bytebase/bytebase · error

failed to get query export factors

Error message

failed to get query export factors

What it means

buildCELVariablesForRoleGrant extracts risk factors (referenced databases) from the role-grant condition CEL expression via common.GetQueryExportFactors. That function compiles the expression in the IAM condition CEL environment; any compile issue or AST conversion failure is wrapped as 'failed to get query export factors'.

Source

Thrown at backend/component/review/evaluator.go:798

	// If no tasks, return empty list (no approval needed)
	if len(celVarsList) == 0 {
		celVarsList = append(celVarsList, map[string]any{})
	}

	return celVarsList, approvalInputVersion, true, nil
}

// buildCELVariablesForRoleGrant builds CEL variables for ROLE_GRANT issues.
func buildCELVariablesForRoleGrant(ctx context.Context, stores *store.Store, issue *store.IssueMessage) ([]map[string]any, bool, error) {
	payload := issue.Payload
	if payload.RoleGrant == nil {
		return nil, false, errors.New("role grant payload not found")
	}

	factors, err := common.GetQueryExportFactors(payload.GetRoleGrant().GetCondition().GetExpression())
	if err != nil {
		return nil, false, errors.Wrap(err, "failed to get query export factors")
	}

	// Default to max int if expiration is not set (no expiration)
	expirationDays := int64(math.MaxInt32)
	if payload.RoleGrant.Expiration != nil {
		expirationDays = int64(payload.RoleGrant.Expiration.AsDuration().Hours() / 24)
	}

	baseVars := map[string]any{
		common.CELAttributeResourceProjectID:     issue.ProjectID,
		common.CELAttributeRequestExpirationDays: expirationDays,
		common.CELAttributeRequestRole:           payload.RoleGrant.Role,
	}

	// If no specific databases, create one entry per environment
	if len(factors.Databases) == 0 {
		issueProject, err := stores.GetProjectByResourceID(ctx, issue.ProjectID)
		if err != nil {

View on GitHub (pinned to 1870550677)

Solutions

1. Validate the condition expression with a CEL linter/compiler against the IAM policy attributes before saving the role grant.
2. Fix the syntax or identifier errors reported in the wrapped 'found issue ...' message.
3. Ensure the condition only references supported attributes (e.g. resource.database) with correct literal types.
4. Clear the malformed condition and re-create the role grant through the UI/API validation path.

Example fix

// before (type error)
resource.database == 123
// after
resource.database == "projects/p/instances/i/databases/db"

// Validate the CEL condition before saving a role grant:
env := cel.NewEnv(common.IAMPolicyConditionCELAttributes...)
if _, issues := env.Compile(expr); issues != nil {
  return fmt.Errorf("invalid role grant condition: %v", issues)
}

if err != nil {
  return fmt.Errorf("rejected role grant: condition failed to compile: %w", err) // surface the CEL issues to the caller
}

When it happens

Trigger: payload.RoleGrant.Condition.Expression is non-empty but not a valid CEL expression against the IAM condition attributes: syntax error, unknown identifier (e.g. referencing a field outside resource.database), or wrong types in comparisons like resource.database == 1.

Common situations: Hand-edited IAM policy condition; condition authored for a different schema version (attribute renamed); API client posting a role grant with a malformed condition string; whitespace/encoding corruption in stored policy JSON.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• failed to parse expression
• unexpected variable %v
• unexpected function %v
• unexpected number of arguments %d
• unexpected argument kind %v

AI-assisted analysis of bytebase/bytebase@1870550677 (2026-09-06). Data as JSON: /api/errors/55e504026f6670be. Report an issue: GitHub.