Add ProtoTypeMaskProvider, ProtoTypeMask, and FieldPath classes. The ProtoTypeMaskProvider has functions that can be used to validate the input field masks and to check whether a field is visible.

PiperOrigin-RevId: 818745535

Author: CEL Dev Team

checker/internal/BUILD

@@ -271,3 +271,81 @@ cc_test(
         "@com_google_protobuf//:protobuf",
     ],
 )
+
+cc_library(
+    name = "field_path",
+    hdrs = ["field_path.h"],
+    deps = [
+        "@com_google_absl//absl/strings",
+        "@com_google_absl//absl/strings:str_format",
+        "@com_google_absl//absl/strings:string_view",
+    ],
+)
+
+cc_test(
+    name = "field_path_test",
+    srcs = ["field_path_test.cc"],
+    deps = [
+        ":field_path",
+        "//internal:testing",
+        "@com_google_absl//absl/strings",
+    ],
+)
+
+cc_library(
+    name = "proto_type_mask",
+    hdrs = ["proto_type_mask.h"],
+    deps = [
+        ":field_path",
+        "@com_google_absl//absl/strings",
+    ],
+)
+
+cc_test(
+    name = "proto_type_mask_test",
+    srcs = ["proto_type_mask_test.cc"],
+    deps = [
+        ":field_path",
+        ":proto_type_mask",
+        "//internal:testing",
+        "@com_google_absl//absl/strings",
+    ],
+)
+
+cc_library(
+    name = "proto_type_mask_provider",
+    srcs = ["proto_type_mask_provider.cc"],
+    hdrs = ["proto_type_mask_provider.h"],
+    deps = [
+        ":field_path",
+        ":proto_type_mask",
+        "//common:type",
+        "//internal:status_macros",
+        "//util/gtl:iterator_adaptors",
+        "@com_google_absl//absl/container:flat_hash_map",
+        "@com_google_absl//absl/memory",
+        "@com_google_absl//absl/status",
+        "@com_google_absl//absl/status:statusor",
+        "@com_google_absl//absl/strings",
+        "@com_google_absl//absl/strings:str_format",
+        "@com_google_absl//absl/strings:string_view",
+        "@com_google_absl//absl/types:optional",
+        "@com_google_protobuf//:protobuf",
+    ],
+)
+
+cc_test(
+    name = "proto_type_mask_provider_test",
+    srcs = ["proto_type_mask_provider_test.cc"],
+    deps = [
+        ":proto_type_mask",
+        ":proto_type_mask_provider",
+        "//internal:testing",
+        "//internal:testing_descriptor_pool",
+        "@com_google_absl//absl/container:flat_hash_map",
+        "@com_google_absl//absl/status",
+        "@com_google_absl//absl/status:status_matchers",
+        "@com_google_absl//absl/strings",
+        "@com_google_absl//absl/strings:string_view",
+    ],
+)

checker/internal/field_path.h

@@ -0,0 +1,71 @@
+// Copyright 2025 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef THIRD_PARTY_CEL_CPP_CHECKER_FIELD_PATH_H_
+#define THIRD_PARTY_CEL_CPP_CHECKER_FIELD_PATH_H_
+
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "absl/strings/str_format.h"
+#include "absl/strings/str_join.h"
+#include "absl/strings/str_split.h"
+#include "absl/strings/string_view.h"
+#include "absl/strings/substitute.h"
+
+// Represents a single path within a FieldMask.
+class FieldPath {
+ public:
+  explicit FieldPath(std::string path) : path_(std::move(path)) {
+    field_selection_ = absl::StrSplit(path_, kPathDelimiter);
+  }
+
+  std::string GetPath() const { return path_; }
+
+  std::vector<std::string> GetFieldSelection() const {
+    return field_selection_;
+  }
+
+  // Returns the first field name in the path.
+  std::string GetFieldName() const { return field_selection_.front(); }
+
+  template <typename Sink>
+  friend void AbslStringify(Sink& sink, const FieldPath& field_path) {
+    const std::string field_selection =
+        absl::StrJoin(field_path.GetFieldSelection(), "', '");
+    std::string output = absl::Substitute(
+        "FieldPath { field path: '$0', field selection: {'$1'} }",
+        field_path.GetPath(), field_selection);
+    absl::Format(&sink, "%v", output);
+  }
+
+ private:
+  static inline constexpr char kPathDelimiter = '.';
+
+  // The input path. For example: "f.b.d".
+  std::string path_;
+  // The list of nested field names in the path. For example: {"f", "b", "d"}.
+  std::vector<std::string> field_selection_;
+};
+
+inline bool operator==(const FieldPath& lhs, const FieldPath& rhs) {
+  return lhs.GetFieldSelection() == rhs.GetFieldSelection();
+}
+
+inline bool operator<(const FieldPath& lhs, const FieldPath& rhs) {
+  return lhs.GetFieldSelection() < rhs.GetFieldSelection();
+}
+
+#endif  // THIRD_PARTY_CEL_CPP_CHECKER_FIELD_PATH_H_

