SCAL-339139 fixes

modules/ROOT/pages/abac_rls-variables.adoc

@@ -18,6 +18,10 @@ RLS rules have a defined set of system variables such as `ts_username` or `ts_gr
 
 Formula variables are custom variables defined within ThoughtSpot that enable dynamic and context-aware logic in RLS rules. They are assigned at the user level during session creation for the ABAC pattern, although they can be set at Org and data model levels as well.
 
+=== Supported operators
+
+RLS rules that use the `ts_var()` function support only equal to (`=`) and not equal to (`!=`) operators. Internally, `=` translates to `IN (...)` and `!=` translates to `NOT IN (...)` in the generated SQL, because `ts_var()` returns a list of values. Comparison operators such as `>` (greater than), `<` (less than), `>=` (greater than or equal to), and `\<=` (less than or equal to) are not supported and do not resolve in RLS rules.
+
 ////
 In embedded analytics scenarios, where each user may require different data access, administrators can assign security attributes and rules on a per-user basis. For these use cases, administrators can implement a JWT-based ABAC model combined with RLS to enforce data security using dynamic attributes derived from formula variables.
 
@@ -26,10 +30,12 @@ In the ABAC via RLS with variables method, administrators add formula variables
 
 === Implementation steps
 
+////
 [NOTE]
 ====
 Formula variables are available on ThoughtSpot starting from 10.15.0.cl. If this feature is not enabled on your instance, contact ThoughtSpot Support.
 ====
+////
 
 The ABAC implementation with formula variables and RLS rules includes the following steps:
 
@@ -84,6 +90,7 @@ The variable update API (`/api/rest/2.0/template/variables/{identifier}/update`)
 
 Variable values are set either by xref:abac_rls-variables.adoc#_create_an_abac_token_request_with_variable_attributes[generating a token] using the `/api/rest/2.0/auth/token/custom` API endpoint or via the Update Variable Values REST API.
 
+
 == Add or update RLS rules with variable references
 RLS rules are defined on Table objects:
 
@@ -93,7 +100,7 @@ RLS rules are defined on Table objects:
 
 [NOTE]
 ====
-Variable values are set through the token request. The RLS rule specifies how the values will be used in the generated RLS `WHERE` clauses in the SQL.
+* Variable values are set through the token request. The RLS rule specifies how the values will be used in the generated RLS `WHERE` clauses in the SQL.
 ====
 
 === RLS rule examples
@@ -138,18 +145,26 @@ In this example, users can access data if they are in the "data developers" grou
 
 ==== Variables with numeric and date data types
 
-The following rule enforces a numeric threshold and restricts access to rows where the Revenue value is less than or equal to the value provided by the `revenue_cap_var` variable.
+The following rule restricts access to rows where the `country` column matches one of the values provided by the `country_var` variable, for a `VARCHAR` column.
 
 ----
-Revenue <= to_double(ts_var(revenue_cap_var))
+country = ts_var(country_var)
 ----
 
-The following rule restricts access to rows where the `date_column` is within the range defined by the `start_date_var` and `end_date_var` variables. Only rows with dates greater than or equal to the start date and less than or equal to the end date specified for these variables will be visible for the user.
+The following rule restricts access to rows where the `Revenue` column matches one of the values provided by `revenue_cap_var`. Use the `to_double()` cast function to ensure the string values from the token are compared correctly against a numeric column.
 
 ----
-(date_column >= ts_var(start_date_var)) AND (date_column <= ts_var(end_date_var))
+Revenue = to_double(ts_var(revenue_cap_var))
 ----
 
+The following rule restricts access to rows where the `date_column` matches one of the values provided by the `date_var` variable, for a `DATE` column.
+
+----
+date_column = ts_var(date_var)
+----
+
+Range comparisons, such as filtering for dates before or after a value provided by a variable, are not supported because RLS rules with `ts_var()` only support the `=` and `!=` operators.
+
 == Create an ABAC token request with variable attributes
 
 To set or update variable values for a user, use the `POST /api/rest/2.0/auth/token/custom` endpoint when logging in the user.
@@ -158,7 +173,7 @@ You can also use the `/api/rest/2.0/template/variables/{identifier}/update-value
 
 The variable attributes defined in the token request take effect only if they are referenced in an RLS rule. If the variables are not used in any formula or RLS rule, they have no impact on data access. Before generating the request with variable attributes, ensure that the xref:abac_rls-variables.adoc#_add_or_update_rls_rules_with_variable_references[variables are added to the RLS rules] for the table.
 
