bytebase/bytebase · error

failed to create CEL environment for masking exemption polic

Error message

failed to create CEL environment for masking exemption policy

What it means

evaluateMaskingExemptionPolicyCondition wraps an error from cel.NewEnv when building the CEL environment that declares the resource and request map variables plus ext string functions for exemption policy evaluation. cel.NewEnv failing is rare - it indicates the CEL library itself rejected the environment construction (bad type declarations or library option).

Source

Thrown at backend/api/v1/masking_evaluator.go:248

	if classification.Level == nil {
		return 0
	}

	return *classification.Level
}

func evaluateMaskingExemptionPolicyCondition(expression *expr.Expr, attributes map[string]any) (bool, error) {
	// nil expression means allow to access all databases
	if expression == nil || expression.Expression == "" {
		return true, nil
	}
	maskingExemptionPolicyEnv, err := cel.NewEnv(
		cel.Variable("resource", cel.MapType(cel.StringType, cel.AnyType)),
		cel.Variable("request", cel.MapType(cel.StringType, cel.AnyType)),
		ext.Strings(),
	)
	if err != nil {
		return false, errors.Wrapf(err, "failed to create CEL environment for masking exemption policy")
	}
	ast, issues := maskingExemptionPolicyEnv.Compile(expression.Expression)
	if issues != nil && issues.Err() != nil {
		return false, errors.Wrapf(issues.Err(), "failed to get the ast of CEL program for masking exemption policy")
	}
	prg, err := maskingExemptionPolicyEnv.Program(ast)
	if err != nil {
		return false, errors.Wrapf(err, "failed to create CEL program for masking exemption policy")
	}
	out, _, err := prg.Eval(attributes)
	if err != nil {
		return false, errors.Wrapf(err, "failed to eval CEL program for masking exemption policy")
	}
	val, err := out.ConvertToNative(reflect.TypeFor[bool]())
	if err != nil {
		return false, errors.Wrap(err, "expect bool result for masking exemption policy")
	}
	boolVar, ok := val.(bool)

View on GitHub (pinned to 1870550677)

Solutions

1. Check the wrapped error for which env component was rejected
2. Pin a cel-go version compatible with ext.Strings() usage (go.mod / go.sum)
3. Run go mod tidy and rebuild to remove duplicate cel-go versions
4. If the env construction was edited, restore valid type declarations for resource and request maps

Example fix

// go.mod pin after upgrade failure
// before
require github.com/google/cel-go v0.99.0
// after
require github.com/google/cel-go v0.20.1

// at startup, build the env once and fail fast
celExemptionEnv, err := cel.NewEnv(
  cel.Variable("resource", cel.MapType(cel.StringType, cel.AnyType)),
  cel.Variable("request", cel.MapType(cel.StringType, cel.AnyType)),
  ext.Strings(),
)
if err != nil { return fmt.Errorf("cel env init failed: %w", err) }

if err != nil {
  log.Printf("CEL environment construction failed: %v", err)
  return fmt.Errorf("masking exemption evaluation unavailable: %w", err)
}

When it happens

Trigger: Effectively only on incompatible/incorrect cel-go usage or version mismatch: an invalid type passed to cel.Variable, or an ext.Strings() incompatibility with the vendored cel-go version. Triggered on every exemption condition evaluation since the env is built per call.

Common situations: Upgrading cel-go to a version where ext.Strings() signature or MapType behavior changed; accidental modification of the env construction code; dependency injection of an incompatible cel-go fork.

Related errors

• CodeInternal
• failed to evaluate masking level of column
• failed to evaluate masking rule policy condition
• failed to evaluate masking exemption policy condition
• failed to get the ast of CEL program for masking exemption p

AI-assisted analysis of bytebase/bytebase@1870550677 (2026-09-06). Data as JSON: /api/errors/73f27d2fdfe16f19. Report an issue: GitHub.