grpc 1.30.2 → 1.35.0

data/src/core/lib/security/authorization/authorization_engine.h

@@ -0,0 +1,84 @@
+
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_CORE_LIB_SECURITY_AUTHORIZATION_AUTHORIZATION_ENGINE_H
+#define GRPC_CORE_LIB_SECURITY_AUTHORIZATION_AUTHORIZATION_ENGINE_H
+
+#include <grpc/support/port_platform.h>
+
+#include <grpc/support/log.h>
+#include <map>
+#include <memory>
+#include <string>
+#include <vector>
+
+#include "absl/container/flat_hash_set.h"
+#include "envoy/config/rbac/v3/rbac.upb.h"
+#include "google/api/expr/v1alpha1/syntax.upb.h"
+#include "upb/upb.hpp"
+
+#include "src/core/lib/security/authorization/evaluate_args.h"
+#include "src/core/lib/security/authorization/mock_cel/activation.h"
+
+namespace grpc_core {
+
+// AuthorizationEngine makes an AuthorizationDecision to ALLOW or DENY the
+// current action based on the condition fields in provided RBAC policies.
+// The engine may be constructed with one or two policies. If two polcies,
+// the first policy is deny-if-matched and the second is allow-if-matched.
+// The engine returns UNDECIDED decision if it fails to find a match in any
+// policy. This engine ignores the principal and permission fields in RBAC
+// policies. It is the caller's responsibility to provide RBAC policies that
+// are compatible with this engine.
+//
+// Example:
+// AuthorizationEngine*
+// auth_engine = AuthorizationEngine::CreateAuthorizationEngine(rbac_policies);
+// auth_engine->Evaluate(evaluate_args); // returns authorization decision.
+class AuthorizationEngine {
+ public:
+  // rbac_policies must be a vector containing either a single policy of any
+  // kind, or one deny policy and one allow policy, in that order.
+  static std::unique_ptr<AuthorizationEngine> CreateAuthorizationEngine(
+      const std::vector<envoy_config_rbac_v3_RBAC*>& rbac_policies);
+
+  // Users should use the CreateAuthorizationEngine factory function
+  // instead of calling the AuthorizationEngine constructor directly.
+  explicit AuthorizationEngine(
+      const std::vector<envoy_config_rbac_v3_RBAC*>& rbac_policies);
+  // TODO(mywang@google.com): add an Evaluate member function.
+
+ private:
+  enum Action {
+    kAllow,
+    kDeny,
+  };
+
+  std::unique_ptr<mock_cel::Activation> CreateActivation(
+      const EvaluateArgs& args);
+
+  std::map<const std::string, const google_api_expr_v1alpha1_Expr*>
+      deny_if_matched_;
+  std::map<const std::string, const google_api_expr_v1alpha1_Expr*>
+      allow_if_matched_;
+  upb::Arena arena_;
+  absl::flat_hash_set<std::string> envoy_attributes_;
+  absl::flat_hash_set<std::string> header_keys_;
+  std::unique_ptr<mock_cel::CelMap> headers_;
+};
+
+}  // namespace grpc_core
+
+#endif /* GRPC_CORE_LIB_SECURITY_AUTHORIZATION_AUTHORIZATION_ENGINE_H */

