in guard/src/rules/parser.rs [1093:1120]
fn single_clauses(input: Span) -> IResult<Span, Conjunctions<WhenGuardClause>> {
cnf_clauses(
input,
//
// Order does matter here. Both rule_clause and access clause have the same syntax
// for the first part e.g
//
// s3_encrypted_bucket or configuration.containers.*.port == 80
//
// the first part is a rule clause and the second part is access clause. Consider
// this example
//
// s3_encrypted_bucket or bucket_encryption EXISTS
//
// The first part if rule clause and second part is access. if we use the rule_clause
// to be first it would interpret bucket_encryption as the rule_clause. Now to prevent that
// we are using the alt form to first parse to see if it is clause and then try rules_clause
//
alt((single_clause, map(rule_clause, |g| match g {
GuardClause::NamedRule(nr) => WhenGuardClause::NamedRule(nr),
_ => unreachable!()
}))),
//
// Mapping the GuardClause
//
std::convert::identity, false)
}