{"record":{"id":"55e504026f6670be","repo":"bytebase/bytebase","slug":"failed-to-get-query-export-factors","errorCode":null,"errorMessage":"failed to get query export factors","messagePattern":"failed to get query export factors","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"backend/component/review/evaluator.go","lineNumber":798,"sourceCode":"\n\t// If no tasks, return empty list (no approval needed)\n\tif len(celVarsList) == 0 {\n\t\tcelVarsList = append(celVarsList, map[string]any{})\n\t}\n\n\treturn celVarsList, approvalInputVersion, true, nil\n}\n\n// buildCELVariablesForRoleGrant builds CEL variables for ROLE_GRANT issues.\nfunc buildCELVariablesForRoleGrant(ctx context.Context, stores *store.Store, issue *store.IssueMessage) ([]map[string]any, bool, error) {\n\tpayload := issue.Payload\n\tif payload.RoleGrant == nil {\n\t\treturn nil, false, errors.New(\"role grant payload not found\")\n\t}\n\n\tfactors, err := common.GetQueryExportFactors(payload.GetRoleGrant().GetCondition().GetExpression())\n\tif err != nil {\n\t\treturn nil, false, errors.Wrap(err, \"failed to get query export factors\")\n\t}\n\n\t// Default to max int if expiration is not set (no expiration)\n\texpirationDays := int64(math.MaxInt32)\n\tif payload.RoleGrant.Expiration != nil {\n\t\texpirationDays = int64(payload.RoleGrant.Expiration.AsDuration().Hours() / 24)\n\t}\n\n\tbaseVars := map[string]any{\n\t\tcommon.CELAttributeResourceProjectID:     issue.ProjectID,\n\t\tcommon.CELAttributeRequestExpirationDays: expirationDays,\n\t\tcommon.CELAttributeRequestRole:           payload.RoleGrant.Role,\n\t}\n\n\t// If no specific databases, create one entry per environment\n\tif len(factors.Databases) == 0 {\n\t\tissueProject, err := stores.GetProjectByResourceID(ctx, issue.ProjectID)\n\t\tif err != nil {","sourceCodeStart":780,"sourceCodeEnd":816,"githubUrl":"https://github.com/bytebase/bytebase/blob/1870550677fe08f0d2a78c07acd27541464eb945/backend/component/review/evaluator.go#L780-L816","documentation":"buildCELVariablesForRoleGrant extracts risk factors (referenced databases) from the role-grant condition CEL expression via common.GetQueryExportFactors. That function compiles the expression in the IAM condition CEL environment; any compile issue or AST conversion failure is wrapped as 'failed to get query export factors'.","triggerScenarios":"payload.RoleGrant.Condition.Expression is non-empty but not a valid CEL expression against the IAM condition attributes: syntax error, unknown identifier (e.g. referencing a field outside resource.database), or wrong types in comparisons like resource.database == 1.","commonSituations":"Hand-edited IAM policy condition; condition authored for a different schema version (attribute renamed); API client posting a role grant with a malformed condition string; whitespace/encoding corruption in stored policy JSON.","solutions":["Validate the condition expression with a CEL linter/compiler against the IAM policy attributes before saving the role grant.","Fix the syntax or identifier errors reported in the wrapped 'found issue ...' message.","Ensure the condition only references supported attributes (e.g. resource.database) with correct literal types.","Clear the malformed condition and re-create the role grant through the UI/API validation path."],"exampleFix":"// before (type error)\nresource.database == 123\n// after\nresource.database == \"projects/p/instances/i/databases/db\"","handlingStrategy":"validation","validationCode":"// Validate the CEL condition before saving a role grant:\nenv := cel.NewEnv(common.IAMPolicyConditionCELAttributes...)\nif _, issues := env.Compile(expr); issues != nil {\n  return fmt.Errorf(\"invalid role grant condition: %v\", issues)\n}","typeGuard":null,"tryCatchPattern":"if err != nil {\n  return fmt.Errorf(\"rejected role grant: condition failed to compile: %w\", err) // surface the CEL issues to the caller\n}","preventionTips":["Compile-validate conditions in the create/update role grant API.","Only reference documented IAM condition attributes (resource.database, etc.).","Use string literals for database comparisons, never other types.","Add CEL unit tests for policy conditions in CI."],"tags":["cel","iam-policy","role-grant"],"backgroundTag":"invalid-argument-value","analyzedSha":"1870550677fe08f0d2a78c07acd27541464eb945","analyzedAt":"2026-09-06T21:16:13.665Z","contentChangedAt":"2026-09-06T21:16:13.665Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}