data/src/core/lib/security/authorization/evaluate_args.cc

@@ -0,0 +1,148 @@
+//
+//
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#include <grpc/support/port_platform.h>
+
+#include "src/core/lib/security/authorization/evaluate_args.h"
+
+#include "src/core/lib/iomgr/parse_address.h"
+#include "src/core/lib/iomgr/resolve_address.h"
+#include "src/core/lib/iomgr/sockaddr_utils.h"
+#include "src/core/lib/slice/slice_utils.h"
+
+namespace grpc_core {
+
+absl::string_view EvaluateArgs::GetPath() const {
+  absl::string_view path;
+  if (metadata_ != nullptr && metadata_->idx.named.path != nullptr) {
+    grpc_linked_mdelem* elem = metadata_->idx.named.path;
+    const grpc_slice& val = GRPC_MDVALUE(elem->md);
+    path = StringViewFromSlice(val);
+  }
+  return path;
+}
+
+absl::string_view EvaluateArgs::GetHost() const {
+  absl::string_view host;
+  if (metadata_ != nullptr && metadata_->idx.named.host != nullptr) {
+    grpc_linked_mdelem* elem = metadata_->idx.named.host;
+    const grpc_slice& val = GRPC_MDVALUE(elem->md);
+    host = StringViewFromSlice(val);
+  }
+  return host;
+}
+
+absl::string_view EvaluateArgs::GetMethod() const {
+  absl::string_view method;
+  if (metadata_ != nullptr && metadata_->idx.named.method != nullptr) {
+    grpc_linked_mdelem* elem = metadata_->idx.named.method;
+    const grpc_slice& val = GRPC_MDVALUE(elem->md);
+    method = StringViewFromSlice(val);
+  }
+  return method;
+}
+
+std::multimap<absl::string_view, absl::string_view> EvaluateArgs::GetHeaders()
+    const {
+  std::multimap<absl::string_view, absl::string_view> headers;
+  if (metadata_ == nullptr) {
+    return headers;
+  }
+  for (grpc_linked_mdelem* elem = metadata_->list.head; elem != nullptr;
+       elem = elem->next) {
+    const grpc_slice& key = GRPC_MDKEY(elem->md);
+    const grpc_slice& val = GRPC_MDVALUE(elem->md);
+    headers.emplace(StringViewFromSlice(key), StringViewFromSlice(val));
+  }
+  return headers;
+}
+
+absl::string_view EvaluateArgs::GetLocalAddress() const {
+  absl::string_view addr = grpc_endpoint_get_local_address(endpoint_);
+  size_t first_colon = addr.find(":");
+  size_t last_colon = addr.rfind(":");
+  if (first_colon == std::string::npos || last_colon == std::string::npos) {
+    return "";
+  } else {
+    return addr.substr(first_colon + 1, last_colon - first_colon - 1);
+  }
+}
+
+int EvaluateArgs::GetLocalPort() const {
+  if (endpoint_ == nullptr) {
+    return 0;
+  }
+  absl::StatusOr<URI> uri =
+      URI::Parse(grpc_endpoint_get_local_address(endpoint_));
+  grpc_resolved_address resolved_addr;
+  if (!uri.ok() || !grpc_parse_uri(*uri, &resolved_addr)) {
+    return 0;
+  }
+  return grpc_sockaddr_get_port(&resolved_addr);
+}
+
+absl::string_view EvaluateArgs::GetPeerAddress() const {
+  absl::string_view addr = grpc_endpoint_get_peer(endpoint_);
+  size_t first_colon = addr.find(":");
+  size_t last_colon = addr.rfind(":");
+  if (first_colon == std::string::npos || last_colon == std::string::npos) {
+    return "";
+  } else {
+    return addr.substr(first_colon + 1, last_colon - first_colon - 1);
+  }
+}
+
+int EvaluateArgs::GetPeerPort() const {
+  if (endpoint_ == nullptr) {
+    return 0;
+  }
+  absl::StatusOr<URI> uri = URI::Parse(grpc_endpoint_get_peer(endpoint_));
+  grpc_resolved_address resolved_addr;
+  if (!uri.ok() || !grpc_parse_uri(*uri, &resolved_addr)) {
+    return 0;
+  }
+  return grpc_sockaddr_get_port(&resolved_addr);
+}
+
+absl::string_view EvaluateArgs::GetSpiffeId() const {
+  if (auth_context_ == nullptr) {
+    return "";
+  }
+  grpc_auth_property_iterator it = grpc_auth_context_find_properties_by_name(
+      auth_context_, GRPC_PEER_SPIFFE_ID_PROPERTY_NAME);
+  const grpc_auth_property* prop = grpc_auth_property_iterator_next(&it);
+  if (prop == nullptr || grpc_auth_property_iterator_next(&it) != nullptr) {
+    return "";
+  }
+  return absl::string_view(prop->value, prop->value_length);
+}
+
+absl::string_view EvaluateArgs::GetCertServerName() const {
+  if (auth_context_ == nullptr) {
+    return "";
+  }
+  grpc_auth_property_iterator it = grpc_auth_context_find_properties_by_name(
+      auth_context_, GRPC_X509_CN_PROPERTY_NAME);
+  const grpc_auth_property* prop = grpc_auth_property_iterator_next(&it);
+  if (prop == nullptr || grpc_auth_property_iterator_next(&it) != nullptr) {
+    return "";
+  }
+  return absl::string_view(prop->value, prop->value_length);
+}
+
+}  // namespace grpc_core

