test: add tests for isAnyNotIn function and lazy evaluate it (#7972)

* Lazy evaluate isAnyNotIn function

Signed-off-by: Chandan-DK <chandandk468@gmail.com>

* Add unit tests

Signed-off-by: Chandan-DK <chandandk468@gmail.com>

* add empty string test and rephrase a test name

Signed-off-by: Chandan-DK <chandandk468@gmail.com>

---------

Signed-off-by: Chandan-DK <chandandk468@gmail.com>
Co-authored-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>

pkg/engine/variables/operator/anyin.go

@@ -200,16 +200,21 @@ func isAnyIn(key []string, value []string) bool {
 
 // isAnyNotIn checks if any of the values in S1 are not in S2
 func isAnyNotIn(key []string, value []string) bool {
-	found := 0
 	for _, valKey := range key {
+		matchFound := false
+
 		for _, valValue := range value {
 			if wildcard.Match(valKey, valValue) || wildcard.Match(valValue, valKey) {
-				found++
+				matchFound = true
 				break
 			}
 		}
+
+		if !matchFound {
+			return true
+		}
 	}
-	return found < len(key)
+	return false
 }
 
 func (anyin AnyInHandler) validateValueWithBoolPattern(_ bool, _ interface{}) bool {

pkg/engine/variables/operator/anynotin_test.go

@@ -0,0 +1,134 @@
+package operator
+
+import (
+	"testing"
+
+	"github.com/go-logr/logr"
+	"github.com/kyverno/kyverno/pkg/engine/context"
+)
+
+func TestAnyNotInHandler_Evaluate(t *testing.T) {
+	type fields struct {
+		ctx context.EvalInterface
+		log logr.Logger
+	}
+	type args struct {
+		key   interface{}
+		value interface{}
+	}
+	tests := []struct {
+		name   string
+		fields fields
+		args   args
+		want   bool
+	}{
+		{
+			name: "key is string and in value",
+			args: args{
+				key:   "kyverno",
+				value: "kyverno",
+			},
+			want: false,
+		},
+		{
+			name: "key is string and in value",
+			args: args{
+				key:   "kube-system",
+				value: []interface{}{"default", "kube-*"},
+			},
+			want: false,
+		},
+		{
+			name: "key is string and not in value",
+			args: args{
+				key:   "kyverno",
+				value: "default",
+			},
+			want: true,
+		},
+
+		{
+			name: "key is int and in value",
+			args: args{
+				key:   64,
+				value: "64",
+			},
+			want: false,
+		},
+		{
+			name: "key is int and not in value",
+			args: args{
+				key:   64,
+				value: "default",
+			},
+			want: true,
+		},
+		{
+			name: "key is array and in value",
+			args: args{
+				key:   []interface{}{"kube-system", "kube-public"},
+				value: "kube-*",
+			},
+			want: false,
+		},
+		{
+			name: "key is array and partially in value",
+			args: args{
+				key:   []interface{}{"kube-system", "default"},
+				value: "kube-system",
+			},
+			want: true,
+		},
+		{
+			name: "key is array and not in value",
+			args: args{
+				key:   []interface{}{"default", "kyverno"},
+				value: "kube-*",
+			},
+			want: true,
+		},
+		{
+			name: "key and value are array and not in value",
+			args: args{
+				key:   []interface{}{"default", "kyverno"},
+				value: []interface{}{"kube-*", "kube-system"},
+			},
+			want: true,
+		},
+		{
+			name: "key and value are array and partially in value",
+			args: args{
+				key:   []interface{}{"default", "kyverno"},
+				value: []interface{}{"kube-*", "ky*"},
+			},
+			want: true,
+		},
+		{
+			name: "key and value are arrays, key is an empty array but is in value",
+			args: args{
+				key:   []interface{}{},
+				value: []interface{}{"default", "kyverno"},
+			},
+			want: false,
+		},
+		{
+			name: "key is an empty string and value is an array, key is not in value",
+			args: args{
+				key:   "",
+				value: []interface{}{"default", "kyverno"},
+			},
+			want: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			anynotin := AnyNotInHandler{
+				ctx: tt.fields.ctx,
+				log: tt.fields.log,
+			}
+			if got := anynotin.Evaluate(tt.args.key, tt.args.value); got != tt.want {
+				t.Errorf("Evaluate() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}