See the License for the specific language governing permissions and
limitations under the License.
*/

package cel

import (
	"fmt"
	"reflect"

	"github.com/google/cel-go/cel"
	"github.com/google/cel-go/checker/decls"
	"github.com/google/cel-go/common/types"
	"github.com/google/cel-go/common/types/ref"
	"k8s.io/apimachinery/pkg/api/resource"
)

var (

	c := &Controller{}
	if filter != nil {
		compilation := cel.Compiler.CompileCELExpression(filter.Selector, environment.StoredExpressions)
		if compilation.Error != nil {
			// Shouldn't happen because of validation.
			return nil, fmt.Errorf("compile class filter CEL expression: %w", compilation.Error)
		}
		c.filter = &compilation
	}
	for _, request := range requests {

import (
	"context"

	celgo "github.com/google/cel-go/cel"

	corev1 "k8s.io/api/core/v1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/runtime"
	"k8s.io/apimachinery/pkg/runtime/schema"
	"k8s.io/apiserver/pkg/admission"
	"k8s.io/apiserver/pkg/admission/plugin/cel"
	"k8s.io/apiserver/pkg/authorization/authorizer"
)

var _ cel.ExpressionAccessor = &ValidationCondition{}

	return v.Expression
}

func (v *MatchCondition) ReturnTypes() []*cel.Type {
	return []*cel.Type{cel.BoolType}
}

var _ Matcher = &matcher{}

// matcher evaluates compiled cel expressions and determines if they match the given request or not
type matcher struct {
	filter      celplugin.Filter
	failPolicy  v1.FailurePolicyType
	matcherType string
	matcherKind string
	objectName  string
}

WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package cel

import (
	"context"
	"fmt"
	"time"

	celgo "github.com/google/cel-go/cel"

	authorizationv1 "k8s.io/api/authorization/v1"
	utilerrors "k8s.io/apimachinery/pkg/util/errors"
)

type CELMatcher struct {
	CompilationResults []CompilationResult

limitations under the License.
*/

package cel

import (
	celgo "github.com/google/cel-go/cel"
)

type ExpressionAccessor interface {
	GetExpression() string
	ReturnTypes() []*celgo.Type
}

var _ ExpressionAccessor = &SubjectAccessReviewMatchCondition{}

// SubjectAccessReviewMatchCondition is a CEL expression that maps a SubjectAccessReview request to a list of values.

limitations under the License.
*/

package cel

import (
	"fmt"
	"math"
	"net/netip"
	"reflect"

	"github.com/google/cel-go/cel"
	"github.com/google/cel-go/common/types"
	"github.com/google/cel-go/common/types/ref"
)

// IP provides a CEL representation of an IP address.
type IP struct {
	netip.Addr
}

var (
	IPType = cel.OpaqueType("net.IP")
)

		t.Errorf("got %s, wanted elem type of string", list.ElemType.TypeName())
	}
	expT, err := list.ExprType()
	if err != nil {
		t.Errorf("fail to get cel type: %s", err)
	}
	if expT.GetListType() == nil {
		t.Errorf("got %v, wanted CEL list type", expT)
	}
}

func TestTypes_MapType(t *testing.T) {
	mp := NewMapType(StringType, IntType, -1)
	if !mp.IsMap() {
		t.Error("map type not identifiable as map")

	//
	// CEL expressions have access to the contents of the token claims, organized into CEL variable:
	// - 'claims' is a map of claim names to claim values.
	//   For example, a variable named 'sub' can be accessed as 'claims.sub'.
	//   Nested claims can be accessed using dot notation, e.g. 'claims.foo.bar'.
	//
	// Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/

	}
	return allErrs
}

func convertCELErrorToValidationError(fldPath *field.Path, expression string, err *cel.Error) *field.Error {
	switch err.Type {
	case cel.ErrorTypeRequired:
		return field.Required(fldPath, err.Detail)
	case cel.ErrorTypeInvalid:
		return field.Invalid(fldPath, expression, err.Detail)
	case cel.ErrorTypeInternal:
		return field.InternalError(fldPath, err)
	}