---
policy: /ce/ca/google/iam/access-approval-settings
logic: /ce/ca/google/iam/access-approval-settings/prod.logic.yaml
executionTime: 2025-04-24T23:46:59.695002568Z
rows:
  - id: a4p1
    match: true
    status:
      expected: INCOMPLIANT
      actual: INCOMPLIANT
    conditionIndex:
      expected: 200
      actual: 200
    conditionText:
      expected: otherwise
      actual: otherwise
    runtimeError: {}
  - id: a4p12
    match: true
    status:
      expected: COMPLIANT
      actual: COMPLIANT
    conditionIndex:
      expected: 199
      actual: 199
    conditionText:
      expected: CA10__Google_Resource_Manager_Projects__r.has(COMPLIANT)
      actual: CA10__Google_Resource_Manager_Projects__r.has(COMPLIANT)
    runtimeError: {}
usedFiles:
  - path: /ce/ca/google/iam/access-approval-settings/policy.yaml
    md5Hash: 8F3A8AE0DCD5B73C4EE084C0EDE0D5E9
    content: "---\nnames: \n  full: \"Google Access Approval is not enabled\"\n  contextual:\
      \ \"Access Approval is not enabled\"\ndescription: \"GCP Access Approval enables\
      \ you to require your organizations' explicit approval \\\n whenever Google\
      \ support try to access your projects. You can then select users within your\
      \ \\\n organization who can approve these requests through giving them a security\
      \ role in IAM. \\\n All access requests display which Google Employee requested\
      \ them in an email or Pub/Sub message \\\n that you can choose to Approve. This\
      \ adds an additional control and logging of who in your \\ \n organization approved/denied\
      \ these requests. \"\ntype: COMPLIANCE_POLICY\ncategories:\n  - \"SECURITY\"\
      \nframeworkMappings:\n  - /frameworks/cis-gcp-v3.0.0/02/15\n  - /frameworks/cloudaware/resource-security/secure-access\n\
      similarPolicies:\n  cloudConformity:\n    - url: \"https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/gcp/CloudIAM/enable-access-approval.html\"\
      \n      name: \"Enable Access Approval\"\n"
  - path: /ce/ca/google/iam/access-approval-settings/prod.logic.yaml
    md5Hash: D895DC7CB9EE677DB05A290669286E86
    content: "---\ninputType: \"CA10__CaGoogleProject__c\"\ntestData:\n  - file: test-data.json\n\
      importExtracts:\n  - file: /types/CA10__CaGoogleProject__c/object.extracts.yaml\n\
      conditions:\n  - status: \"COMPLIANT\"\n    currentStateMessage: \"Access Approval\
      \ is enabled.\"\n    check:\n      RELATED_LIST_HAS:\n        status: \"COMPLIANT\"\
      \n        relationshipName: \"CA10__Google_Resource_Manager_Projects__r\"\n\
      otherwise:\n  status: \"INCOMPLIANT\"\n  currentStateMessage: \"Access Approval\
      \ is not enabled.\"\n  remediationMessage: \"Consider enabling Access Approval.\"\
      \nrelatedLists:\n  - relationshipName: \"CA10__Google_Resource_Manager_Projects__r\"\
      \n    importExtracts:\n      - file: /types/CA10__CaGoogleResourceManagerProject__c/object.extracts.yaml\n\
      \      - file: /types/CA10__CaGoogleResourceManagerFolder__c/object.extracts.yaml\n\
      \      - file: /types/CA10__CaGoogleResourceManagerOrganization__c/object.extracts.yaml\n\
      \    conditions: \n      - status: \"COMPLIANT\"\n        currentStateMessage:\
      \ \"Resource Manager Project with Access Approval enabled.\"\n        check:\n\
      \          OR:\n            args:\n              - NOT_EMPTY:\n            \
      \      arg:\n                    EXTRACT: \"CA10__resourceManagerFolder__r.caJsonFrom__accessApprovalStatus__c\"\
      \n              - NOT_EMPTY:\n                  arg:\n                    EXTRACT:\
