JLCEL Course

PC06-L04 · independent challenge

Complete authorization decision

Combine account state, permission, classification, ownership, and session validity.

Practical CEL4 test casesDocumented
What will I practise?

You can independently build and defend a complex authorization rule.

How is it checked?

Your one expression must produce the expected result for all four JSON inputs.

When am I done?

When all tests pass and you can explain every condition in your expression.

Word problem

Authorize an action only for an active, non-suspended user who has the action permission and classification access, is the owner or an administrator, and has an unexpired session.

Exact requirements

  1. Account state, permission, and classification are mandatory.
  2. Ownership and administrator role are alternatives.
  3. The current instant must be strictly before session expiry.
  4. No single successful condition can bypass another mandatory condition.

Required result

Write one CEL expression. It must return the expected value and type for all four prepared JSON inputs. Do not change the inputs to make an incomplete expression pass.

Recommended procedure

  1. Translate each numbered requirement into one small boolean condition.
  2. Run the starter expression and inspect which cases fail.
  3. Add one condition at a time and run the complete suite again.
  4. Mark the challenge complete only when you can explain every operator and every boundary.

Solve the challenge · browser test suite

Write one expression that passes every case

Edit the CEL expression, then run it against all prepared JSON inputs. A solution is complete only when every case passes.

4 test cases

Hint: Join every required condition with &&; only ownership and the admin role are alternatives.

Tip: press Ctrl/⌘ + Enter to run all tests.
Active ownerNot run yet
Expected: true · bool
Show JSON input
{
  "now": "2026-07-23T10:00:00Z",
  "action": "edit",
  "user": {
    "id": "u1",
    "active": true,
    "suspended": false,
    "permissions": [
      "edit"
    ],
    "allowedClassifications": [
      "internal"
    ],
    "roles": []
  },
  "resource": {
    "ownerId": "u1",
    "classification": "internal"
  },
  "session": {
    "expiresAt": "2026-07-23T11:00:00Z"
  }
}
Administrator is not ownerNot run yet
Expected: true · bool
Show JSON input
{
  "now": "2026-07-23T10:00:00Z",
  "action": "edit",
  "user": {
    "id": "u2",
    "active": true,
    "suspended": false,
    "permissions": [
      "edit"
    ],
    "allowedClassifications": [
      "internal"
    ],
    "roles": [
      "admin"
    ]
  },
  "resource": {
    "ownerId": "u1",
    "classification": "internal"
  },
  "session": {
    "expiresAt": "2026-07-23T11:00:00Z"
  }
}
Permission missingNot run yet
Expected: false · bool
Show JSON input
{
  "now": "2026-07-23T10:00:00Z",
  "action": "edit",
  "user": {
    "id": "u1",
    "active": true,
    "suspended": false,
    "permissions": [
      "read"
    ],
    "allowedClassifications": [
      "internal"
    ],
    "roles": [
      "admin"
    ]
  },
  "resource": {
    "ownerId": "u1",
    "classification": "internal"
  },
  "session": {
    "expiresAt": "2026-07-23T11:00:00Z"
  }
}
Session expiredNot run yet
Expected: false · bool
Show JSON input
{
  "now": "2026-07-23T11:00:00Z",
  "action": "edit",
  "user": {
    "id": "u1",
    "active": true,
    "suspended": false,
    "permissions": [
      "edit"
    ],
    "allowedClassifications": [
      "internal"
    ],
    "roles": []
  },
  "resource": {
    "ownerId": "u1",
    "classification": "internal"
  },
  "session": {
    "expiresAt": "2026-07-23T11:00:00Z"
  }
}
Test result

Not run yet

The same expression runs against every case. Test data is fixed so that boundary and failure scenarios cannot be skipped.

Explained solution

Show the complete expression
user.active && !user.suspended && action in user.permissions && resource.classification in user.allowedClassifications && (resource.ownerId == user.id || user.roles.exists(role, role == 'admin')) && timestamp(now) < timestamp(session.expiresAt)

Why the solution works

  1. The first four conditions validate account and declared access lists.
  2. Parentheses isolate the owner-or-administrator alternative.
  3. exists() searches the role list for admin.
  4. The final timestamp comparison rejects a session exactly at or after expiry.

What the test cases prove

  • Active owner: expected true (bool).
  • Administrator is not owner: expected true (bool).
  • Permission missing: expected false (bool).
  • Session expired: expected false (bool).

The cases are intentionally different. A solution that passes only the first case has not yet implemented the complete rule.

Common mistake

Do not optimise the expression for the first successful input. A requirement is implemented only when its positive case, negative case, and boundary case all produce the stated result.

Knowledge check

Can you point to the exact part of the solution that makes each false test case fail? If two different failures depend on the same condition, explain why.

Key takeaway

You can independently build and defend a complex authorization rule.

Sources

  • CEL-DEV — official CEL overview.
  • CEL-LANG — official CEL language definition for operators, types, macros, presence, strings, and time values used in this challenge.