checker/internal/field_path_test.cc

@@ -0,0 +1,77 @@
+// Copyright 2025 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "checker/internal/field_path.h"
+
+#include "absl/strings/str_cat.h"
+#include "internal/testing.h"
+
+namespace {
+
+using ::testing::ElementsAre;
+
+TEST(FieldPathTest, EmptyPathReturnsEmptyString) {
+  FieldPath field_path("");
+  EXPECT_EQ(field_path.GetPath(), "");
+  EXPECT_THAT(field_path.GetFieldSelection(), ElementsAre(""));
+  EXPECT_EQ(field_path.GetFieldName(), "");
+}
+
+TEST(FieldPathTest, DelimiterPathReturnsEmptyStrings) {
+  FieldPath field_path(".");
+  EXPECT_EQ(field_path.GetPath(), ".");
+  EXPECT_THAT(field_path.GetFieldSelection(), ElementsAre("", ""));
+  EXPECT_EQ(field_path.GetFieldName(), "");
+}
+
+TEST(FieldPathTest, FieldPathReturnsFields) {
+  FieldPath field_path("resource.name.other_field");
+  EXPECT_EQ(field_path.GetPath(), "resource.name.other_field");
+  EXPECT_THAT(field_path.GetFieldSelection(),
+              ElementsAre("resource", "name", "other_field"));
+  EXPECT_EQ(field_path.GetFieldName(), "resource");
+}
+
+TEST(FieldPathTest, AbslStringifyPrintsFieldSelection) {
+  FieldPath field_path("resource.name");
+  EXPECT_EQ(absl::StrCat(field_path),
+            "FieldPath { field path: 'resource.name', field selection: "
+            "{'resource', 'name'} }");
+}
+
+TEST(FieldPathTest, EqualsComparesFieldSelectionAndReturnsTrue) {
+  FieldPath field_path_1("resource.name");
+  FieldPath field_path_2("resource.name");
+  EXPECT_TRUE(field_path_1 == field_path_2);
+}
+
+TEST(FieldPathTest, EqualsComparesFieldSelectionAndReturnsFalse) {
+  FieldPath field_path_1("resource.name");
+  FieldPath field_path_2("resource.type");
+  EXPECT_FALSE(field_path_1 == field_path_2);
+}
+
+TEST(FieldPathTest, LessThanComparesFieldSelectionAndReturnsTrue) {
+  FieldPath field_path_1("resource.name");
+  FieldPath field_path_2("resource.type");
+  EXPECT_TRUE(field_path_1 < field_path_2);
+}
+
+TEST(FieldPathTest, LessThanComparesFieldSelectionAndReturnsFalse) {
+  FieldPath field_path_1("resource.name");
+  FieldPath field_path_2("resource.name");
+  EXPECT_FALSE(field_path_1 < field_path_2);
+}
+
+}  // namespace

checker/internal/proto_type_mask.h

@@ -0,0 +1,63 @@
+// Copyright 2025 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef THIRD_PARTY_CEL_CPP_CHECKER_PROTO_TYPE_MASK_H_
+#define THIRD_PARTY_CEL_CPP_CHECKER_PROTO_TYPE_MASK_H_
+
+#include <set>
+#include <string>
+#include <utility>
+
+#include "absl/strings/str_join.h"
+#include "absl/strings/substitute.h"
+#include "checker/internal/field_path.h"
+
+// Represents the fraction of a protobuf type's object graph that should be
+// visible within CEL expressions.
+class ProtoTypeMask {
+ public:
+  explicit ProtoTypeMask(std::string type_name,
+                         const std::set<std::string>& field_paths)
+      : type_name_(std::move(type_name)) {
+    for (const std::string& field_path : field_paths) {
+      field_paths_.insert(FieldPath(field_path));
+    }
+  };
+
+  std::string GetTypeName() const { return type_name_; }
+
+  std::set<FieldPath> GetFieldPaths() const { return field_paths_; }
+
+  template <typename Sink>
+  friend void AbslStringify(Sink& sink, const ProtoTypeMask& proto_type_mask) {
+    std::string field_paths =
+        absl::StrJoin(proto_type_mask.GetFieldPaths(), ", ");
+    std::string output = absl::Substitute(
+        "ProtoTypeMask { type name: '$0', field paths: { $1 } }",
+        proto_type_mask.GetTypeName(), field_paths);
+    absl::Format(&sink, "%v", output);
+  }
+
+ private:
+  // A type's full name. For example: "google.rpc.context.AttributeContext".
+  std::string type_name_;
+  // A representation of a FieldMask, which is a set of field paths.
+  // A FieldMask contains one or more paths which contain identifier characters
+  // that have been dot delimited, e.g. resource.name, request.auth.claims.
+  // For each path, all descendent fields after the last element in the path are
+  // visible. An empty set means all fields are hidden.
+  std::set<FieldPath> field_paths_;
+};
+
+#endif  // THIRD_PARTY_CEL_CPP_CHECKER_PROTO_TYPE_MASK_H_