synapse 2.155.0__py311-none-any.whl → 2.156.0__py311-none-any.whl

synapse/tests/test_lib_agenda.py

@@ -496,51 +496,6 @@ class AgendaTest(s_t_utils.SynTest):
 
                     self.len(0, [appt for (iden, appt) in appts if iden == badguid2])
 
-    async def test_cron_perms(self):
-
-        async with self.getTestCore() as core:
-
-            visi = await core.auth.addUser('visi')
-            newb = await core.auth.addUser('newb')
-            async with core.getLocalProxy(user='visi') as proxy:
-
-                cdef = {'storm': 'inet:ipv4', 'reqs': {'hour': 2}}
-                with self.raises(s_exc.AuthDeny):
-                    await proxy.addCronJob(cdef)
-
-                await visi.addRule((True, ('cron', 'add')))
-                cron0 = await proxy.addCronJob(cdef)
-                cron0_iden = cron0.get('iden')
-
-                cdef = {'storm': 'inet:ipv6', 'reqs': {'hour': 2}}
-                cron1 = await proxy.addCronJob(cdef)
-                cron1_iden = cron1.get('iden')
-
-                await proxy.delCronJob(cron0_iden)
-
-                cdef = {'storm': '[test:str=foo]', 'reqs': {'now': True},
-                        'incunit': 'month',
-                        'incvals': 1}
-                await self.asyncraises(s_exc.BadConfValu, proxy.addCronJob(cdef))
-
-            async with core.getLocalProxy(user='newb') as proxy:
-
-                with self.raises(s_exc.AuthDeny):
-                    await proxy.delCronJob(cron1_iden)
-
-                self.eq(await proxy.listCronJobs(), ())
-                await newb.addRule((True, ('cron', 'get')))
-                self.len(1, await proxy.listCronJobs())
-
-                with self.raises(s_exc.AuthDeny):
-                    await proxy.disableCronJob(cron1_iden)
-
-                await newb.addRule((True, ('cron', 'set')))
-                self.none(await proxy.disableCronJob(cron1_iden))
-
-                await newb.addRule((True, ('cron', 'del')))
-                await proxy.delCronJob(cron1_iden)
-
     async def test_agenda_stop(self):
 
         async with self.getTestCore() as core:
@@ -727,7 +682,8 @@ class AgendaTest(s_t_utils.SynTest):
 
         async with self.getTestCore() as core:
 
-            derp = await core.auth.addUser('derp')
+            lowuser = await core.addUser('lowuser')
+            lowuser = lowuser.get('iden')
 
             msgs = await core.stormlist('cron.add --hourly 32 { $lib.print(woot) }')
             self.stormHasNoWarnErr(msgs)
@@ -735,14 +691,23 @@ class AgendaTest(s_t_utils.SynTest):
             cdef = await core.callStorm('for $cron in $lib.cron.list() { return($cron) }')
             self.eq(cdef['creator'], core.auth.rootuser.iden)
 
-            opts = {'vars': {'derp': derp.iden}}
-            cdef = await core.callStorm('for $cron in $lib.cron.list() { return($cron.set(creator, $derp)) }', opts=opts)
-
-            self.eq(cdef['creator'], derp.iden)
-
-            async with core.getLocalProxy(user='derp') as proxy:
-                with self.raises(s_exc.AuthDeny):
-                    await proxy.editCronJob(cdef.get('iden'), 'creator', derp.iden)
+            opts = {'vars': {'lowuser': lowuser}}
+            cdef = await core.callStorm('for $cron in $lib.cron.list() { return($cron.set(creator, $lowuser)) }',
+                                        opts=opts)
+            self.eq(cdef['creator'], lowuser)
+
+            opts = {'user': lowuser, 'vars': {'iden': cdef.get('iden'), 'lowuser': lowuser}}
+            q = '$cron = $lib.cron.get($iden) return ( $cron.set(creator, $lowuser) )'
+            msgs = await core.stormlist(q, opts=opts)
+            # XXX FIXME - This is an odd message since the new creator does not implicitly have
+            # access to the cronjob that is running as them.
+            self.stormIsInErr('Provided iden does not match any valid authorized cron job.', msgs)
+
+            await core.addUserRule(lowuser, (True, ('cron', 'get')))
+            opts = {'user': lowuser, 'vars': {'iden': cdef.get('iden'), 'lowuser': lowuser}}
+            q = '$cron = $lib.cron.get($iden) return ( $cron.set(creator, $lowuser) )'
+            msgs = await core.stormlist(q, opts=opts)
+            self.stormIsInErr('must have permission cron.set.creator', msgs)
 