-In the token request, include the following properties along with the `username`, xref:trusted-auth-secret-key.adoc[`secret_key`]:
+In the token request, include the following properties along with the `username` and xref:trusted-auth-secret-key.adoc[`secret_key`]:
 
 * `variable_values`
 * `persist_option`
@@ -297,24 +312,18 @@ You can simplify user provisioning and programmatically manage user creation and
 To restrict the scope of variable attributes and rules to a specific Org context and object, define `org_identifier` and `objects`.
 
 ==== Apply to specific objects
-To apply variable entitlements to a specific object, specify the object IDs in the `objects` array as shown in this example:
+To apply variable entitlements to a specific object, specify the object ID in the `objects` array as shown in this example. The API supports only the `LOGICAL_TABLE` object type:
 
 [source,JSON]
 ----
 "objects": [
-   {
-     "type": "{OBJECT_TYPE}",
-     "identifier": "{id or name of the object}"
-   },
    {
      "type": "LOGICAL_TABLE",
      "identifier": "9b751df2-d344-4850-9756-18535797378c"
    }
 ]
 ----
 
-The API supports only the `LOGICAL_TABLE` object type.
-
 If the object ID is not specified in the API request, the variable values will be applied to all formulas and rules that use those variables, across all objects in the Org for that user.
 
 The following example shows the request body for generating a token with formula variable attributes scoped to a particular Model object:

modules/ROOT/pages/just-in-time-provisioning.adoc

@@ -143,7 +143,7 @@ If using `ts_groups` in a RLS Rule, the group names must match exactly with the
 
 Variable values are used as part of the xref:abac_rls-variables.adoc[ABAC via RLS variables] pattern, which allows assigning many values to multiple variables via the xref:abac_rls-variables.adoc#_create_an_abac_token_request_with_variable_attributes[Custom Token request].
 
-There is also a direct xref:variables.adoc#_update_variable_values[variable values update REST API] for more complex or bulk updates.
+There is also a direct xref:variables.adoc#_assign_or_update_variable_values[variable values update REST API] for more complex or bulk updates.
 
 
 

modules/ROOT/pages/metadata-parameterization.adoc

@@ -12,7 +12,7 @@ Metadata parameterization with variables allows administrators to reuse and prop
 
 == Before you begin
 
-* Ensure that xref:variables.adoc[variables are available] on your instance. You can use the xref:variables.adoc#_get_details_of_variables[variable search API] to get a list of variables.
+* Ensure that xref:variables.adoc[variables are available] on your instance. You can use the xref:variables.adoc#_get_variables[variable search API] to get a list of variables.
 * Ensure that you have edit access to the Connections and Tables to which you want to assign variables.
 
 == How to parameterize objects

modules/ROOT/pages/variables.adoc

@@ -13,7 +13,7 @@ Variables allow you to substitute values for specific properties of a metadata o
 ThoughtSpot provides predefined system variables such as `ts_username` and `ts_groups`, which can be used in formulas for data security. Additionally, you can configure variables programmatically via REST APIs, and later use these variables for the following purposes:
 
 * To xref:metadata-parameterization.adoc[parameterize metadata object properties] and xref:publishing-overview.adoc[publish artifacts across Orgs].
-* To implement xref:rls-rules.adoc[Row Level Security (RLS) rules] using formula variables and customize data for a specific Org, Model, or user. You can also pass variable attributes as security entitlements in JWT tokens for xref:abac-user-parameters.adoc#_abac_via_rls_with_formula_variables[ABAC implementation].
+* To implement xref:rls-rules.adoc[Row Level Security (RLS) rules] using formula variables and customize data for a specific Org, Model, or user. You can also pass variable attributes as security entitlements in JWT tokens for xref:abac_rls-variables.adoc[ABAC implementation].
 * To update properties of a Connection or Table directly in the TML.
 
 === Variable types
@@ -33,8 +33,14 @@ This feature is disabled by default. To enable this option, contact ThoughtSpot
 * `FORMULA_VARIABLE` +
 Formula variables allow you to parameterize logic in formulas and rules, and can be used in  different contexts to dynamically populate values.
 Formula variables can be set for an Org, user, or Model and can be used in RLS rules with the `ts_var` function.
++
+The Variable API allows administrators to define formula variables for the `VARCHAR`, `INT32`, `INT64`, `DOUBLE`, `DATE`, and `DATE_TIME` data types. Formula variables for `BOOLEAN` and `TIME` data types are not supported.
 