      \ \"CA10__resourceManagerOrganization__r.caJsonFrom__accessApprovalStatus__c\"\
      \n              - NOT_EMPTY:\n                  arg:\n                    EXTRACT:\
      \ \"caJsonFrom__accessApprovalStatus__c\"\n    otherwise:\n      status: \"\
      INCOMPLIANT\"\n      currentStateMessage: \"Resource Manager Project without\
      \ Access Approval.\"\n"
  - path: /types/CA10__CaGoogleResourceManagerProject__c/object.extracts.yaml
    md5Hash: 567BE31DE8B132C61377E41DA9808A0D
    content: "---\nextracts:\n  - name: \"CA10__accessApprovalStatus__c\"\n    value:\
      \ \n       FIELD:\n         path: \"CA10__accessApprovalStatus__c\"\n  - name:\
      \ \"caJsonFrom__accessApprovalStatus__c\"\n    value:\n      JSON_FROM:\n  \
      \      arg:\n          EXTRACT: \"CA10__accessApprovalStatus__c\"\n        undeterminedIf:\n\
      \          isInvalid: \"JSON is invalid\""
  - path: /types/CA10__CaGoogleResourceManagerFolder__c/object.extracts.yaml
    md5Hash: 567BE31DE8B132C61377E41DA9808A0D
    content: "---\nextracts:\n  - name: \"CA10__accessApprovalStatus__c\"\n    value:\
      \ \n       FIELD:\n         path: \"CA10__accessApprovalStatus__c\"\n  - name:\
      \ \"caJsonFrom__accessApprovalStatus__c\"\n    value:\n      JSON_FROM:\n  \
      \      arg:\n          EXTRACT: \"CA10__accessApprovalStatus__c\"\n        undeterminedIf:\n\
      \          isInvalid: \"JSON is invalid\""
  - path: /ce/ca/google/iam/access-approval-settings/test-data.json
    md5Hash: 5857EE501AA94E841BAA431457C3A8F2
    content: |
      [
        {
          "expectedResult": {
            "status": "INCOMPLIANT",
            "conditionIndex": "200",
            "conditionText": "otherwise",
            "runtimeError": null
          },
          "context": { "snapshotTime": "2024-09-24T02:03:19Z" },
          "Id": "a4p1",
          "CA10__Google_Resource_Manager_Projects__r": [
            {
              "Id": "aA5D1",
              "CA10__disappearanceTime__c": null,
              "CA10__resourceManagerFolder__c": "aA3V1",
              "CA10__resourceManagerFolderId__c": "folders/1251",
              "CA10__resourceManagerOrganization__c": "aA4D1",
              "CA10__resourceManagerOrganizationId__c": "organizations/3051",
              "CA10__accessApprovalStatus__c": "",
              "CA10__googleProject__c": "a4p1",
              "CA10__resourceManagerFolder__r": {
                "Id": "aA3V1",
                "CA10__disappearanceTime__c": null,
                "CA10__accessApprovalStatus__c": ""
              },
              "CA10__resourceManagerOrganization__r": {
                "Id": "aA4D1",
                "CA10__disappearanceTime__c": null,
                "CA10__accessApprovalStatus__c": ""
              }
            }
          ]
        },
        {
          "expectedResult": {
            "status": "COMPLIANT",
            "conditionIndex": "199",
            "conditionText": "CA10__Google_Resource_Manager_Projects__r.has(COMPLIANT)",
            "runtimeError": null
          },
          "context": { "snapshotTime": "2024-09-24T02:03:19Z" },
          "Id": "a4p12",
          "CA10__Google_Resource_Manager_Projects__r": [
            {
              "Id": "aA5D2",
              "CA10__disappearanceTime__c": null,
              "CA10__resourceManagerFolder__c": "aA3V12",
              "CA10__resourceManagerFolderId__c": "folders/12512",
              "CA10__resourceManagerOrganization__c": "aA4D12",
              "CA10__resourceManagerOrganizationId__c": "organizations/30512",
              "CA10__accessApprovalStatus__c": "",
              "CA10__googleProject__c": "a4p12",
