diff --git a/rego/Utils.rego b/rego/Utils.rego index ff884bd4..2947361d 100644 --- a/rego/Utils.rego +++ b/rego/Utils.rego @@ -43,40 +43,40 @@ OUsWithEvents contains OrgUnit if { OrgUnit := Parameter.value } +# Simplest case: if input.tenant_info.topLevelOU is +# non-empty, it contains the name of the top-level OU. TopLevelOU := Name if { - # Simplest case: if input.tenant_info.topLevelOU is - # non-empty, it contains the name of the top-level OU. input.tenant_info.topLevelOU != "" Name := input.tenant_info.topLevelOU } +# input.tenant_info.topLevelOU will be empty when +# no custom OUs have been created, as in this case +# the top-level OU cannot be determined via the API. +# Fortunately, in this case, we know there's literally +# only one OU, so we can grab the OU listed on any of +# the events and know that it is the top-level OU TopLevelOU := OU if { - # input.tenant_info.topLevelOU will be empty when - # no custom OUs have been created, as in this case - # the top-level OU cannot be determined via the API. - # Fortunately, in this case, we know there's literally - # only one OU, so we can grab the OU listed on any of - # the events and know that it is the top-level OU input.tenant_info.topLevelOU == "" count(OUsWithEvents) == 1 some OU in OUsWithEvents } +# Extreme edge case: input.tenant_info.topLevelOU is empty +# because no custom OUs currently exist, but multiple OUs +# are present in the events, likely due to an custom OU +# that was deleted. In this case, we have no way of determining +# which of OUs is the current OU. TopLevelOU := Name if { - # Extreme edge case: input.tenant_info.topLevelOU is empty - # because no custom OUs currently exist, but multiple OUs - # are present in the events, likely due to an custom OU - # that was deleted. In this case, we have no way of determining - # which of OUs is the current OU. input.tenant_info.topLevelOU == "" count(OUsWithEvents) > 1 Name := "" } +# Extreme edge case: no custom OUs have been made +# and the logs are empty. In this case, we really +# have no way of determining the top-level OU name. TopLevelOU := Name if { - # Extreme edge case: no custom OUs have been made - # and the logs are empty. In this case, we really - # have no way of determining the top-level OU name. input.tenant_info.topLevelOU == "" count(OUsWithEvents) == 0 Name := ""