     async def test_agenda_fatal_run(self):
 

synapse/tests/test_lib_aha.py

@@ -1115,3 +1115,100 @@ class AhaTest(s_test.SynTest):
                     online = svcinfo.get('online')
                     self.nn(online)
                     self.true(ready)
+
+    async def test_aha_reprovision(self):
+        with self.withNexusReplay() as stack:
+            with self.getTestDir() as dirn:
+                aha00dirn = s_common.gendir(dirn, 'aha00')
+                aha01dirn = s_common.gendir(dirn, 'aha01')
+                svc0dirn = s_common.gendir(dirn, 'svc00')
+                svc1dirn = s_common.gendir(dirn, 'svc01')
+                async with await s_base.Base.anit() as cm:
+                    aconf = {
+                        'aha:name': 'aha',
+                        'aha:network': 'loop.vertex.link',
+                        'provision:listen': 'ssl://aha.loop.vertex.link:0'
+                    }
+                    name = aconf.get('aha:name')
+                    netw = aconf.get('aha:network')
+                    dnsname = f'{name}.{netw}'
+
+                    aha = await s_aha.AhaCell.anit(aha00dirn, conf=aconf)
+                    await cm.enter_context(aha)
+
+                    addr, port = aha.provdmon.addr
+                    # update the config to reflect the dynamically bound port
+                    aha.conf['provision:listen'] = f'ssl://{dnsname}:{port}'
+
+                    # do this config ex-post-facto due to port binding...
+                    host, ahaport = await aha.dmon.listen(f'ssl://0.0.0.0:0?hostname={dnsname}&ca={netw}')
+                    aha.conf['aha:urls'] = (f'ssl://{dnsname}:{ahaport}',)
+
+                    onetime = await aha.addAhaSvcProv('00.svc', provinfo=None)
+                    sconf = {'aha:provision': onetime}
+                    s_common.yamlsave(sconf, svc0dirn, 'cell.yaml')
+                    svc0 = await s_cell.Cell.anit(svc0dirn, conf=sconf)
+                    await cm.enter_context(svc0)
+
+                    onetime = await aha.addAhaSvcProv('01.svc', provinfo={'mirror': 'svc'})
+                    sconf = {'aha:provision': onetime}
+                    s_common.yamlsave(sconf, svc1dirn, 'cell.yaml')
+                    svc1 = await s_cell.Cell.anit(svc1dirn, conf=sconf)
+                    await cm.enter_context(svc1)
+
+                    # Ensure that services have connected
+                    await asyncio.wait_for(svc1.nexsroot._mirready.wait(), timeout=6)
+                    await svc1.sync()
+
+                    # Get Aha services
+                    snfo = await aha.getAhaSvc('01.svc.loop.vertex.link')
+                    svcinfo = snfo.get('svcinfo')
+                    ready = svcinfo.get('ready')
+                    self.true(ready)
+
+                    await aha.fini()
+
+                # Now re-deploy the AHA Service and re-provision the two cells
+                # with the same AHA configuration
+                async with await s_base.Base.anit() as cm:
+                    aconf = {
+                        'aha:name': 'aha',
+                        'aha:network': 'loop.vertex.link',
+                        'provision:listen': 'ssl://aha.loop.vertex.link:0'
+                    }
+                    name = aconf.get('aha:name')
+                    netw = aconf.get('aha:network')
+                    dnsname = f'{name}.{netw}'
+
+                    aha = await s_aha.AhaCell.anit(aha01dirn, conf=aconf)
+                    await cm.enter_context(aha)
+
+                    addr, port = aha.provdmon.addr
+                    # update the config to reflect the dynamically bound port
+                    aha.conf['provision:listen'] = f'ssl://{dnsname}:{port}'
+
+                    # do this config ex-post-facto due to port binding...
+                    host, ahaport = await aha.dmon.listen(f'ssl://0.0.0.0:0?hostname={dnsname}&ca={netw}')
+                    aha.conf['aha:urls'] = (f'ssl://{dnsname}:{ahaport}',)
+
+                    onetime = await aha.addAhaSvcProv('00.svc', provinfo=None)
+                    sconf = {'aha:provision': onetime}
+                    s_common.yamlsave(sconf, svc0dirn, 'cell.yaml')
+                    svc0 = await s_cell.Cell.anit(svc0dirn, conf=sconf)
+                    await cm.enter_context(svc0)
+
+                    onetime = await aha.addAhaSvcProv('01.svc', provinfo={'mirror': 'svc'})
+                    sconf = {'aha:provision': onetime}
+                    s_common.yamlsave(sconf, svc1dirn, 'cell.yaml')
+                    svc1 = await s_cell.Cell.anit(svc1dirn, conf=sconf)
+                    await cm.enter_context(svc1)
+
+                    # Ensure that services have connected
+                    await asyncio.wait_for(svc1.nexsroot._mirready.wait(), timeout=6)
+                    await svc1.sync()
+
+                    # Get Aha services
+                    snfo = await aha.getAhaSvc('01.svc.loop.vertex.link')
+                    svcinfo = snfo.get('svcinfo')
+                    ready = svcinfo.get('ready')
+                    self.true(ready)

