bytebase/bytebase · error

failed to eval CEL program for masking exemption policy

Error message

failed to eval CEL program for masking exemption policy

What it means

prg.Eval(attributes) returned a runtime error while evaluating the masking exemption policy CEL expression. Compile only checks syntax and types against declared variables; runtime failures happen when the expression performs an unsupported operation on the actual attribute values (type errors on any-typed values, missing map keys with strict semantics, extension function misuse, evaluation timeouts, recursion).

Source

Thrown at backend/api/v1/masking_evaluator.go:260

	maskingExemptionPolicyEnv, err := cel.NewEnv(
		cel.Variable("resource", cel.MapType(cel.StringType, cel.AnyType)),
		cel.Variable("request", cel.MapType(cel.StringType, cel.AnyType)),
		ext.Strings(),
	)
	if err != nil {
		return false, errors.Wrapf(err, "failed to create CEL environment for masking exemption policy")
	}
	ast, issues := maskingExemptionPolicyEnv.Compile(expression.Expression)
	if issues != nil && issues.Err() != nil {
		return false, errors.Wrapf(issues.Err(), "failed to get the ast of CEL program for masking exemption policy")
	}
	prg, err := maskingExemptionPolicyEnv.Program(ast)
	if err != nil {
		return false, errors.Wrapf(err, "failed to create CEL program for masking exemption policy")
	}
	out, _, err := prg.Eval(attributes)
	if err != nil {
		return false, errors.Wrapf(err, "failed to eval CEL program for masking exemption policy")
	}
	val, err := out.ConvertToNative(reflect.TypeFor[bool]())
	if err != nil {
		return false, errors.Wrap(err, "expect bool result for masking exemption policy")
	}
	boolVar, ok := val.(bool)
	if !ok {
		return false, errors.Wrap(err, "expect bool result for masking exemption policy")
	}
	return boolVar, nil
}

func getAlgorithmNameFromSemanticType(semanticType *storepb.SemanticTypeSetting_SemanticType) string {
	if semanticType == nil || semanticType.Algorithm == nil {
		return ""
	}

	switch semanticType.Algorithm.Mask.(type) {

View on GitHub (pinned to 1870550677)

Solutions

1. Log/inspect the wrapped error to see the exact failing operation and attribute
2. Fix the stored exemption policy expression: use matches() or string() casts for type-sensitive comparisons and cel.bind/has() guards for absent values
3. Validate the expression at save time with ValidateMaskingRuleCELExpr-style compile+eval checks so bad expressions never reach evaluation
4. Pin or upgrade cel-go so extension function (ext.Strings) runtime behavior matches what the expression expects

Example fix

// before
resource.classification_level == "4"
// after
string(resource.classification_level) == "4"

// at save time: compile + sample eval
prg, err := env.Program(ast)
if err != nil { return err }
_, _, err = prg.Eval(sampleAttributes) // catch runtime issues early
return err

pass, err := evaluateMaskingExemptionPolicyCondition(cond, attrs)
if err != nil {
	log.Printf("exemption condition %q failed eval: %v", cond.GetExpression(), err)
	return false, nil // deny exemption on error (fail-closed)
}

When it happens

Trigger: In evaluateMaskingExemptionPolicyCondition (backend/api/v1/masking_evaluator.go:258), the stored exemption policy expression evaluates against the masking exemption attributes map (resource.database_name, resource.schema_name, resource.table_name, resource.column_name, resource.classification_level, request.time) and hits an unhandled runtime condition, e.g. comparing request.time with a wrong format or calling a string ext function on a non-string.

Common situations: Admin saved an exemption expression referencing attributes whose runtime type differs from what the expression assumes (e.g. classification_level as string vs int64); expression uses functions on nil/absent values; cel-go upgrade changed runtime semantics of an extension function.

Related errors

• failed to eval CEL program for masking rule
• failed to create CEL program for masking exemption policy
• expect bool result for masking exemption policy
• failed to create CEL program for masking rule
• expect bool result for masking rule

AI-assisted analysis of bytebase/bytebase@1870550677 (2026-09-06). Data as JSON: /api/errors/e2276ae1d523183f. Report an issue: GitHub.