Found while verifying PR #415's review (thread on grm_routing_rule.py:174). Four sites validate expressions the product presents as CEL using Python's own parser:
spp_programs/models/cel/entitlement_inkind_cel.py:182 — ast.parse(expression, mode="eval")spp_programs/models/cel/entitlement_inkind_cel.py:328 — compile(..., "eval")spp_programs/wizard/create_program_wizard_cel.py:713 and :908 — compile(..., "eval")
Consequence: the wizard's "Formula syntax is valid" accepts input the actual CEL parser (spp_cel_domain.services.cel_parser) rejects, and rejects valid CEL that isn't valid Python. Validation and evaluation disagree about the language.
Fix direction: a shared validate(expr) helper in spp_cel_domain.services.cel_parser that owns the parse call and its exception set, used by every CEL-accepting surface; keep Python-grammar validation only where the runtime genuinely evaluates Python (the restricted-AST evaluator) and label those fields accordingly.
Found while verifying PR #415's review (thread on
grm_routing_rule.py:174). Four sites validate expressions the product presents as CEL using Python's own parser:spp_programs/models/cel/entitlement_inkind_cel.py:182—ast.parse(expression, mode="eval")spp_programs/models/cel/entitlement_inkind_cel.py:328—compile(..., "eval")spp_programs/wizard/create_program_wizard_cel.py:713and:908—compile(..., "eval")Consequence: the wizard's "Formula syntax is valid" accepts input the actual CEL parser (
spp_cel_domain.services.cel_parser) rejects, and rejects valid CEL that isn't valid Python. Validation and evaluation disagree about the language.Fix direction: a shared
validate(expr)helper inspp_cel_domain.services.cel_parserthat owns the parse call and its exception set, used by every CEL-accepting surface; keep Python-grammar validation only where the runtime genuinely evaluates Python (the restricted-AST evaluator) and label those fields accordingly.