JLCEL Course

PC01-L04 · guided challenge

Resource access

Combine role, user status, a public resource, and team membership.

Practical CEL4 test casesDocumented
What will I practise?

You can use parentheses to separate alternative paths to the same permission.

How is it checked?

Your one expression must produce the expected result for all four JSON inputs.

When am I done?

When all tests pass and you can explain every condition in your expression.

Word problem

An active editor or administrator may open a resource when the resource is public or the user belongs to its owner team.

Exact requirements

  1. The user is active.
  2. The role is editor or admin.
  3. The resource is public, or ownerTeam occurs in the user team list.

Required result

Write one CEL expression. It must return the expected value and type for all four prepared JSON inputs. Do not change the inputs to make an incomplete expression pass.

Recommended procedure

  1. Translate each numbered requirement into one small boolean condition.
  2. Run the starter expression and inspect which cases fail.
  3. Add one condition at a time and run the complete suite again.
  4. Mark the challenge complete only when you can explain every operator and every boundary.

Solve the challenge · browser test suite

Write one expression that passes every case

Edit the CEL expression, then run it against all prepared JSON inputs. A solution is complete only when every case passes.

4 test cases

Hint: The final requirement has two alternatives joined by || and enclosed in parentheses.

Tip: press Ctrl/⌘ + Enter to run all tests.
Editor and public resourceNot run yet
Expected: true · bool
Show JSON input
{
  "user": {
    "active": true,
    "role": "editor",
    "teams": []
  },
  "resource": {
    "public": true,
    "ownerTeam": "alpha"
  }
}
Private resource owned by teamNot run yet
Expected: true · bool
Show JSON input
{
  "user": {
    "active": true,
    "role": "admin",
    "teams": [
      "alpha"
    ]
  },
  "resource": {
    "public": false,
    "ownerTeam": "alpha"
  }
}
Private resource owned by another teamNot run yet
Expected: false · bool
Show JSON input
{
  "user": {
    "active": true,
    "role": "editor",
    "teams": [
      "beta"
    ]
  },
  "resource": {
    "public": false,
    "ownerTeam": "alpha"
  }
}
Inactive administratorNot run yet
Expected: false · bool
Show JSON input
{
  "user": {
    "active": false,
    "role": "admin",
    "teams": [
      "alpha"
    ]
  },
  "resource": {
    "public": true,
    "ownerTeam": "alpha"
  }
}
Test result

Not run yet

The same expression runs against every case. Test data is fixed so that boundary and failure scenarios cannot be skipped.

Explained solution

Show the complete expression
user.active && user.role in ['editor', 'admin'] && (resource.public || user.teams.exists(team, team == resource.ownerTeam))

Why the solution works

  1. The account and role checks are always required.
  2. Parentheses group the two alternative resource-access paths.
  3. exists() compares each team name with resource.ownerTeam.
  4. The outer && prevents a public resource from bypassing account and role checks.

What the test cases prove

  • Editor and public resource: expected true (bool).
  • Private resource owned by team: expected true (bool).
  • Private resource owned by another team: expected false (bool).
  • Inactive administrator: expected false (bool).

The cases are intentionally different. A solution that passes only the first case has not yet implemented the complete rule.

Common mistake

Do not optimise the expression for the first successful input. A requirement is implemented only when its positive case, negative case, and boundary case all produce the stated result.

Knowledge check

Can you point to the exact part of the solution that makes each false test case fail? If two different failures depend on the same condition, explain why.

Key takeaway

You can use parentheses to separate alternative paths to the same permission.

Sources

  • CEL-DEV — official CEL overview.
  • CEL-LANG — official CEL language definition for operators, types, macros, presence, strings, and time values used in this challenge.