Support match_path for non-repeated primitive fields, maps, and message.

PiperOrigin-RevId: 971054057

Author: CEL Dev Team

tools/proto_to_predicate.cc

@@ -246,7 +246,13 @@ class ProtoToPredicateBuilder final : private ExprFactory {
     const FieldDescriptor* const value_field =
         field->message_type()->FindFieldByName("value");
 
-    Expr map_path = NewSelect(NextId(), base_expr, field->name());
+    std::string match_path_val = GetMatchPath(field);
+    Expr map_path;
+    if (!match_path_val.empty()) {
+      map_path = ParseAndBuildPath(match_path_val);
+    } else {
+      map_path = NewSelect(NextId(), base_expr, field->name());
+    }
 
     struct MapEntry {
       const Message* message;
@@ -355,7 +361,13 @@ class ProtoToPredicateBuilder final : private ExprFactory {
         const Message& sub_message =
             reflection->GetRepeatedMessage(message, field, i);
         std::vector<Expr> sub_predicates;
-        Expr sub_base = NewSelect(NextId(), base_expr, field->name());
+        std::string match_path_val = GetMatchPath(field);
+        Expr sub_base;
+        if (!match_path_val.empty()) {
+          sub_base = ParseAndBuildPath(match_path_val);
+        } else {
+          sub_base = NewSelect(NextId(), base_expr, field->name());
+        }
         CEL_RETURN_IF_ERROR(Walk(sub_message, sub_base, sub_predicates));
         message_asts.push_back(LogicalAnd(sub_predicates));
       }
@@ -426,11 +438,23 @@ class ProtoToPredicateBuilder final : private ExprFactory {
         }
       } else if (field->cpp_type() == FieldDescriptor::CPPTYPE_MESSAGE) {
         const Message& sub_message = reflection->GetMessage(message, field);
-        Expr field_path = NewSelect(NextId(), base_expr, field->name());
+        std::string match_path_val = GetMatchPath(field);
+        Expr field_path;
+        if (!match_path_val.empty()) {
+          field_path = ParseAndBuildPath(match_path_val);
+        } else {
+          field_path = NewSelect(NextId(), base_expr, field->name());
+        }
         CEL_RETURN_IF_ERROR(Walk(sub_message, field_path, predicates));
       } else {
         // Primitive field: base_expr.field == <value>
-        Expr field_path = NewSelect(NextId(), base_expr, field->name());
+        std::string match_path_val = GetMatchPath(field);
+        Expr field_path;
+        if (!match_path_val.empty()) {
+          field_path = ParseAndBuildPath(match_path_val);
+        } else {
+          field_path = NewSelect(NextId(), base_expr, field->name());
+        }
         predicates.push_back(
             ConstructEquality(std::move(field_path),
                               PrimitiveToExpr(message, reflection, field)));

tools/proto_to_predicate_test.cc

@@ -549,6 +549,63 @@ INSTANTIATE_TEST_SUITE_P(
             .json_input = R"({ "destinations": [ { "tool": { } } ] })",
             .expected_unparsed = "true",
         },
+        PolicyTestCase{
+            .name = "AnnotatedSingularFieldInMessage",
+            .json_input =
+                R"({ "destinations": [ {
+                     "agent": {
+                       "id": "agent-007",
+                       "location": "us-central1"
+                     }
+                   } ] })",
+            .expected_unparsed = "dest.agent.name == \"agent-007\" && "
+                                 "custom.agent.location == \"us-central1\"",
+        },
+        PolicyTestCase{
+            .name = "AnnotatedOneofPrimitiveField",
+            .json_input =
+                R"({ "destinations": [ {
+                     "ip": "192.168.1.1"
+                   } ] })",
+            .expected_unparsed = "custom.ip == \"192.168.1.1\"",
+        },
+        PolicyTestCase{
+            .name = "AnnotatedMapFieldPrimitive",
+            .json_input =
+                R"({ "destinations": [ {
+                     "tool": {
+                       "annotated_labels": {
+                         "cluster": "us-central1"
+                       }
+                     }
+                   } ] })",
+            .expected_unparsed =
+                "\"cluster\" in custom.labels && "
+                "custom.labels[\"cluster\"] == \"us-central1\"",
+        },
+        PolicyTestCase{
+            .name = "AnnotatedMapFieldMessage",
+            .json_input =
+                R"({ "destinations": [ {
+                     "tool": {
+                       "annotated_role_members": {
+                         "admin": {
+                           "all_users": true,
+                           "principals": ["alice_user"],
+                           "leader": "alice",
+                           "leaders": ["bob"]
+                         }
+                       }
+                     }
+                   } ] })",
+            .expected_unparsed =
+                "\"admin\" in custom.role_members && "
+                "\"alice_user\" in custom.role_members[\"admin\"].principals "
+                "&& "
+                "custom.role_members[\"admin\"].all_users == true && "
+                "custom.member.leader == \"alice\" && "
+                "custom.member.leaders in [\"bob\"]",
+        },
         PolicyTestCase{
             .name = "MapEquality",
             .json_input =

tools/testdata/BUILD

@@ -32,6 +32,7 @@ proto_library(
     name = "test_policy_proto",
     srcs = ["test_policy.proto"],
     visibility = ["//tools:__subpackages__"],
+    deps = ["@com_google_protobuf//:protobuf"],
 )
 
 cc_proto_library(

tools/testdata/test_policy.proto

@@ -19,11 +19,18 @@ edition = "2023";
 
 package cel.cpp.tools;
 
+import "net/proto2/proto/descriptor.proto";
+
 option cc_enable_arenas = true;
 
+extend proto2.FieldOptions {
+  string match_path = 51074;
+}
+
 // Represents the targeted client agent.
 message Agent {
   string name = 1 [json_name = "id"];
+  string location = 2 [(match_path) = "custom.agent.location"];
 }
 
 // Specifies additional metadata tool annotations.
@@ -40,6 +47,10 @@ message Members {
   bool all_users = 3;
 
   bool all_authenticated_users = 4;
+
+  string leader = 5 [(match_path) = "custom.member.leader"];
+
+  repeated string leaders = 6 [(match_path) = "custom.member.leaders"];
 }
 
 // Represents a metadata tool block.
@@ -56,13 +67,22 @@ message Tool {
 
   // A map with string keys representing roles and Member instances as values.
   map<string, Members> role_members = 4;
+
+  // A map with string keys representing roles and Member instances as values,
+  // annotated with a match_path.
+  map<string, Members> annotated_role_members = 5
+      [(match_path) = "custom.role_members"];
+
+  // A string-to-string map, annotated with a match_path.
+  map<string, string> annotated_labels = 6 [(match_path) = "custom.labels"];
 }
 
 // Represents a policy mapping destination block.
 message Target {
   oneof kind {
     Agent agent = 1;
     Tool tool = 2;
+    string ip = 3 [(match_path) = "custom.ip"];
   }
 }