&ClaimValidationCondition{
					Expression: "claims.foo",
				},
			},
			wantErr: "must evaluate to bool",
		},
		{
			name: "UserValidationCondition with wrong env",
			expressionAccessors: []ExpressionAccessor{
				&UserValidationCondition{
					Expression: "user.username == 'foo'",
				},
			},
			wantErr: `compilation failed: ERROR: <input>:1:1: undeclared reference to 'user' (in container '')`,

	return []*celgo.Type{celgo.AnyType}
}

var _ ExpressionAccessor = &UserValidationCondition{}

// UserValidationCondition is a CEL expression that validates a User.
type UserValidationCondition struct {
	Expression string
	Message    string
}

// GetExpression returns the CEL expression.
func (v *UserValidationCondition) GetExpression() string {
	return v.Expression
}

		if err := checkValidationRulesEvaluation(evalResult, func(a authenticationcel.ExpressionAccessor) (string, error) {
			userValidationCondition, ok := a.(*authenticationcel.UserValidationCondition)
			if !ok {
				return "", fmt.Errorf("invalid type conversion, expected UserValidationCondition")
			}
			return userValidationCondition.Message, nil
		}); err != nil {

			continue
		}
		seenExpressions.Insert(rule.Expression)

		compilationResult, err := compileUserCELExpression(compiler, &authenticationcel.UserValidationCondition{
			Expression: rule.Expression,
			Message:    rule.Message,
		}, fldPath.Child("expression"))

		if err != nil {
			allErrs = append(allErrs, err)
			continue
		}