Help needed writing a cel expression for a caveat

[vmendiratta]

Say, my caveat looks like following:

caveat attributes_match(expected map<any>, provided map<any>) {
   <a-cel-expression>
}

Sample:
expected - {"label": "important", "sub_label": ["some_value_1", "some_value_2"]}
provided - {"another_label": "something_else", "label": "important", "sub_label": ["some_value_1", "some_value_2", "some_value_3", "some_value_4"]}

I'm finding it a challenge to come up with a cel expression that, for every (key, value) pair in the expected map,:

1. Tests the (key, value) pair's existence in the provided map if the value is of a primitive type. If value is not of a primitive type, then
2. Tests if the value (expected) is a subset of the value (provided) if the value is of a type list (slice). If value is of a type map, then
3. Recursively applies the same logic.

Can you please guide me on how to go about this?

[vroldanbet]

@vmendiratta 👋🏻 we created a custom CEL macro function for this, I think it should do what you expect:

caveat attributes_match(expected map<any>, provided map<any>) {
  expected.isSubtreeOf(provided)
}

See this example in SpiceDB tests

[vmendiratta]

Thank you @vroldanbet for your answer. Actually, I did test that macro but it doesn't work when the value stored against a key is a list. It works beautifully when it's either a primitive type or a map. Is there any way users could write similar custom macros themselves? It should be relatively trivial for me to extend isSubtreeOf to support lists also.

[vroldanbet]

@vmendiratta 👋🏻 I think those missing semantics fit in in IsSubtreeOf. Perhaps you'd contribute to the changes upstream? Otherwise, contributing your own macro involves using SpiceDB Go APIs and creating a custom build, I assume that's not the route you want to take.

[vmendiratta]

Will propose a PR and share. Thank you @vroldanbet