synapse/tests/test_lib_ast.py

@@ -656,6 +656,109 @@ class AstTest(s_test.SynTest):
             self.len(0, await core.nodes('[ inet:ipv4=1.2.3.4 ] :foo -> *'))
             self.len(0, await core.nodes('[ inet:ipv4=1.2.3.4 ] :asn -> inet:asn'))
 
+    async def test_ast_edge_walknjoin(self):
+
+        async with self.getTestCore() as core:
+
+            await core.nodes('[test:str=foo :hehe=bar +(foobar)> { [ test:str=baz ] }]')
+
+            nodes = await core.nodes('test:str=foo --+> *')
+            self.len(2, nodes)
+            self.eq(('test:str', 'foo'), nodes[0].ndef)
+            self.eq(('test:str', 'baz'), nodes[1].ndef)
+
+            nodes = await core.nodes('test:str=baz <+-- *')
+            self.len(2, nodes)
+            self.eq(('test:str', 'baz'), nodes[0].ndef)
+            self.eq(('test:str', 'foo'), nodes[1].ndef)
+
+            nodes = await core.nodes('test:str=foo -(foobar)+> *')
+            self.len(2, nodes)
+            self.eq(('test:str', 'foo'), nodes[0].ndef)
+            self.eq(('test:str', 'baz'), nodes[1].ndef)
+
+            nodes = await core.nodes('test:str=baz <+(foobar)- *')
+            self.len(2, nodes)
+            self.eq(('test:str', 'baz'), nodes[0].ndef)
+            self.eq(('test:str', 'foo'), nodes[1].ndef)
+
+            await core.nodes('test:str=foo [ +(coffeeone)> { [ test:str=arabica ] } ]')
+            await core.nodes('test:str=foo [ +(coffeetwo)> { [ test:str=robusta ] } ]')
+            await core.nodes('[ test:int=28 +(coffeethree)> { test:str=arabica } ]')
+
+            nodes = await core.nodes('test:str=foo -((coffeeone, coffeetwo))+> *')
+            self.len(3, nodes)
+            self.eq(('test:str', 'foo'), nodes[0].ndef)
+            self.eq(('test:str', 'arabica'), nodes[1].ndef)
+            self.eq(('test:str', 'robusta'), nodes[2].ndef)
+
+            await core.nodes('[test:str=neato :hehe=haha +(stuff)> { [inet:ipv4=1.2.3.0/24] }]')
+            await core.nodes('[test:str=burrito :hehe=stuff <(stuff)+ { test:str=baz }]')
+            await core.nodes('test:str=neato [ <(other)+ { test:str=foo } ]')
+
+            nodes = await core.nodes('$edge=stuff test:str=neato -($edge)+> *')
+            self.len(257, nodes)
+            self.eq(('test:str', 'neato'), nodes[0].ndef)
+            for n in nodes[1:]:
+                self.eq('inet:ipv4', n.ndef[0])
+
+            nodes = await core.nodes('test:str=neato | tee { --+> * } { <+(other)- * }')
+            self.len(259, nodes)
+            self.eq(('test:str', 'neato'), nodes[0].ndef)