              "CA10__resourceManagerFolder__r": {
                "Id": "aA3V12",
                "CA10__disappearanceTime__c": null,
                "CA10__accessApprovalStatus__c": ""
              },
              "CA10__resourceManagerOrganization__r": {
                "Id": "aA4D12",
                "CA10__disappearanceTime__c": null,
                "CA10__accessApprovalStatus__c": "[{\"languageTag\":\"en-US\",\"accessApproval\":[\"Enabled\"]}]"
              }
            }
          ]
        }
      ]
  - path: /types/CA10__CaGoogleResourceManagerOrganization__c/object.extracts.yaml
    md5Hash: 2D2C19059D3B64302B00AFEC051B96ED
    content: "---\nextracts:\n  - name: \"CA10__essentialContactsConfiguration__c\"\
      \n    value: \n       FIELD:\n         path: \"CA10__essentialContactsConfiguration__c\"\
      \n         returnType: BYTES\n  - name: \"caJsonFrom__essentialContactsConfiguration__c\"\
      \n    value: \n      JSON_FROM:\n        arg:\n          EXTRACT: \"CA10__essentialContactsConfiguration__c\"\
      \n        undeterminedIf:\n          isInvalid: \"JSON is invalid\"\n  - name:\
      \ \"caJsonFrom__essentialContactsConfiguration__notificationCategory_withEmail\"\
      \n    value: \n      JSON_QUERY_TEXT:\n        arg:\n          EXTRACT: \"caJsonFrom__essentialContactsConfiguration__c\"\
      \n        expression: \"to_string([?email != null].notificationCategorySubscriptions)\"\
      \n        undeterminedIf:\n          evaluationError: \"The JSON query failed.\"\
      \n          resultTypeMismatch: \"The JSON query did not return a text.\"\n\
      \          resultIsEmpty: \"The JSON query did not return a value.\"\n  - name:\
      \ \"CA10__accessApprovalStatus__c\"\n    value: \n       FIELD:\n         path:\
      \ \"CA10__accessApprovalStatus__c\"\n  - name: \"caJsonFrom__accessApprovalStatus__c\"\
      \n    value:\n      JSON_FROM:\n        arg:\n          EXTRACT: \"CA10__accessApprovalStatus__c\"\
      \n        undeterminedIf:\n          isInvalid: \"JSON is invalid\""
  - path: /types/CA10__CaGoogleProject__c/object.extracts.yaml
    md5Hash: 8EB422663BF4493D44ABA5FEC0FB9AD4
    content: "---\nextracts:\n  - name: \"CA10__projectId__c\"\n    value: \n    \
      \   FIELD:\n         path: \"CA10__projectId__c\"\n         undeterminedIf:\n\
      \          isEmpty: \"Corrupted data. Project ID cannot be empty.\"\n  - name:\
      \ \"CA10__enabledServices__c\"\n    value: \n      FIELD:\n        path: \"\
      CA10__enabledServices__c\""
script: |-
  CREATE TEMP FUNCTION mock_ExpectedResult()
  RETURNS ARRAY<STRUCT<
          Id STRING,
          expectedResult STRUCT<status STRING, conditionIndex DECIMAL, conditionText STRING, runtimeError STRING>
      >>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
    return [ {
    "Id" : "a4p1",
    "expectedResult" : {
      "status" : "INCOMPLIANT",
      "conditionIndex" : "200",
      "conditionText" : "otherwise",
      "runtimeError" : null
    }
  }, {
    "Id" : "a4p12",
    "expectedResult" : {
      "status" : "COMPLIANT",
      "conditionIndex" : "199",
      "conditionText" : "CA10__Google_Resource_Manager_Projects__r.has(COMPLIANT)",
      "runtimeError" : null
    }
  } ];
  """;

  CREATE TEMP FUNCTION mock_CA10__CaGoogleProject__c()
  RETURNS ARRAY<STRUCT<
      Id STRING,
      context STRUCT<
          snapshotTime TIMESTAMP
      >
  >>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
    return [ {
    "context" : {
      "snapshotTime" : new Date("2024-09-24T02:03:19Z")
    },
    "Id" : "a4p1"
  }, {
    "context" : {
