Background(), props)
 	s.Require().NoError(err)
 	s.NotZero(smList)
-	s.Len(smList, 2)
+	s.Len(smList, 3)
 	for _, sm := range smList {
 		if sm.GetSubjectConditionSet().GetId() == fixtureScs.ID {
 			s.Equal(expectedMappedFixture.ID, sm.GetId())

service/policy/db/subject_mappings.go

@@ -527,12 +527,7 @@ func (c PolicyDBClient) DeleteSubjectMapping(ctx context.Context, id string) (*p
 // and the JSON structure being SubjectSets -> ConditionGroups -> Conditions.
 //
 // Unfortunately we must do some slight filtering at the SQL level to avoid extreme and potentially non-rare edge cases. Subject Mappings will
-// be returned if there is any condition found among the structures that matches:
-// 1. The external field, external value, and an IN operator
-// 2. The external field, _no_ external value, and a NOT_IN operator
-//
-// Without this filtering, if a selector value was something like '.emailAddress' or '.username', every Subject is probably going to relate to that mapping
-// in some way or another. This could theoretically be every attribute in the DB if a policy admin has relied heavily on that field.
+// be returned if an external selector field matches.
 //
 // NOTE: if you have any issues, set the log level to 'debug' for more comprehensive context.
 func selectMatchedSubjectMappingsSQL(subjectProperties []*policy.SubjectProperty, logger *logger.Logger) (string, []interface{}, error) {
@@ -554,13 +549,8 @@ func selectMatchedSubjectMappingsSQL(subjectProperties []*policy.SubjectProperty
 		}
 
 		hasField := "each_condition->>'subject_external_selector_value' = '" + sp.GetExternalSelectorValue() + "'"
-		hasValue := "(each_condition->>'subject_external_values')::jsonb @> '[\"" + sp.GetExternalValue() + "\"]'::jsonb"
-		hasInOperator := "each_condition->>'operator' = 'SUBJECT_MAPPING_OPERATOR_ENUM_IN'"
-		hasNotInOperator := "each_condition->>'operator' = 'SUBJECT_MAPPING_OPERATOR_ENUM_NOT_IN'"
-		// Parses the json and matches the row if either of the following conditions are met:
-		where += "((" + hasField + " AND " + hasValue + " AND " + hasInOperator + ")" +
-			" OR " +
-			"(" + hasField + " AND NOT " + hasValue + " AND " + hasNotInOperator + "))"
+		// Parses the json and matches the row if the selector exists:
+		where += "(" + hasField + ")"
 		logger.Debug("current condition filter WHERE clause", slog.String("subject_external_selector_value", sp.GetExternalSelectorValue()), slog.String("subject_external_value", sp.GetExternalValue()), slog.String("where", where))
 	}
 	where += ")"
@@ -589,15 +579,8 @@ func selectMatchedSubjectMappingsSQL(subjectProperties []*policy.SubjectProperty
 		ToSql()
 }
 
-// GetMatchedSubjectMappings liberally returns a list of SubjectMappings based on the provided SubjectProperties. The SubjectMappings are returned
-// if there is any single condition found among the structures that matches:
-// 1. The external field, external value, and an IN operator
-// 2. The external field, _no_ external value, and a NOT_IN operator
-//
-// Without this filtering, if a field was something like '.emailAddress' or '.username', every Subject is probably going to relate to that mapping
-// in some way or another, potentially matching every single attribute in the DB if a policy admin has relied heavily on that field. There is no
-// logic applied beyond a single condition within the query to avoid business logic interpreting the supplied conditions beyond the bare minimum
-// initial filter.
+// GetMatchedSubjectMappings liberally returns a list of SubjectMappings based on the provided SubjectProperties.
+// The SubjectMappings are returned if an external selector field matches.
 //
 // NOTE: This relationship is sometimes called Entitlements or Subject Entitlements.
 // NOTE: if you have any issues, set the log level to 'debug' for more comprehensive context.

service/policy/subjectmapping/subject_mapping.proto

@@ -8,15 +8,8 @@ import "google/api/annotations.proto";
 import "common/common.proto";
 import "policy/objects.proto";
 
-// MatchSubjectMappingsRequest liberally returns a list of SubjectMappings based on the provided SubjectProperties. The SubjectMappings are returned
-// if there is any single condition found among the structures that matches for one of the provided properties:
-// 1. The external selector value, external value, and an IN operator
-// 2. The external selector value, _no_ external value, and a NOT_IN operator
-//
-// Without this filtering, if a selector value was something like '.emailAddress' or '.username', every Subject is probably going to relate to that mapping
-// in some way or another, potentially matching every single attribute in the DB if a policy admin has relied heavily on that field. There is no
-// logic applied beyond a single condition within the query to avoid business logic interpreting the supplied conditions beyond the bare minimum
-// initial filter.
+// MatchSubjectMappingsRequest liberally returns a list of SubjectMappings based on the provided SubjectProperties.
+// The SubjectMappings are returned if an external selector field matches.
 //
 // NOTE: if you have any issues, debug logs are available within the service to help identify why a mapping was or was not returned.
 message MatchSubjectMappingsRequest {