bytebase/bytebase · error

failed to parse expression

Error message

failed to parse expression

What it means

validateExpirationInExpression parses a CEL expression that encodes role expiration via request.time comparisons. This error wraps any failure from cel.Env.Parse(expr), meaning the expression string is not syntactically valid CEL (bad tokens, unbalanced parens, invalid operators). The library validates IAM policy expressions before accepting them, so malformed CEL is rejected up front.

Source

Thrown at backend/api/v1/project_service.go:1267

// validateExpirationInExpression validates the IAM policy expression.
// Currently only validate the following expression:
// * request.time < timestamp("2021-01-01T00:00:00Z")
//
// Other expressions will be ignored.
func validateExpirationInExpression(expr string, maximumExpiration *durationpb.Duration) error {
	if maximumExpiration == nil {
		return nil
	}
	if !strings.Contains(expr, "request.time") {
		return errors.Errorf("request.time is required")
	}
	e, err := cel.NewEnv()
	if err != nil {
		return errors.Wrap(err, "failed to create cel environment")
	}
	ast, iss := e.Parse(expr)
	if iss != nil {
		return errors.Wrap(iss.Err(), "failed to parse expression")
	}

	var validator func(expr celast.Expr) error

	validator = func(expr celast.Expr) error {
		switch expr.Kind() {
		case celast.CallKind:
			functionName := expr.AsCall().FunctionName()
			switch functionName {
			case "_||_":
				for _, arg := range expr.AsCall().Args() {
					err := validator(arg)
					if err != nil {
						return err
					}
				}
				return nil
			case "_&&_":

View on GitHub (pinned to 1870550677)

Solutions

1. Validate the CEL expression locally with the CEL parser or an online CEL playground before submitting the policy
2. Check for unbalanced quotes, parentheses, and stray characters in the expression string
3. Use the exact expected form: timestamp(request.time) < timestamp("RFC3339-time")
4. If generated, fix the code that interpolates the expiration timestamp into the expression template

Example fix

// before
expr := `timestamp(request.time) < timestamp("2026-01-01T00:00:00Z"`  // missing )
// after
expr := `timestamp(request.time) < timestamp("2026-01-01T00:00:00Z")`

if _, iss := cel.NewEnv().Parse(expr); iss != nil { return fmt.Errorf("invalid CEL expression: %v", iss.Err()) }

func isNonEmptyString(s string) bool { return strings.TrimSpace(s) != "" }

When it happens

Trigger: Calling buildIssueMessage or validateBindings with an IAM policy binding whose 'expression' field contains syntactically invalid CEL, e.g. 'timestamp(request.time) <' or 'request.time <"2025-01-01T00:00:00Z' with unbalanced quotes/parens.

Common situations: Hand-edited IAM policy JSON, copy-pasted expressions with smart quotes or missing closing quotes, templates with unfilled placeholders like '<expiry-time>', or expressions built programmatically with formatting bugs.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• failed to build CEL expression
• filter exceeds the maximum supported size of 100000 code poi
• invalid filter expression
• invalid empty creator identifier
• CodeInvalidArgument

AI-assisted analysis of bytebase/bytebase@1870550677 (2026-09-06). Data as JSON: /api/errors/d091e9fdb5f9145b. Report an issue: GitHub.