      "snapshotTime" : new Date("2024-09-24T02:03:19Z")
    },
    "Id" : "a4p12"
  } ];
  """;

  CREATE TEMP FUNCTION mock_CA10__CaGoogleResourceManagerProject__c()
  RETURNS ARRAY<STRUCT<
      Id STRING,
      CA10__disappearanceTime__c TIMESTAMP,
      CA10__resourceManagerFolder__c STRING,
      CA10__resourceManagerFolderId__c STRING,
      CA10__resourceManagerOrganization__c STRING,
      CA10__resourceManagerOrganizationId__c STRING,
      CA10__accessApprovalStatus__c STRING,
      CA10__googleProject__c STRING,
      context STRUCT<
          snapshotTime TIMESTAMP
      >
  >>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
    return [ {
    "context" : {
      "snapshotTime" : new Date("2024-09-24T02:03:19Z")
    },
    "Id" : "aA5D1",
    "CA10__resourceManagerFolder__c" : "aA3V1",
    "CA10__resourceManagerFolderId__c" : "folders/1251",
    "CA10__resourceManagerOrganization__c" : "aA4D1",
    "CA10__resourceManagerOrganizationId__c" : "organizations/3051",
    "CA10__accessApprovalStatus__c" : "",
    "CA10__googleProject__c" : "a4p1"
  }, {
    "context" : {
      "snapshotTime" : new Date("2024-09-24T02:03:19Z")
    },
    "Id" : "aA5D2",
    "CA10__resourceManagerFolder__c" : "aA3V12",
    "CA10__resourceManagerFolderId__c" : "folders/12512",
    "CA10__resourceManagerOrganization__c" : "aA4D12",
    "CA10__resourceManagerOrganizationId__c" : "organizations/30512",
    "CA10__accessApprovalStatus__c" : "",
    "CA10__googleProject__c" : "a4p12"
  } ];
  """;

  CREATE TEMP FUNCTION mock_CA10__CaGoogleResourceManagerFolder__c()
  RETURNS ARRAY<STRUCT<
      Id STRING,
      CA10__disappearanceTime__c TIMESTAMP,
      CA10__accessApprovalStatus__c STRING,
      context STRUCT<
          snapshotTime TIMESTAMP
      >
  >>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
    return [ {
    "context" : {
      "snapshotTime" : new Date("2024-09-24T02:03:19Z")
    },
    "Id" : "aA3V1",
    "CA10__accessApprovalStatus__c" : ""
  }, {
    "context" : {
      "snapshotTime" : new Date("2024-09-24T02:03:19Z")
    },
    "Id" : "aA3V12",
    "CA10__accessApprovalStatus__c" : ""
  } ];
  """;

  CREATE TEMP FUNCTION mock_CA10__CaGoogleResourceManagerOrganization__c()
  RETURNS ARRAY<STRUCT<
      Id STRING,
      CA10__disappearanceTime__c TIMESTAMP,
      CA10__accessApprovalStatus__c STRING,
      context STRUCT<
          snapshotTime TIMESTAMP
      >
  >>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
    return [ {
    "context" : {
      "snapshotTime" : new Date("2024-09-24T02:03:19Z")
    },
    "Id" : "aA4D1",
    "CA10__accessApprovalStatus__c" : ""
  }, {
    "context" : {
      "snapshotTime" : new Date("2024-09-24T02:03:19Z")
    },
    "Id" : "aA4D12",
    "CA10__accessApprovalStatus__c" : "[{\"languageTag\":\"en-US\",\"accessApproval\":[\"Enabled\"]}]"
  } ];
  """;

  CREATE TEMP FUNCTION process_CA10__CaGoogleProject__c(
      obj STRUCT<
          Id STRING,
          CA10__Google_Resource_Manager_Projects__r ARRAY<STRUCT<
              Id STRING,
              CA10__disappearanceTime__c TIMESTAMP,
              CA10__resourceManagerFolder__c STRING,
              CA10__resourceManagerFolderId__c STRING,
              CA10__resourceManagerOrganization__c STRING,
              CA10__resourceManagerOrganizationId__c STRING,
              CA10__accessApprovalStatus__c STRING,
              CA10__googleProject__c STRING,
              CA10__resourceManagerFolder__r STRUCT<
                  Id STRING,
                  CA10__disappearanceTime__c TIMESTAMP,
                  CA10__accessApprovalStatus__c STRING
              >,