data/src/core/lib/security/authorization/evaluate_args.h

@@ -0,0 +1,59 @@
+//
+//
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#ifndef GRPC_CORE_LIB_SECURITY_AUTHORIZATION_EVALUATE_ARGS_H
+#define GRPC_CORE_LIB_SECURITY_AUTHORIZATION_EVALUATE_ARGS_H
+
+#include <grpc/support/port_platform.h>
+
+#include <map>
+
+#include "src/core/lib/iomgr/endpoint.h"
+#include "src/core/lib/security/context/security_context.h"
+#include "src/core/lib/transport/metadata_batch.h"
+
+namespace grpc_core {
+
+class EvaluateArgs {
+ public:
+  EvaluateArgs(grpc_metadata_batch* metadata, grpc_auth_context* auth_context,
+               grpc_endpoint* endpoint)
+      : metadata_(metadata), auth_context_(auth_context), endpoint_(endpoint) {}
+
+  absl::string_view GetPath() const;
+  absl::string_view GetHost() const;
+  absl::string_view GetMethod() const;
+  std::multimap<absl::string_view, absl::string_view> GetHeaders() const;
+  absl::string_view GetLocalAddress() const;
+  int GetLocalPort() const;
+  absl::string_view GetPeerAddress() const;
+  int GetPeerPort() const;
+  absl::string_view GetSpiffeId() const;
+  absl::string_view GetCertServerName() const;
+
+  // TODO(unknown): Add a getter function for source.principal
+
+ private:
+  grpc_metadata_batch* metadata_;
+  grpc_auth_context* auth_context_;
+  grpc_endpoint* endpoint_;
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_CORE_LIB_SECURITY_AUTHORIZATION_EVALUATE_ARGS_H

data/src/core/lib/security/authorization/mock_cel/activation.h

@@ -0,0 +1,57 @@
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_CORE_LIB_SECURITY_AUTHORIZATION_MOCK_CEL_ACTIVATION_H
+#define GRPC_CORE_LIB_SECURITY_AUTHORIZATION_MOCK_CEL_ACTIVATION_H
+
+#include <grpc/support/port_platform.h>
+
+#include "absl/strings/string_view.h"
+
+#include "src/core/lib/security/authorization/mock_cel/cel_value.h"
+
+namespace grpc_core {
+namespace mock_cel {
+
+// Base class for an activation. This is a temporary stub implementation of CEL
+// APIs. Once gRPC imports the CEL library, this class will be removed.
+class BaseActivation {
+ public:
+  BaseActivation() = default;
+
+  // Non-copyable/non-assignable
+  BaseActivation(const BaseActivation&) = delete;
+  BaseActivation& operator=(const BaseActivation&) = delete;
+};
+
+// Instance of Activation class is used by evaluator.
+// It provides binding between references used in expressions
+// and actual values. This is a temporary stub implementation of CEL APIs.
+// Once gRPC imports the CEL library, this class will be removed.
+class Activation : public BaseActivation {
+ public:
+  Activation() = default;
+
+  // Non-copyable/non-assignable
+  Activation(const Activation&) = delete;
+  Activation& operator=(const Activation&) = delete;
+
+  // Insert value into Activation.
+  void InsertValue(absl::string_view name, const CelValue& value) {}
+};
+
+}  // namespace mock_cel
+}  // namespace grpc_core
+
+#endif  // GRPC_CORE_LIB_SECURITY_AUTHORIZATION_MOCK_CEL_ACTIVATION_H

