(policyType storepb.Policy_Type, policy *v1pb.Policy)
| 508 | } |
| 509 | |
| 510 | func validatePolicyPayload(policyType storepb.Policy_Type, policy *v1pb.Policy) error { |
| 511 | switch policyType { |
| 512 | case storepb.Policy_MASKING_RULE: |
| 513 | maskingRulePolicy, ok := policy.Policy.(*v1pb.Policy_MaskingRulePolicy) |
| 514 | if !ok { |
| 515 | return connect.NewError(connect.CodeInvalidArgument, errors.Errorf("unmatched policy type %v and policy %v", policyType, policy.Policy)) |
| 516 | } |
| 517 | if maskingRulePolicy.MaskingRulePolicy == nil { |
| 518 | return connect.NewError(connect.CodeInvalidArgument, errors.New("masking rule policy must be set")) |
| 519 | } |
| 520 | for _, rule := range maskingRulePolicy.MaskingRulePolicy.Rules { |
| 521 | if rule.Id == "" { |
| 522 | return connect.NewError(connect.CodeInvalidArgument, errors.New("masking rule must have ID set")) |
| 523 | } |
| 524 | if _, err := common.ValidateMaskingRuleCELExpr(rule.Condition.Expression); err != nil { |
| 525 | return connect.NewError(connect.CodeInvalidArgument, errors.Wrap(err, "invalid masking rule expression")) |
| 526 | } |
| 527 | } |
| 528 | case storepb.Policy_MASKING_EXEMPTION: |
| 529 | maskingExemptionPolicy, ok := policy.Policy.(*v1pb.Policy_MaskingExemptionPolicy) |
| 530 | if !ok { |
| 531 | return connect.NewError(connect.CodeInvalidArgument, errors.Errorf("unmatched policy type %v and policy %v", policyType, policy.Policy)) |
| 532 | } |
| 533 | if maskingExemptionPolicy.MaskingExemptionPolicy == nil { |
| 534 | return connect.NewError(connect.CodeInvalidArgument, errors.New("masking exception policy must be set")) |
| 535 | } |
| 536 | for _, exemption := range maskingExemptionPolicy.MaskingExemptionPolicy.Exemptions { |
| 537 | if _, err := common.ValidateMaskingExemptionCELExpr(exemption.Condition); err != nil { |
| 538 | return connect.NewError(connect.CodeInvalidArgument, errors.Errorf("invalid masking exemption expression: %v", err)) |
| 539 | } |
| 540 | for _, member := range exemption.Members { |
| 541 | if err := validateMember(member); err != nil { |
| 542 | return err |
| 543 | } |
| 544 | } |
| 545 | } |
| 546 | default: |
| 547 | } |
| 548 | return nil |
| 549 | } |
| 550 | |
| 551 | func (s *OrgPolicyService) convertPolicyPayloadToString(ctx context.Context, policy *v1pb.Policy) (string, error) { |
| 552 | switch policy.Type { |
no test coverage detected