From 60276e2198a85e42ffa822611d7ad22bd69bb19f Mon Sep 17 00:00:00 2001
From: Aaron Raddon <araddon@gmail.com>
Date: Tue, 13 Dec 2016 19:16:33 -0800
Subject: [PATCH] Better handling of NOT Urnary with nested expressions in
 parsing

---
 expr/parse.go      |  2 +-
 expr/parse_test.go | 31 ++++++++++++++++++++++++++-----
 vm/vm_test.go      |  9 ++++++---
 3 files changed, 33 insertions(+), 9 deletions(-)

diff --git a/expr/parse.go b/expr/parse.go
index 04592e7f..397db1b5 100644
--- a/expr/parse.go
+++ b/expr/parse.go
@@ -519,7 +519,7 @@ func (t *tree) F(depth int) Node {
 	case lex.TokenNegate, lex.TokenMinus, lex.TokenExists:
 		t.Next()
 		debugf(depth, "cur: %v   next:%v", cur, t.Cur())
-		n := NewUnary(cur, t.F(depth+1))
+		n := NewUnary(cur, t.O(depth+1))
 		debugf(depth, "f urnary: %s", n)
 		return n
 	case lex.TokenIs:
diff --git a/expr/parse_test.go b/expr/parse_test.go
index 33ade615..64303e35 100644
--- a/expr/parse_test.go
+++ b/expr/parse_test.go
@@ -26,6 +26,8 @@ func init() {
 	}
 
 	builtins.LoadAllBuiltins()
+
+	//expr.Trace = true
 }
 
 type State struct{}
@@ -101,7 +103,11 @@ type exprTest struct {
 }
 
 var exprTestx = []exprTest{
-	{`*`, `*`, true},
+	{
+		`NOT 10 IN "value"`,
+		`NOT (10 IN "value")`,
+		true,
+	},
 }
 
 var exprTests = []exprTest{
@@ -161,13 +167,28 @@ var exprTests = []exprTest{
 		true,
 	},
 	{
-		`item IN "value"`,
-		`item IN "value"`,
+		`item IN "value1"`,
+		`item IN "value1"`,
+		true,
+	},
+	{
+		`item NOT IN "value2"`,
+		`NOT (item IN "value2")`,
+		true,
+	},
+	{
+		`NOT item IN "value3"`,
+		`NOT (item IN "value3")`,
+		true,
+	},
+	{
+		`NOT 10 IN "value4"`,
+		`NOT (10 IN "value4")`,
 		true,
 	},
 	{
-		`"value" IN ident`,
-		`"value" IN ident`,
+		`"value5" IN ident`,
+		`"value5" IN ident`,
 		true,
 	},
 	{
diff --git a/vm/vm_test.go b/vm/vm_test.go
index 8967c4a2..9766b704 100644
--- a/vm/vm_test.go
+++ b/vm/vm_test.go
@@ -56,11 +56,11 @@ var (
 		"email":   value.NewStringValue("bob@bob.com"),
 		"mt":      value.NewMapTimeValue(map[string]time.Time{"event0": t0, "event1": t1}),
 	}, true)
-	vmTestsx = []vmTest{
-		vmtall(`user_id > "abc"`, nil, parseOk, evalError),
+	vmTests = []vmTest{
+		vmtall(`NOT 10 IN ("a","b" 4.5)`, true, parseOk, evalError),
 	}
 	// list of tests
-	vmTests = []vmTest{
+	vmTestsx = []vmTest{
 
 		// Date math
 		vmt(`created > "now-1M"`, true, noError),
@@ -133,8 +133,11 @@ var (
 		vmtall(`"a" IN ("a","b",10, 4.5)`, true, parseOk, evalError),
 		// NEGATED
 		vmtall(`10 NOT IN ("a","b" 4.5)`, true, parseOk, evalError),
+		vmtall(`NOT (10 IN ("a","b" 4.5))`, true, parseOk, evalError),
+		vmtall(`NOT 10 IN ("a","b" 4.5)`, true, parseOk, evalError),
 		vmtall(`"a" NOT IN ("a","b" 4.5)`, false, parseOk, evalError),
 		vmt(`email NOT IN ("bob@bob.com")`, false, noError),
+		vmt(`NOT email IN ("bob@bob.com")`, false, noError),
 		// true because negated
 		vmtall(`toint(not_a_field) NOT IN ("a","b" 4.5)`, true, parseOk, noError),