From 04c4ce68c93dd768d4d034d9a92ac527be9b536e Mon Sep 17 00:00:00 2001
From: Evan Corkrean <62527488+corkrean@users.noreply.github.com>
Date: Wed, 26 Aug 2026 10:04:55 -0600
Subject: [PATCH] redact .any() .all() fix

---
 pkg/backupformat/redaction.go      |  7 +++++++
 pkg/backupformat/redaction_test.go | 32 ++++++++++++++++++++++++++++++
 2 files changed, 39 insertions(+)

diff --git a/pkg/backupformat/redaction.go b/pkg/backupformat/redaction.go
index 4c3b6f3d..ab54e6ac 100644
--- a/pkg/backupformat/redaction.go
+++ b/pkg/backupformat/redaction.go
@@ -287,12 +287,19 @@ func redactRewriteChildren(children []*core.SetOperation_Child, redactionMap *Re
 			t.TupleToUserset.Tupleset.Relation = redactionMap.Relations[t.TupleToUserset.Tupleset.Relation]
 			t.TupleToUserset.ComputedUserset.Relation = redactionMap.Relations[t.TupleToUserset.ComputedUserset.Relation]
 
+		case *core.SetOperation_Child_FunctionedTupleToUserset:
+			t.FunctionedTupleToUserset.Tupleset.Relation = redactionMap.Relations[t.FunctionedTupleToUserset.Tupleset.Relation]
+			t.FunctionedTupleToUserset.ComputedUserset.Relation = redactionMap.Relations[t.FunctionedTupleToUserset.ComputedUserset.Relation]
+
 		case *core.SetOperation_Child_XNil:
 			// nothing to do
 
 		case *core.SetOperation_Child_XThis:
 			// nothing to do
 
+		case *core.SetOperation_Child_XSelf:
+			// nothing to do
+
 		default:
 			return spiceerrors.MustBugf("unknown child type: %T", t)
 		}
diff --git a/pkg/backupformat/redaction_test.go b/pkg/backupformat/redaction_test.go
index c9e44b6d..dd737b23 100644
--- a/pkg/backupformat/redaction_test.go
+++ b/pkg/backupformat/redaction_test.go
@@ -216,6 +216,38 @@ func TestRedactSchema(t *testing.T) {
 				ObjectIDs: map[string]string{},
 			},
 		},
+		{
+			name: "any and all operators",
+			opts: RedactionOptions{
+				RedactDefinitions: true,
+				RedactRelations:   true,
+				RedactObjectIDs:   true,
+			},
+			in: `
+			definition user {}
+
+			definition resource {
+				relation viewer: user
+				relation upstream: resource
+				permission readany = viewer + upstream.any(readany)
+				permission readall = viewer + upstream.all(readall)
+			}`,
+			out: "definition def0 {}\n\ndefinition def1 {\n\trelation rel2: def0\n\trelation rel3: def1\n\tpermission rel4 = rel2 + rel3.any(rel4)\n\tpermission rel5 = rel2 + rel3.all(rel5)\n}",
+			redactionMap: RedactionMap{
+				Definitions: map[string]string{
+					"user":     "def0",
+					"resource": "def1",
+				},
+				Caveats: map[string]string{},
+				Relations: map[string]string{
+					"viewer":   "rel2",
+					"upstream": "rel3",
+					"readany":  "rel4",
+					"readall":  "rel5",
+				},
+				ObjectIDs: map[string]string{},
+			},
+		},
 		{
 			name: "same relation name in different definitions",
 			opts: RedactionOptions{