              CA10__resourceManagerOrganization__r STRUCT<
                  Id STRING,
                  CA10__disappearanceTime__c TIMESTAMP,
                  CA10__accessApprovalStatus__c STRING
              >,
              result STRUCT<status STRING, conditionIndex DECIMAL, conditionText STRING, currentStateMessage STRING, currentStateReferences STRING, remediation STRING, runtimeError STRING>
          >>
      >,
      snapshotTime TIMESTAMP
  )
  RETURNS STRUCT<status STRING, conditionIndex DECIMAL, conditionText STRING, currentStateMessage STRING, currentStateReferences STRING, remediation STRING, runtimeError STRING>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
      var references1 = [];
      // condition[0], conditionIndex:[0..99]
      if (false) {
          return {status: 'DISAPPEARED', conditionIndex: 99, conditionText: "isDisappeared()", currentStateMessage: "Object is deleted in the source", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
      }
      var count_CA10__Google_Resource_Manager_Projects__r_COMPLIANT2 = 0;
      if (obj.CA10__Google_Resource_Manager_Projects__r != null) {
          for (var i3 = 0; i3 < obj.CA10__Google_Resource_Manager_Projects__r.length; i3++) {
              if (obj.CA10__Google_Resource_Manager_Projects__r[i3].result.status == 'COMPLIANT') {
                  count_CA10__Google_Resource_Manager_Projects__r_COMPLIANT2 += 1;
              }
          }
      }
      // condition[1], conditionIndex:[100..199]
      references1.push('Related list [CA10__Google_Resource_Manager_Projects__r] ' + (count_CA10__Google_Resource_Manager_Projects__r_COMPLIANT2 > 0 ? 'has' : 'does not have') + ' objects in COMPLIANT status');
      if (count_CA10__Google_Resource_Manager_Projects__r_COMPLIANT2 > 0) {
          return {status: 'COMPLIANT', conditionIndex: 199, conditionText: "CA10__Google_Resource_Manager_Projects__r.has(COMPLIANT)", currentStateMessage: "Access Approval is enabled.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
      }
      return {status: 'INCOMPLIANT', conditionIndex: 200, conditionText: "otherwise", currentStateMessage: "Access Approval is not enabled.", currentStateReferences: references1.join('\n'), remediation: "Consider enabling Access Approval.", runtimeError: null};
  """;

  CREATE TEMP FUNCTION process_CA10__Google_Resource_Manager_Projects__r(
      obj STRUCT<
          Id STRING,
          CA10__disappearanceTime__c TIMESTAMP,
          CA10__resourceManagerFolder__c STRING,
          CA10__resourceManagerFolderId__c STRING,
          CA10__resourceManagerOrganization__c STRING,
          CA10__resourceManagerOrganizationId__c STRING,
          CA10__accessApprovalStatus__c STRING,
          CA10__googleProject__c STRING,
          CA10__resourceManagerFolder__r STRUCT<
              Id STRING,
              CA10__disappearanceTime__c TIMESTAMP,
              CA10__accessApprovalStatus__c STRING
          >,
          CA10__resourceManagerOrganization__r STRUCT<
              Id STRING,
              CA10__disappearanceTime__c TIMESTAMP,
              CA10__accessApprovalStatus__c STRING
          >
      >,
      snapshotTime TIMESTAMP
  )
  RETURNS STRUCT<status STRING, conditionIndex DECIMAL, conditionText STRING, currentStateMessage STRING, currentStateReferences STRING, remediation STRING, runtimeError STRING>
  DETERMINISTIC
  LANGUAGE js
  AS r"""
      var TextLib = new function () {
          this.normalize = function(arg) {
              return arg == null ? '' : arg.replace(/\s+/g, ' ').trim().toLowerCase();
          };
          this.isEmpty = function(arg) {
