ValidateFallbackApprovalExpr validates that a CEL expression only uses variables allowed in fallback approval rules (only resource.project_id).
(expression string)
| 55 | // ValidateFallbackApprovalExpr validates that a CEL expression only uses |
| 56 | // variables allowed in fallback approval rules (only resource.project_id). |
| 57 | func ValidateFallbackApprovalExpr(expression string) error { |
| 58 | if expression == "" || expression == "true" { |
| 59 | return nil |
| 60 | } |
| 61 | |
| 62 | e, err := cel.NewEnv(FallbackApprovalFactors...) |
| 63 | if err != nil { |
| 64 | return errors.Wrap(err, "failed to create CEL env") |
| 65 | } |
| 66 | |
| 67 | _, issues := e.Compile(expression) |
| 68 | if issues != nil && issues.Err() != nil { |
| 69 | return connect.NewError(connect.CodeInvalidArgument, |
| 70 | errors.Errorf("fallback rules can only use resource.project_id in conditions: %v", issues.Err())) |
| 71 | } |
| 72 | |
| 73 | return nil |
| 74 | } |
| 75 | |
| 76 | // IAMPolicyConditionCELAttributes are the variables when evaluating IAM policy condition. |
| 77 | var IAMPolicyConditionCELAttributes = []cel.EnvOption{ |