fix: not is a prefix operator, not a function

Change NegateExpr to produce "not expr" instead of "not(expr)"
to match the policy expression language syntax.

Author: dangrondahl

internal/policy/expression.go

@@ -74,7 +74,7 @@ func UnwrapExpr(expr string) string {
 	return s
 }
 
-// NegateExpr wraps a raw (unwrapped) expression with not().
+// NegateExpr prefixes a raw (unwrapped) expression with the not operator.
 func NegateExpr(raw string) string {
-	return fmt.Sprintf("not(%s)", raw)
+	return fmt.Sprintf("not %s", raw)
 }

internal/policy/expression_test.go

@@ -90,12 +90,12 @@ func TestUnwrapExpr_AlreadyRaw(t *testing.T) {
 
 func TestNegateExpr(t *testing.T) {
 	result := NegateExpr(`flow.name == "prod"`)
-	assert.Equal(t, `not(flow.name == "prod")`, result)
+	assert.Equal(t, `not flow.name == "prod"`, result)
 }
 
 func TestCombineAndNegate(t *testing.T) {
 	a := UnwrapExpr(FlowNameExpr("prod"))
 	b := NegateExpr(UnwrapExpr(ArtifactNameMatchExpr("^datadog:.*")))
 	result := CombineExprs("and", a, b)
-	assert.Equal(t, `${{ flow.name == "prod" and not(matches(artifact.name, "^datadog:.*")) }}`, result)
+	assert.Equal(t, `${{ flow.name == "prod" and not matches(artifact.name, "^datadog:.*") }}`, result)
 }

internal/policywizard/forms.go

@@ -175,7 +175,7 @@ func (m *Model) buildForm() *huh.Form {
 
 	case stepExprNegate:
 		f = confirmForm("Negate this condition?",
-			"Wrap with not() — e.g. not(flow.name == \"prod\")")
+			"Prefix with not — e.g. not flow.name == \"prod\"")
 
 	case stepExprCombineConfirm:
 		f = confirmForm("Combine with another condition?",

internal/policywizard/forms_test.go

@@ -436,7 +436,7 @@ func TestApply_ExprNegate_Yes_NegatesLastPending(t *testing.T) {
 	m.applyFormValues(formValues{confirm: true})
 
 	require.Len(t, m.pendingExprs, 1)
-	assert.Equal(t, `not(flow.name == "prod")`, m.pendingExprs[0])
+	assert.Equal(t, `not flow.name == "prod"`, m.pendingExprs[0])
 }
 
 func TestApply_ExprNegate_No_LeavesUnchanged(t *testing.T) {
@@ -576,7 +576,7 @@ func TestCombineFlow_NegatedExprWithOr(t *testing.T) {
 
 	require.Len(t, m.Policy.Artifacts.TrailCompliance.Exceptions, 1)
 	assert.Equal(t,
-		`${{ not(flow.name == "staging") or exists(flow) }}`,
+		`${{ not flow.name == "staging" or exists(flow) }}`,
 		m.Policy.Artifacts.TrailCompliance.Exceptions[0].If,
 	)
 }