data/src/core/lib/security/authorization/mock_cel/cel_expr_builder_factory.h

@@ -0,0 +1,44 @@
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_CORE_LIB_SECURITY_AUTHORIZATION_MOCK_CEL_CEL_EXPR_BUILDER_FACTORY_H
+#define GRPC_CORE_LIB_SECURITY_AUTHORIZATION_MOCK_CEL_CEL_EXPR_BUILDER_FACTORY_H
+
+#include <grpc/support/port_platform.h>
+
+#include <memory>
+
+#include "absl/memory/memory.h"
+
+#include "src/core/lib/security/authorization/mock_cel/flat_expr_builder.h"
+
+namespace grpc_core {
+namespace mock_cel {
+
+// This is a temporary stub implementation of CEL APIs.
+// Once gRPC imports the CEL library, this file will be removed.
+
+struct InterpreterOptions {
+  bool short_circuiting = true;
+};
+
+inline std::unique_ptr<CelExpressionBuilder> CreateCelExpressionBuilder(
+    const InterpreterOptions& options) {
+  return absl::make_unique<FlatExprBuilder>();
+}
+
+}  // namespace mock_cel
+}  // namespace grpc_core
+
+#endif  // GRPC_CORE_LIB_SECURITY_AUTHORIZATION_MOCK_CEL_CEL_EXPR_BUILDER_FACTORY_H

data/src/core/lib/security/authorization/mock_cel/cel_expression.h

@@ -0,0 +1,69 @@
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_CORE_LIB_SECURITY_AUTHORIZATION_MOCK_CEL_CEL_EXPRESSION_H
+#define GRPC_CORE_LIB_SECURITY_AUTHORIZATION_MOCK_CEL_CEL_EXPRESSION_H
+
+#include <grpc/support/port_platform.h>
+
+#include <memory>
+#include <vector>
+
+#include "absl/status/statusor.h"
+
+#include "google/api/expr/v1alpha1/syntax.upb.h"
+#include "src/core/lib/security/authorization/mock_cel/activation.h"
+#include "src/core/lib/security/authorization/mock_cel/cel_value.h"
+
+namespace grpc_core {
+namespace mock_cel {
+
+// This is a temporary stub implementation of CEL APIs.
+// Once gRPC imports the CEL library, this file will be removed.
+
+// Base interface for expression evaluating objects.
+class CelExpression {
+ public:
+  virtual ~CelExpression() = default;
+
+  // Evaluates expression and returns value.
+  // activation contains bindings from parameter names to values
+  virtual absl::StatusOr<CelValue> Evaluate(
+      const BaseActivation& activation) const = 0;
+};
+
+// Base class for Expression Builder implementations
+// Provides user with factory to register extension functions.
+// ExpressionBuilder MUST NOT be destroyed before CelExpression objects
+// it built.
+class CelExpressionBuilder {
+ public:
+  virtual ~CelExpressionBuilder() = default;
+
+  // Creates CelExpression object from AST tree.
+  // expr specifies root of AST tree
+  virtual absl::StatusOr<std::unique_ptr<CelExpression>> CreateExpression(
+      const google_api_expr_v1alpha1_Expr* expr,
+      const google_api_expr_v1alpha1_SourceInfo* source_info) const = 0;
+
+  virtual absl::StatusOr<std::unique_ptr<CelExpression>> CreateExpression(
+      const google_api_expr_v1alpha1_Expr* expr,
+      const google_api_expr_v1alpha1_SourceInfo* source_info,
+      std::vector<absl::Status>* warnings) const = 0;
+};
+
+}  // namespace mock_cel
+}  // namespace grpc_core
+
+#endif  // GRPC_CORE_LIB_SECURITY_AUTHORIZATION_MOCK_CEL_CEL_EXPRESSION_H

