}

	// 3. If an inline session-policy is present, evaluate it.
	hasSessionPolicy, isAllowedSP := isAllowedBySessionPolicyForServiceAccount(args)
	if hasSessionPolicy {
		return isAllowedSP && (isOwnerDerived || combinedPolicy.IsAllowed(parentArgs))
	}

	// Sub policy not set. Evaluate only the parent policies.
	return (isOwnerDerived || combinedPolicy.IsAllowed(parentArgs))
}

	errWildcardArrayLookup        = errors.New("Array wildcard used on non-array value")
	errWildcardObjectUsageInvalid = errors.New("Invalid usage of object wildcard")
)

// jsonpathEval evaluates a JSON path and returns the value at the path.
// If the value should be considered flat (from wildcards) any array returned should be considered individual values.

		w.Header().Set(xhttp.AmzServerSideEncryptionCustomerKeyMD5, r.Header.Get(xhttp.AmzServerSideEncryptionCustomerKeyMD5))
	}

	s3Select.Evaluate(w)

	// Notify object accessed via a GET request.
	sendEvent(eventArgs{
		EventName:    event.ObjectAccessedGet,
		BucketName:   bucket,
		Object:       objInfo,
		ReqParams:    extractReqParams(r),

					// opts.DeletePrefix is used only in the above lifecycle Expiration actions.
				default:
					// object has been modified since lifecycle action was previously evaluated
					isErr = true
				}
				if isErr {
					if goi.VersionID != "" {
						return goi, VersionNotFound{
							Bucket:    bucket,
							Object:    object,
							VersionID: goi.VersionID,

			if len(testCase.withJSON) > 0 {
				in = testCase.withJSON
			}
			if err = s3Select.Open(newStringRSC(in)); err != nil {
				t.Fatal(err)
			}

			w := &testResponseWriter{}
			s3Select.Evaluate(w)
			s3Select.Close()
			resp := http.Response{
				StatusCode:    http.StatusOK,
				Body:          io.NopCloser(bytes.NewReader(w.response)),
				ContentLength: int64(len(w.response)),
			}

type metaCacheEntriesSorted struct {
	o metaCacheEntries
	// list id is not serialized
	listID string
	// Reuse buffers
	reuse bool
	// Contain the last skipped object after an ILM expiry evaluation
	lastSkippedEntry string
}

// shallowClone will create a shallow clone of the array objects,
// but object metadata will not be cloned.
func (m metaCacheEntriesSorted) shallowClone() metaCacheEntriesSorted {

"minio.imagePullSecrets" -}} {{/* Helm 2.11 supports the assignment of a value to a variable defined in a different scope, but Helm 2.9 and 2.10 does not support it, so we need to implement this if-else logic. Also, we can not use a single if because lazy evaluation is not an option */}} {{- if .Values.global }} {{- if .Values.global.imagePullSecrets }} imagePullSecrets: {{- range .Values.global.imagePullSecrets }} - name: {{ . }} {{- end }} {{- else if .Values.imagePullSecrets }} imagePullSecrets: {{ toYaml...

"minio.imagePullSecrets" -}} {{/* Helm 2.11 supports the assignment of a value to a variable defined in a different scope, but Helm 2.9 and 2.10 does not support it, so we need to implement this if-else logic. Also, we can not use a single if because lazy evaluation is not an option */}} {{- if .Values.global }} {{- if .Values.global.imagePullSecrets }} imagePullSecrets: {{- range .Values.global.imagePullSecrets }} - name: {{ . }} {{- end }} {{- else if .Values.imagePullSecrets }} imagePullSecrets: {{ toYaml...

	errLikeInvalidEscape = errors.New("LIKE clause has invalid ESCAPE character")
	errNotImplemented    = errors.New("not implemented")
)

// AST Node Evaluation functions
//
// During evaluation, the query is known to be valid, as analysis is
// complete. The only errors possible are due to value type
// mismatches, etc.
//
// If an aggregation node is present as a descendant (when

	Extract   *ExtractFunc   `parser:"| @@"`
	Trim      *TrimFunc      `parser:"| @@"`
	DateAdd   *DateAddFunc   `parser:"| @@"`
	DateDiff  *DateDiffFunc  `parser:"| @@"`

	// Used during evaluation for aggregation funcs
	aggregate *aggVal
}

// SimpleArgFunc represents functions with simple expression
// arguments.
type SimpleArgFunc struct {