Implement aggregate rule composition in CEL C++ policy compiler.

MODULE.bazel

@@ -99,9 +99,9 @@ bazel_dep(
     version = "0.9.0",
 )
 
-_CEL_POLICY_TAG = "4c2c2fd5b8f20da4eb34e3ee82a4ef1b7f023347"
+_CEL_POLICY_TAG = "8e4cf0378e3f0d3406b537afbcc6f59562652ad6"
 
-_CEL_POLICY_SHA = "e2bd943f89a3cab3b6508daf0bc5aa53d00e3e6ea52ef14a1d6f618a2b2909be"
+_CEL_POLICY_SHA = "c3aaed647f04efb7f77d67de21f21720d298938a066cec7f94dd9e24f9a8d88f"
 
 http_archive = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 

checker/internal/type_inference_context.cc

@@ -15,6 +15,7 @@
 #include "checker/internal/type_inference_context.h"
 
 #include <cstddef>
+#include <optional>
 #include <string>
 #include <utility>
 #include <vector>

conformance/policy/BUILD

@@ -65,6 +65,16 @@ cc_library(
 )
 
 _ALL_TESTS = [
+    "@cel_policy//conformance:agent_tool_execution_governance",
+    "@cel_policy//conformance:aggregate",
+    "@cel_policy//conformance:aggregate_explicit_list_output",
+    "@cel_policy//conformance:aggregate_explicit_optional_none",
+    "@cel_policy//conformance:aggregate_nested_all_rules_fall_through_to_empty",
+    "@cel_policy//conformance:aggregate_nested_explicit_list_double_wrapping",
+    "@cel_policy//conformance:aggregate_nested_multi_branch_match",
+    "@cel_policy//conformance:aggregate_nested_single_conditional_match",
+    "@cel_policy//conformance:aggregate_shadowed_variables",
+    "@cel_policy//conformance:first_match_nested_aggregate",
     "@cel_policy//conformance:k8s",
     "@cel_policy//conformance:limits",
     "@cel_policy//conformance:nested_rule",
@@ -81,9 +91,15 @@ _ALL_TESTS = [
     "@cel_policy//conformance:unconditional_rules",
     "@cel_policy//conformance:unnest",
     "@cel_policy//conformance:variable_type_propagation",
+    "@cel_policy//conformance:compile_error_aggregate_false_condition",
+    "@cel_policy//conformance:compile_error_aggregate_heterogeneous_outputs",
+    "@cel_policy//conformance:compile_error_aggregate_nested_mixed_semantics",
+    "@cel_policy//conformance:compile_error_aggregate_subrule_heterogeneous_outputs",
+    "@cel_policy//conformance:compile_error_aggregate_unreachable_in_nested_first_match",
     "@cel_policy//conformance:compile_error_compose_conflicting_output",
     "@cel_policy//conformance:compile_error_compose_conflicting_subrule",
     "@cel_policy//conformance:compile_error_unreachable",
+    "@cel_policy//conformance:compile_error_unreachable_under_unconditional_aggregate_subrule",
     "@cel_policy//conformance:compile_error_duplicate_variable",
     "@cel_policy//conformance:compile_error_import",
     "@cel_policy//conformance:compile_error_incompatible_outputs",
@@ -97,6 +113,12 @@ cel_policy_conformance_test(
         # TODO(b/506179116): Fix these.
         # Need to add k8s custom yaml parser and mock runtime.
         "k8s",
+        # Expects Java reverse-order type mismatch error message.
+        "compile_error_aggregate_heterogeneous_outputs",
+        # Expects "rule creates unreachable outputs" on the exhaustive subrule,
+        # whereas C++ reports "match creates unreachable outputs" on the
+        # subsequent unreachable match.
+        "compile_error_unreachable_under_unconditional_aggregate_subrule",
     ],
     test_files = _ALL_TESTS,
 )

conformance/policy/policy_conformance_test.cc

@@ -141,6 +141,43 @@ cel::Value LocationCode(const cel::StringValue& ip,
   return cel::StringValue::WrapUnsafe("ir");
 }
 
+bool MapContainsKey(const cel::MapValue& map_val, absl::string_view key,
+                    const google::protobuf::DescriptorPool* pool,
+                    google::protobuf::MessageFactory* factory, google::protobuf::Arena* arena) {
+  cel::Value has_val;
+  if (!map_val
+           .Has(cel::StringValue::WrapUnsafe(key), pool, factory, arena,
+                &has_val)
+           .ok()) {
+    return false;
+  }
+  return has_val.IsTrue();
+}
+
+cel::Value HasCreditCard(const cel::Value& arg,
+                         const google::protobuf::DescriptorPool* pool,
+                         google::protobuf::MessageFactory* factory,
+                         google::protobuf::Arena* arena) {
+  if (!arg.IsMap()) {
+    return cel::BoolValue(false);
+  }
+  return cel::BoolValue(
+      MapContainsKey(arg.GetMap(), "cc", pool, factory, arena));
+}
+
+cel::Value HasEmailOrPhone(const cel::Value& arg,
+                           const google::protobuf::DescriptorPool* pool,
+                           google::protobuf::MessageFactory* factory,
+                           google::protobuf::Arena* arena) {
+  if (!arg.IsMap()) {
+    return cel::BoolValue(false);
+  }
+  const cel::MapValue& map_val = arg.GetMap();
+  return cel::BoolValue(
+      MapContainsKey(map_val, "email", pool, factory, arena) ||
+      MapContainsKey(map_val, "phone", pool, factory, arena));
+}
+
 // TODO(uncreated-issue/92): This should be migrated to use the testrunner utility
 // after adding support for reading the yaml specification for envs/tests.
 class InputEvaluator {
@@ -568,11 +605,19 @@ absl::Status RegisterTestSuite(
     }
   }
 
-  // Register locationCode in runtime
+  // Register custom functions in runtime
   CEL_RETURN_IF_ERROR(
       (cel::UnaryFunctionAdapter<cel::Value, const cel::StringValue&>::
            RegisterGlobalOverload("locationCode", LocationCode,
                                   runtime_builder.function_registry())));
+  CEL_RETURN_IF_ERROR(
+      (cel::UnaryFunctionAdapter<cel::Value, const cel::Value&>::
+           RegisterGlobalOverload("hasCreditCard", HasCreditCard,
+                                  runtime_builder.function_registry())));
+  CEL_RETURN_IF_ERROR(
+      (cel::UnaryFunctionAdapter<cel::Value, const cel::Value&>::
+           RegisterGlobalOverload("hasEmailOrPhone", HasEmailOrPhone,
+                                  runtime_builder.function_registry())));
 
   CEL_ASSIGN_OR_RETURN(auto runtime, std::move(runtime_builder).Build());
 

policy/BUILD

@@ -195,6 +195,7 @@ cc_test(
         "//common:ast",
         "//common:ast_proto",
         "//common:decl",
+        "//common:expr",
         "//common:navigable_ast",
         "//common:source",
         "//common:type",
@@ -209,6 +210,7 @@ cc_test(
         "//internal:status_macros",
         "//internal:testing",
         "//internal:testing_descriptor_pool",
+        "//internal:testing_message_factory",
         "//runtime",
         "//runtime:activation",
         "//runtime:optional_types",