data/src/core/lib/security/authorization/mock_cel/cel_value.h

@@ -0,0 +1,97 @@
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_CORE_LIB_SECURITY_AUTHORIZATION_MOCK_CEL_CEL_VALUE_H
+#define GRPC_CORE_LIB_SECURITY_AUTHORIZATION_MOCK_CEL_CEL_VALUE_H
+
+// CelValue is a holder, capable of storing all kinds of data
+// supported by CEL.
+// CelValue defines explicitly typed/named getters/setters.
+// When storing pointers to objects, CelValue does not accept ownership
+// to them and does not control their lifecycle. Instead objects are expected
+// to be either external to expression evaluation, and controlled beyond the
+// scope or to be allocated and associated with some allocation/ownership
+// controller (Arena).
+// Usage examples:
+// (a) For primitive types:
+//    CelValue value = CelValue::CreateInt64(1);
+// (b) For string:
+//    std::string* msg("test");
+//    CelValue value = CelValue::CreateString(msg);
+
+#include <grpc/support/port_platform.h>
+
+#include <memory>
+
+#include "absl/memory/memory.h"
+#include "absl/strings/string_view.h"
+#include "absl/types/span.h"
+
+namespace grpc_core {
+namespace mock_cel {
+
+// Break cyclic depdendencies for container types.
+class CelMap {
+ public:
+  CelMap() = default;
+};
+
+// This is a temporary stub implementation of CEL APIs.
+// Once gRPC imports the CEL library, this class will be removed.
+class CelValue {
+ public:
+  // Default constructor.
+  // Creates CelValue with null data type.
+  CelValue() : CelValue(nullptr) {}
+
+  // We will use factory methods instead of public constructors
+  // The reason for this is the high risk of implicit type conversions
+  // between bool/int/pointer types.
+  // We rely on copy elision to avoid extra copying.
+  static CelValue CreateNull() { return CelValue(nullptr); }
+
+  static CelValue CreateInt64(int64_t value) { return CreateNull(); }
+
+  static CelValue CreateUint64(uint64_t value) { return CreateNull(); }
+
+  static CelValue CreateStringView(absl::string_view value) {
+    return CreateNull();
+  }
+
+  static CelValue CreateString(const std::string* str) { return CreateNull(); }
+
+  static CelValue CreateMap(const CelMap* value) { return CreateNull(); }
+
+ private:
+  // Constructs CelValue wrapping value supplied as argument.
+  // Value type T should be supported by specification of ValueHolder.
+  template <class T>
+  explicit CelValue(T value) {}
+};
+
+// CelMap implementation that uses STL map container as backing storage.
+class ContainerBackedMapImpl : public CelMap {
+ public:
+  ContainerBackedMapImpl() = default;
+
+  static std::unique_ptr<CelMap> Create(
+      absl::Span<std::pair<CelValue, CelValue>> key_values) {
+    return absl::make_unique<ContainerBackedMapImpl>();
+  }
+};
+
+}  // namespace mock_cel
+}  // namespace grpc_core
+
+#endif  // GRPC_CORE_LIB_SECURITY_AUTHORIZATION_MOCK_CEL_CEL_VALUE_H