+            self.eq(('test:str', 'foo'), nodes[-1].ndef)
+            self.eq(('test:str', 'neato'), nodes[-2].ndef)
+
+            for n in nodes[1:257]:
+                self.eq('inet:ipv4', n.ndef[0])
+
+            await core.nodes('test:str=foo [ +(wat)> {[test:int=12]}]')
+
+            nodes = await core.nodes('test:str=foo -(other)+> test:str')
+            self.len(2, nodes)
+            self.eq(('test:str', 'foo'), nodes[0].ndef)
+            self.eq(('test:str', 'neato'), nodes[1].ndef)
+
+            with self.raises(s_exc.BadSyntax):
+                await core.nodes('test:str=neato --+> test:str')
+
+            with self.raises(s_exc.BadSyntax):
+                await core.nodes('test:str <+-- test:str')
+
+            nodes = await core.nodes('test:str=foo -(*)+> test:str')
+            self.len(5, nodes)
+            self.eq(('test:str', 'foo'), nodes[0].ndef)
+            ndefs = [n.ndef for n in nodes[1:]]
+            self.isin(('test:str', 'arabica'), ndefs)
+            self.isin(('test:str', 'robusta'), ndefs)
+            self.isin(('test:str', 'baz'), ndefs)
+            self.isin(('test:str', 'neato'), ndefs)
+            self.notin(('test:int', 12), ndefs)
+
+            nodes = await core.nodes('test:str=foo -(*)+> *')
+            self.len(6, nodes)
+            self.eq(('test:str', 'foo'), nodes[0].ndef)
+            ndefs = [n.ndef for n in nodes[1:]]
+            self.isin(('test:int', 12), ndefs)
+
+            nodes = await core.nodes('test:str=arabica <+(*)- test:str')
+            self.len(2, nodes)
+            self.eq(('test:str', 'arabica'), nodes[0].ndef)
+            self.eq(('test:str', 'foo'), nodes[1].ndef)
+
+            nodes = await core.nodes('test:str=arabica <+(*)- *')
+            self.len(3, nodes)
+            self.eq(('test:str', 'arabica'), nodes[0].ndef)
+            ndefs = [n.ndef for n in nodes[1:]]
+            self.isin(('test:str', 'foo'), ndefs)
+            self.isin(('test:int', 28), ndefs)
+
+            await core.nodes('test:str=arabica [ <(place)+ { [ test:str=coffeebar] } ]')
+            nodes = await core.nodes('test:str=arabica <+((place, coffeeone))- *')
+            self.len(3, nodes)
+            self.eq(('test:str', 'arabica'), nodes[0].ndef)
+            self.eq(('test:str', 'coffeebar'), nodes[1].ndef)
+            self.eq(('test:str', 'foo'), nodes[2].ndef)
+
     async def test_ast_lift_filt_array(self):
 
         async with self.getTestCore() as core:
@@ -1738,6 +1841,243 @@ class AstTest(s_test.SynTest):
             evnt = firs[0]
             self.eq(evnt[1].get('data'), {'total': 3})
 
