exercise7 introduces macros for dealing with repeated fields and maps. Determine whether the `jwt.extra_claims` has at least one key that starts with the `group` prefix, and ensure that all group-like keys have list values containing only strings that end with '@acme.co`.
()
| 305 | // with the `group` prefix, and ensure that all group-like keys have list |
| 306 | // values containing only strings that end with '@acme.co`. |
| 307 | func exercise7() { |
| 308 | fmt.Println("=== Exercise 7: Macros ===\n") |
| 309 | env, _ := cel.NewEnv(cel.Variable("jwt", cel.DynType)) |
| 310 | ast := compile(env, |
| 311 | `jwt.extra_claims.exists(c, c.startsWith('group')) |
| 312 | && jwt.extra_claims |
| 313 | .filter(c, c.startsWith('group')) |
| 314 | .all(c, jwt.extra_claims[c] |
| 315 | .all(g, g.endsWith('@acme.co')))`, |
| 316 | cel.BoolType) |
| 317 | program, _ := env.Program(ast) |
| 318 | |
| 319 | // Evaluate a complex-ish JWT with two groups that satisfy the criteria. |
| 320 | // Output: true. |
| 321 | eval(program, |
| 322 | map[string]any{ |
| 323 | "jwt": map[string]any{ |
| 324 | "sub": "serviceAccount:delegate@acme.co", |
| 325 | "aud": "my-project", |
| 326 | "iss": "auth.acme.com:12350", |
| 327 | "extra_claims": map[string][]string{ |
| 328 | "group1": {"admin@acme.co", "analyst@acme.co"}, |
| 329 | "labels": {"metadata", "prod", "pii"}, |
| 330 | "groupN": {"forever@acme.co"}, |
| 331 | }, |
| 332 | }, |
| 333 | }) |
| 334 | |
| 335 | fmt.Println() |
| 336 | } |
| 337 | |
| 338 | // exercise8 covers some useful features of CEL-Go which can be used to |
| 339 | // improve performance and better understand evaluation behavior. |