data/src/core/lib/security/authorization/mock_cel/evaluator_core.h

@@ -0,0 +1,67 @@
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_CORE_LIB_SECURITY_AUTHORIZATION_MOCK_CEL_EVALUATOR_CORE_H
+#define GRPC_CORE_LIB_SECURITY_AUTHORIZATION_MOCK_CEL_EVALUATOR_CORE_H
+
+#include <grpc/support/port_platform.h>
+
+#include <memory>
+#include <set>
+#include <vector>
+
+#include "absl/status/statusor.h"
+
+#include "google/api/expr/v1alpha1/syntax.upb.h"
+#include "src/core/lib/security/authorization/mock_cel/activation.h"
+#include "src/core/lib/security/authorization/mock_cel/cel_expression.h"
+#include "src/core/lib/security/authorization/mock_cel/cel_value.h"
+
+namespace grpc_core {
+namespace mock_cel {
+
+// This is a temporary stub implementation of CEL APIs.
+// Once gRPC imports the CEL library, this file will be removed.
+
+class ExecutionPath {
+ public:
+  ExecutionPath() = default;
+};
+
+// Implementation of the CelExpression that utilizes flattening
+// of the expression tree.
+class CelExpressionFlatImpl : public CelExpression {
+  // Constructs CelExpressionFlatImpl instance.
+  // path is flat execution path that is based upon
+  // flattened AST tree. Max iterations dictates the maximum number of
+  // iterations in the comprehension expressions (use 0 to disable the upper
+  // bound).
+ public:
+  CelExpressionFlatImpl(const google_api_expr_v1alpha1_Expr* root_expr,
+                        ExecutionPath path, int max_iterations,
+                        std::set<std::string> iter_variable_names,
+                        bool enable_unknowns = false,
+                        bool enable_unknown_function_results = false) {}
+
+  // Implementation of CelExpression evaluate method.
+  absl::StatusOr<CelValue> Evaluate(
+      const BaseActivation& activation) const override {
+    return CelValue::CreateNull();
+  }
+};
+
+}  // namespace mock_cel
+}  // namespace grpc_core
+
+#endif  // GRPC_CORE_LIB_SECURITY_AUTHORIZATION_MOCK_CEL_EVALUATOR_CORE_H

data/src/core/lib/security/authorization/mock_cel/flat_expr_builder.h

@@ -0,0 +1,57 @@
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_CORE_LIB_SECURITY_AUTHORIZATION_MOCK_CEL_FLAT_EXPR_BUILDER_H
+#define GRPC_CORE_LIB_SECURITY_AUTHORIZATION_MOCK_CEL_FLAT_EXPR_BUILDER_H
+
+#include <grpc/support/port_platform.h>
+
+#include <memory>
+
+#include "src/core/lib/security/authorization/mock_cel/evaluator_core.h"
+
+namespace grpc_core {
+namespace mock_cel {
+
+// This is a temporary stub implementation of CEL APIs.
+// Once gRPC imports the CEL library, this file will be removed.
+
+// CelExpressionBuilder implementation.
+// Builds instances of CelExpressionFlatImpl.
+class FlatExprBuilder : public CelExpressionBuilder {
+ public:
+  FlatExprBuilder() = default;
+
+  absl::StatusOr<std::unique_ptr<CelExpression>> CreateExpression(
+      const google_api_expr_v1alpha1_Expr* expr,
+      const google_api_expr_v1alpha1_SourceInfo* source_info) const override {
+    ExecutionPath path;
+    return absl::make_unique<CelExpressionFlatImpl>(nullptr, path, 0,
+                                                    std::set<std::string>{});
+  }
+
+  absl::StatusOr<std::unique_ptr<CelExpression>> CreateExpression(
+      const google_api_expr_v1alpha1_Expr* expr,
+      const google_api_expr_v1alpha1_SourceInfo* source_info,
+      std::vector<absl::Status>* warnings) const override {
+    ExecutionPath path;
+    return absl::make_unique<CelExpressionFlatImpl>(nullptr, path, 0,
+                                                    std::set<std::string>{});
+  }
+};
+
+}  // namespace mock_cel
+}  // namespace grpc_core
+
+#endif  // GRPC_CORE_LIB_SECURITY_AUTHORIZATION_MOCK_CEL_FLAT_EXPR_BUILDER_H