+    async def test_ast_emptyblock(self):
+
+        async with self.getTestCore() as core:
+            q = '''
+            empty {
+                $lib.print("a fancy but empty block")
+            }
+            '''
+            msgs = await core.stormlist(q)
+            self.stormIsInPrint('a fancy but empty block', msgs)
+
+            q = '''
+            empty {
+                [test:str=neato]
+            }
+            [ :hehe=stuff ]
+            '''
+            msgs = await core.stormlist(q)
+            nodes = [m[1] for m in msgs if m[0] == 'node']
+            self.len(1, nodes)
+            props = nodes[0][1]['props']
+            self.eq('stuff', props.get('hehe'))
+
+            q = '''
+                empty {
+                    $lib.print("some empty block")
+                }
+                [test:str=synapse]
+            '''
+            msgs = await core.stormlist(q)
+            nodes = [m[1] for m in msgs if m[0] == 'node']
+            self.len(1, nodes)
+            self.stormIsInPrint('some empty block', msgs)
+
+            q = '''
+                for $i in $lib.range(10) {
+                    if ($i > 5) {
+                        [test:int=$i]
+                    }
+                } | empty { $lib.print(`count is {$i}`) }
+            '''
+            msgs = await core.stormlist(q)
+            self.stormNotInPrint('count is', msgs)
+
+            q = '''
+                for $i in $lib.range(10) {
+                    $lib.print(`count is {$i}`)
+                } | empty { $lib.print(`pipeline is empty`) }
+            '''
+            msgs = await core.stormlist(q)
+            self.stormIsInPrint('count is', msgs)
+            self.stormIsInPrint('pipeline is empty', msgs)
+
+            q = '''
+            [test:str=burrito]
+            empty {
+                [test:str=awesome]
+            }
+            '''
+            msgs = await core.stormlist(q)
+            nodes = [m[1] for m in msgs if m[0] == 'node']
+            self.len(1, nodes)
+            self.eq(('test:str', 'burrito'), nodes[0][0])
+
+            q = '''
+            $lib.print("OH YEA")
+            empty {
+                [test:str=possum]
+            }
+            '''
+            msgs = await core.stormlist(q)
+            nodes = [m[1] for m in msgs if m[0] == 'node']
+            self.len(1, nodes)
+            self.eq(('test:str', 'possum'), nodes[0][0])
+            self.stormIsInPrint('OH YEA', msgs)
+
+            q = '''
+            empty {
+                [test:str=foo]
+            }
+
+            empty {
+                [test:bstr=bar]
+            }
+            '''
+            msgs = await core.stormlist(q)
+            nodes = [m[1] for m in msgs if m[0] == 'node']
+            self.len(1, nodes)
+            self.eq(('test:str', 'foo'), nodes[0][0])
+
+            q = '''
+            empty {
+                $lib.print('call me')
+            }
+
+            $lib.print('ishmael')
+
+            empty {
+                $lib.print('some years ago')
+            }
+
+            [test:str="moby dick"]
+
+            empty {
+                $lib.print('never mind')
+            }
+
+            empty {
+                $lib.print('how long')
+            }
+
+            [ :hehe=haha ]
+            '''
+            msgs = await core.stormlist(q)
+            self.stormIsInPrint('call me', msgs)
+            self.stormIsInPrint('ishmael', msgs)
+            self.stormIsInPrint('some years ago', msgs)
+            nodes = [m[1] for m in msgs if m[0] == 'node']
+            self.len(1, nodes)
+            self.eq(('test:str', 'moby dick'), nodes[0][0])
+            self.eq('haha', nodes[0][1]['props']['hehe'])
