From 89d691ba1bc66a8c25823c34aed8ab08fddfc83b Mon Sep 17 00:00:00 2001
From: brharrington <brharrington@gmail.com>
Date: Fri, 26 Jan 2024 14:50:16 -0600
Subject: [PATCH] eval: improve offset validation (#1600)

Check each data expression to catch some uses of named
rewrites where the offset is not available on the display
expression.
---
 .../com/netflix/atlas/eval/stream/ExprInterpreter.scala   | 4 ++++
 .../com/netflix/atlas/eval/stream/EvaluatorSuite.scala    | 8 ++++++++
 2 files changed, 12 insertions(+)

diff --git a/atlas-eval/src/main/scala/com/netflix/atlas/eval/stream/ExprInterpreter.scala b/atlas-eval/src/main/scala/com/netflix/atlas/eval/stream/ExprInterpreter.scala
index f34ddf262..a5e2b85a9 100644
--- a/atlas-eval/src/main/scala/com/netflix/atlas/eval/stream/ExprInterpreter.scala
+++ b/atlas-eval/src/main/scala/com/netflix/atlas/eval/stream/ExprInterpreter.scala
@@ -58,6 +58,10 @@ private[stream] class ExprInterpreter(config: Config) {
         case op: FilterExpr                    => invalidOperator(op); op
         case op: DataExpr if !op.offset.isZero => invalidOperator(op); op
       }
+
+      // Double check all data expressions do not have an offset. In some cases for named rewrites
+      // the check above may not detect the offset.
+      result.expr.dataExprs.filterNot(_.offset.isZero).foreach(invalidOperator)
     }
 
     // Perform host rewrites based on the Atlas hostname
diff --git a/atlas-eval/src/test/scala/com/netflix/atlas/eval/stream/EvaluatorSuite.scala b/atlas-eval/src/test/scala/com/netflix/atlas/eval/stream/EvaluatorSuite.scala
index 6a6159177..919be76f5 100644
--- a/atlas-eval/src/test/scala/com/netflix/atlas/eval/stream/EvaluatorSuite.scala
+++ b/atlas-eval/src/test/scala/com/netflix/atlas/eval/stream/EvaluatorSuite.scala
@@ -502,6 +502,14 @@ class EvaluatorSuite extends FunSuite {
     invalidOperator("offset", "name,jvm.gc.pause,:eq,:sum,1w,:offset")
   }
 
+  test("validate: unsupported operation `:offset` with math") {
+    invalidOperator("offset", "name,a,:eq,:sum,:dup,1w,:offset,:div")
+  }
+
+  test("validate: unsupported operation `:offset` with named rewrite and math") {
+    invalidOperator("offset", "name,a,:eq,:sum,:sdes-slower,:dup,1w,:offset,:div")
+  }
+
   test("validate: unsupported operation `:integral`") {
     invalidOperator("integral", "name,jvm.gc.pause,:eq,:sum,:integral")
   }