{"record":{"id":"73f27d2fdfe16f19","repo":"bytebase/bytebase","slug":"failed-to-create-cel-environment-for-masking-exemp","errorCode":null,"errorMessage":"failed to create CEL environment for masking exemption policy","messagePattern":"failed to create CEL environment for masking exemption policy","errorType":"error_code","errorClass":null,"httpStatus":500,"severity":"error","filePath":"backend/api/v1/masking_evaluator.go","lineNumber":248,"sourceCode":"\tif classification.Level == nil {\n\t\treturn 0\n\t}\n\n\treturn *classification.Level\n}\n\nfunc evaluateMaskingExemptionPolicyCondition(expression *expr.Expr, attributes map[string]any) (bool, error) {\n\t// nil expression means allow to access all databases\n\tif expression == nil || expression.Expression == \"\" {\n\t\treturn true, nil\n\t}\n\tmaskingExemptionPolicyEnv, err := cel.NewEnv(\n\t\tcel.Variable(\"resource\", cel.MapType(cel.StringType, cel.AnyType)),\n\t\tcel.Variable(\"request\", cel.MapType(cel.StringType, cel.AnyType)),\n\t\text.Strings(),\n\t)\n\tif err != nil {\n\t\treturn false, errors.Wrapf(err, \"failed to create CEL environment for masking exemption policy\")\n\t}\n\tast, issues := maskingExemptionPolicyEnv.Compile(expression.Expression)\n\tif issues != nil && issues.Err() != nil {\n\t\treturn false, errors.Wrapf(issues.Err(), \"failed to get the ast of CEL program for masking exemption policy\")\n\t}\n\tprg, err := maskingExemptionPolicyEnv.Program(ast)\n\tif err != nil {\n\t\treturn false, errors.Wrapf(err, \"failed to create CEL program for masking exemption policy\")\n\t}\n\tout, _, err := prg.Eval(attributes)\n\tif err != nil {\n\t\treturn false, errors.Wrapf(err, \"failed to eval CEL program for masking exemption policy\")\n\t}\n\tval, err := out.ConvertToNative(reflect.TypeFor[bool]())\n\tif err != nil {\n\t\treturn false, errors.Wrap(err, \"expect bool result for masking exemption policy\")\n\t}\n\tboolVar, ok := val.(bool)","sourceCodeStart":230,"sourceCodeEnd":266,"githubUrl":"https://github.com/bytebase/bytebase/blob/1870550677fe08f0d2a78c07acd27541464eb945/backend/api/v1/masking_evaluator.go#L230-L266","documentation":"evaluateMaskingExemptionPolicyCondition wraps an error from cel.NewEnv when building the CEL environment that declares the resource and request map variables plus ext string functions for exemption policy evaluation. cel.NewEnv failing is rare - it indicates the CEL library itself rejected the environment construction (bad type declarations or library option).","triggerScenarios":"Effectively only on incompatible/incorrect cel-go usage or version mismatch: an invalid type passed to cel.Variable, or an ext.Strings() incompatibility with the vendored cel-go version. Triggered on every exemption condition evaluation since the env is built per call.","commonSituations":"Upgrading cel-go to a version where ext.Strings() signature or MapType behavior changed; accidental modification of the env construction code; dependency injection of an incompatible cel-go fork.","solutions":["Check the wrapped error for which env component was rejected","Pin a cel-go version compatible with ext.Strings() usage (go.mod / go.sum)","Run go mod tidy and rebuild to remove duplicate cel-go versions","If the env construction was edited, restore valid type declarations for resource and request maps"],"exampleFix":"// go.mod pin after upgrade failure\n// before\nrequire github.com/google/cel-go v0.99.0\n// after\nrequire github.com/google/cel-go v0.20.1","handlingStrategy":"try-catch","validationCode":"// at startup, build the env once and fail fast\ncelExemptionEnv, err := cel.NewEnv(\n  cel.Variable(\"resource\", cel.MapType(cel.StringType, cel.AnyType)),\n  cel.Variable(\"request\", cel.MapType(cel.StringType, cel.AnyType)),\n  ext.Strings(),\n)\nif err != nil { return fmt.Errorf(\"cel env init failed: %w\", err) }","typeGuard":null,"tryCatchPattern":"if err != nil {\n  log.Printf(\"CEL environment construction failed: %v\", err)\n  return fmt.Errorf(\"masking exemption evaluation unavailable: %w\", err)\n}","preventionTips":["Build the CEL environment once at startup and fail fast instead of per-evaluation","Pin a cel-go version compatible with ext.Strings() and go mod tidy after upgrades","Add a startup smoke test that constructs the env and compiles a sample expression"],"tags":["cel","environment","masking","dependency"],"backgroundTag":"module-init-failed","analyzedSha":"1870550677fe08f0d2a78c07acd27541464eb945","analyzedAt":"2026-09-06T21:16:13.665Z","contentChangedAt":"2026-09-06T21:16:13.665Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}