Rule: use-object-keys

[anderseknert]

Another rule in the "let's use a built-in for that" series. Whenever a set comprehension is used to collect the keys from an object, we should recommend using object.keys instead, as it's easier to read, and less "imperative".

Avoid

package policy

import rego.v1

keys := {k | some k, _ in input.object}

# or

keys := {k | some k; input.object[k]}

Prefer

package policy

import rego.v1

keys := object.keys(input.object)

Most often, we can't really tell the type of the input used in a comprehension like this statically. Meaning that something like:

{user | some user, _ in users}

...could be collecting indices of an array, or "key" values from a set. However, collecting array indices into a set seems unlikely / pointless, and collecting values from a set into another set with no further processing is equally pointless. Obviously, we'll need to ensure that only the simples form matches, not when more things happen in the comprehension.