-The Variable API allows administrators to define formula variables for the `VARCHAR`, `BIGINT`, `INT`, `FLOAT`, `DOUBLE`, `BOOLEAN`, `DATE`, `DATE_TIME`, and `TIME` data types.
++
+[NOTE]
+====
+Comparison operators such as `>` (greater than), `<` (less than), `>=` (greater than or equal to), and `\<=` (less than or equal to) are not supported in RLS rules with the `ts_var()` function, regardless of the variable data type.
+====
 
 === APIs for Variable creation and management
 The following REST API endpoints are available for variable creation and management:
@@ -44,9 +50,9 @@ Allows xref:variables.adoc#_create_a_variable[creating variables].
 * `POST /api/rest/2.0/template/variables/{identifier}/update`  +
 Allows xref:variables.adoc#_update_variable_name[updating the variable name].
 * `POST /api/rest/2.0/template/variables/{identifier}/update-values` +
-Allows xref:variables.adoc#_update_variable_values[assigning values to a variable].
+Allows xref:variables.adoc#_assign_or_update_variable_values[assigning values to a variable].
 * `POST /api/rest/2.0/template/variables/search`  +
-xref:variables.adoc#_get_details_of_variables[Retrieves variables available in your Org context].
+xref:variables.adoc#_get_variables[Retrieves variables available in your Org context].
 * `POST /api/rest/2.0/template/variables/delete` +
 xref:variables.adoc#_delete_a_variable[Deletes the variables] specified in the API request.
 
@@ -230,7 +236,7 @@ If the update operation is successful, the API returns a 204 response to indicat
 
 == Assign or update variable values
 
-To assign values to a variable, use the +++<a href="{{navprefix}}/restV2-playground?apiResourceId=http%2Fapi-endpoints%2Fvariable%2Fupdate-variable-values"> /api/rest/2.0/template/variables/{identifier}/update-values </a> +++ API endpoint. For example, you can assign values for a formula variable and limit its scope to a specific Org, Model, or user context. Similarly, for the `CONNECTION_PROPERTY_PER_PRINCIPAL` variable type, you can define the principal type as user or user group, and specifiy the ID of the principal object.
+To assign values to a variable, use the +++<a href="{{navprefix}}/restV2-playground?apiResourceId=http%2Fapi-endpoints%2Fvariable%2Fupdate-variable-values"> /api/rest/2.0/template/variables/{identifier}/update-values </a> +++ API endpoint. For example, you can assign values for a formula variable and limit its scope to a specific Org, Model, or user context. Similarly, for the `CONNECTION_PROPERTY_PER_PRINCIPAL` variable type, you can define the principal type as user or user group, and specify the ID of the principal object.
 
 The API also allows you to edit, replace, or reset the values and scope assigned to a variable.
 
@@ -273,7 +279,7 @@ Applicable to the `CONNECTION_PROPERTY_PER_PRINCIPAL` variable type.
 
 * `model_identifier`: __Optional__. ID or name of the Model to which the variables configuration must be applied. Applicable to formula variables.
 
-* `priority`: __Optional__. Priority assigned to this value. If more than one entity matches the conditions during variable resolution, the system determines which entity’s value takes effect based on the value assigned to the `priority` parameter. For example, if a variable is configured for both the user and their group, the system determines which value to based on the assigned priority. +
+* `priority`: __Optional__. Priority assigned to this value. If more than one entity matches the conditions during variable resolution, the system determines which entity’s value takes effect based on the value assigned to the `priority` parameter. For example, if a variable is configured for both the user and their group, the system determines which value to use based on the assigned priority. +
 Applicable to the `CONNECTION_PROPERTY_PER_PRINCIPAL` variable type. +
 ||
 |=====
@@ -294,7 +300,7 @@ curl -X POST \
   "variable_assignment": [
     {
       "assigned_values": [
-        "SALES_SCHEMA_A",
+        "SALES_SCHEMA_A"
       ],
       "org_identifier": "Primary"
     },
@@ -339,7 +345,7 @@ curl -X POST \
         "OrgB_account"
       ],
       "org_identifier": "OrgB"
-    },
+    }
   ],
   "operation": "ADD"
 }'
@@ -383,7 +389,7 @@ curl -X POST \
     }
   ],
   "operation": "ADD"
-}
+}'
 ----
 
 If the variable update is successful, the API returns 204 response code. you can use these variables in link:https://docs.thoughtspot.com/cloud/latest/rls-variables-reference[RLS rules, window=_blank].
@@ -492,7 +498,7 @@ curl -X POST \
     "table_var_2",
     "table_var_3"
   ]
-}
+}'
 ----
 
 If the API request is successful, ThoughtSpot returns a 204 response code.