+            self.stormNotInPrint('never mind', msgs)
+            self.stormNotInPrint('how long', msgs)
+
+            q = '''
+            function foo(x) {
+                empty {
+                    $lib.print($x)
+                }
+
+                return()
+            }
+
+            [test:str=biz :hehe=baz]
+            $foo(:hehe)
+            '''
+            msgs = await core.stormlist(q)
+            self.stormIsInPrint("baz", msgs)
+            nodes = [m[1] for m in msgs if m[0] == 'node']
+            self.len(1, nodes)
+            self.eq(('test:str', 'biz'), nodes[0][0])
+
+            q = '''
+            [test:str=coffee :hehe=pourover] $beep=:hehe | spin | empty { $lib.print("blorp") }
+            '''
+            msgs = await core.stormlist(q)
+            nodes = [m[1] for m in msgs if m[0] == 'node']
+            self.len(0, nodes)
+            self.stormIsInPrint('blorp', msgs)
+
+            q = '''
+            [test:str=latte :hehe=milk] $beep=:hehe | spin | empty { $lib.print($beep) }
+            '''
+            msgs = await core.stormlist(q)
+            nodes = [m[1] for m in msgs if m[0] == 'node']
+            self.len(0, nodes)
+            self.stormIsInErr('Empty block query must be runtsafe', msgs)
+
+            q = '''
+            function foo() {
+                for $x in $lib.range(10) {
+                    emit $x
+                }
+            }
+
+            for $data in $foo() {
+                if ($data > 10000) {
+                    [test:int=$data]
+                }
+            }
+
+            empty {
+                [test:int=1000]
+            }
+            '''
+            msgs = await core.stormlist(q)
+            nodes = [m[1] for m in msgs if m[0] == 'node']
+            self.len(1, nodes)
+            self.eq(('test:int', 1000), nodes[0][0])
+
+            q = '''
+            empty {
+                [test:int=12345]
+            }
+            '''
+            idens = [nodes[0][1]['iden'],]
+            msgs = await core.stormlist(q, opts={'idens': idens})
+            nodes = [m[1] for m in msgs if m[0] == 'node']
+            self.len(1, nodes)
+            self.eq(('test:int', 1000), nodes[0][0])
+
+            q = '''
+            function foo() {
+                empty {
+                    $lib.print('foobarbaz')
+                }
+                [test:int=12]
+            }
+
+            yield $foo()
+            empty {
+                $lib.print('neato')
+            }
+            '''
+            msgs = await core.stormlist(q)
+            nodes = [m[1] for m in msgs if m[0] == 'node']
+            self.len(1, nodes)
+            self.eq(('test:int', 12), nodes[0][0])
+            self.stormIsInPrint('foobarbaz', msgs)
+            self.stormNotInPrint('neato', msgs)
+
+            q = '''
+            function foo() {
+                for $x in $lib.range(2) {
+                    emit $x
+                    empty {
+                        $lib.print(`count is {$x}`)
+                    }
+                }
+            }
+            for $x in $foo() {
+                [test:int=$x]
+            }
+            '''
+            msgs = await core.stormlist(q)
+            order = [m[0] for m in msgs]
+            nodes = [m[1] for m in msgs if m[0] == 'node']
+            ndefs = [n[0] for n in nodes]
+
+            self.len(2, nodes)
+            self.eq(order, ['init', 'node:edits', 'node', 'print', 'node:edits', 'node', 'print', 'fini'])
+            self.isin(('test:int', 0), ndefs)
+            self.isin(('test:int', 1), ndefs)
+
+            self.stormIsInPrint('count is 0', msgs)
+            self.stormIsInPrint('count is 1', msgs)
+
     async def test_ast_cmdargs(self):
 
         async with self.getTestCore() as core:
@@ -2778,8 +3118,11 @@ class AstTest(s_test.SynTest):
             self.len(2, await core.nodes('test:str +#taga*:score'))
             self.len(1, await core.nodes('test:str +#tagaa:score=5'))
             self.len(1, await core.nodes('test:str +#tagaa:score<(2+4)'))
+            self.len(0, await core.nodes('test:str +#tagaa:score<-5'))
             self.len(1, await core.nodes('test:str +#tagaa:score*range=(4,6)'))
+            self.len(0, await core.nodes('test:str +#taga*:score <- *'))
             self.len(1, await core.nodes('test:str +#taga*:score <(*)- *'))
+            self.len(3, await core.nodes('test:str +#taga*:score <+(*)- *'))
             self.len(2, await core.nodes('$tag=taga* test:str +#$tag:score'))
             self.len(1, await core.nodes('$tag=tagaa test:str +#$tag:score=5'))
             self.len(1, await core.nodes('$tag=tagaa test:str +#$tag:score*range=(4,6)'))
@@ -2850,3 +3193,62 @@ class AstTest(s_test.SynTest):
             nodes = await core.nodes('test:type10 $foobar=:int2 +(:intprop = $foobar)')
             self.len(1, nodes)
             self.eq(nodes[0].ndef, ('test:type10', 'one'))
+
+    async def test_ast_propvalue(self):
+        async with self.getTestCore() as core:
+
+            # Create node with data prop, assign data prop to var, update var
+            q = '[ it:exec:query=(test1,) :opts=({"foo": "bar"}) ] $opts=:opts $opts.bar = "baz"'
+            nodes = await core.nodes(q)
+            self.len(1, nodes)
+            self.eq(nodes[0].props.get('opts'), {'foo': 'bar'})
+
+            q = '[ it:exec:query=(test1,) :opts=({"foo": "bar"}) ] $opts=:opts $opts.bar = "baz" [ :opts=$opts ]'
+            nodes = await core.nodes(q)
+            self.len(1, nodes)
+            self.eq(nodes[0].props.get('opts'), {'foo': 'bar', 'bar': 'baz'})
+
+            q = '''
+            '''
+            msgs = await core.stormlist('[ it:exec:query=(test2,) :opts=({"foo": "bar"}) ]')
+            self.stormHasNoWarnErr(msgs)
+
+            # Lift node with data prop, assign data prop to var, update var
+            q = 'it:exec:query=(test2,) $opts=:opts $opts.bar = "baz"'
+            nodes = await core.nodes(q)
+            self.len(1, nodes)
+            self.eq(nodes[0].props.get('opts'), {'foo': 'bar'})
+
+            q = 'it:exec:query=(test2,) $opts=:opts $opts.bar = "baz" [ :opts=$opts ]'
+            nodes = await core.nodes(q)
+            self.len(1, nodes)
+            self.eq(nodes[0].props.get('opts'), {'foo': 'bar', 'bar': 'baz'})
+
+            # Create node for the lift below
+            q = '''
+            [ it:app:snort:hit=*
+                :flow={[ inet:flow=* :raw=({"foo": "bar"}) ]}
+            ]
+            '''
+            nodes = await core.nodes(q)
+            self.len(1, nodes)
+
+            # Lift node, get prop via implicit pivot, assign data prop to var, update var
+            q = f'it:app:snort:hit $raw = :flow::raw $raw.baz="box" | spin | inet:flow'
+            nodes = await core.nodes(q)
+            self.len(1, nodes)
+            self.eq(nodes[0].props.get('raw'), {'foo': 'bar'})
+
+            q = f'it:app:snort:hit $raw = :flow::raw $raw.baz="box" | spin | inet:flow [ :raw=$raw ]'
+            nodes = await core.nodes(q)
+            self.len(1, nodes)
+            self.eq(nodes[0].props.get('raw'), {'foo': 'bar', 'baz': 'box'})
+
+    async def test_ast_subq_runtsafety(self):
+
+        async with self.getTestCore() as core:
+            msgs = await core.stormlist('$foo={[test:str=foo] return($node.value())} $lib.print($foo)')
+            self.stormIsInPrint('foo', msgs)
+
+            msgs = await core.stormlist('$lib.print({[test:str=foo] return($node.value())})')
+            self.stormIsInPrint('foo', msgs)