              return this.normalize(arg) == '';
          };
          this.isNotEmpty = function(arg) {
              return this.normalize(arg) != '';
          };
          this.equal = function(left, right) {
              return this.normalize(left) == this.normalize(right);
          };
          this.notEqual = function(left, right) {
              return this.normalize(left) != this.normalize(right);
          };
          this.startsWith = function(arg, substring) {
              return this.normalize(arg).startsWith(this.normalize(substring));
          };
          this.endsWith = function(arg, substring) {
              return this.normalize(arg).endsWith(this.normalize(substring));
          };
          this.contains = function(arg, substring) {
              return this.normalize(arg).includes(this.normalize(substring));
          };
      }();
      var JsonLib = new function () {
          this.isEmpty = function(arg) {
              return this.equal(arg, {});
          };
          this.isNotEmpty = function(arg) {
              return this.notEqual(arg, {});
          };
          this.equal = function jsonEqual(left, right) {
              function removeNullProperties(obj) {
                if (obj === null || typeof obj !== 'object') {
                  return obj;
                }
                if (Array.isArray(obj)) {
                  return obj.map(removeNullProperties);
                }
                const newObj = {};
                for (const key in obj) {
                  if (obj[key] !== null) {
                    newObj[key] = removeNullProperties(obj[key]);
                  }
                }
                return newObj;
              }
              const replacer = (key, value) => {
                  if (value && typeof value === 'object' && !Array.isArray(value)) {
                      return Object.keys(value).sort().reduce((sorted, k) => {
                          sorted[k] = value[k];
                          return sorted;
                      }, {});
                  }
                  return value;
              };
              return JSON.stringify(removeNullProperties(left == null ? {} : left), replacer) === JSON.stringify(removeNullProperties(right == null ? {} : right), replacer);
          }
          this.notEqual = function(left, right) {
              return !this.equal(left, right);
          };
      }();
      var references1 = [];
      // condition[0], conditionIndex:[0..99]
      references1.push('Deleted From Google [CA10__disappearanceTime__c]: ' + obj.CA10__disappearanceTime__c);
      if (obj.CA10__disappearanceTime__c != null) {
          return {status: 'DISAPPEARED', conditionIndex: 99, conditionText: "isDisappeared(CA10__disappearanceTime__c)", currentStateMessage: "Object is deleted in the source", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
      }
      // condition[1], conditionIndex:[100..199]
      function extractChecked2() {
          if (TextLib.isEmpty(obj.CA10__resourceManagerFolderId__c)) {
              throw new Error("UNDETERMINED condition:101", {cause: {status: 'UNDETERMINED', conditionIndex: 101, conditionText: "extractCheck(obj.CA10__resourceManagerFolderId__c)", currentStateMessage: "Related object via CA10__resourceManagerFolderId__c has empty ID", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}});
          }
          if (TextLib.isEmpty(obj.CA10__resourceManagerFolder__c)) {
              throw new Error("UNDETERMINED condition:102", {cause: {status: 'UNDETERMINED', conditionIndex: 102, conditionText: "extractCheck(obj.CA10__resourceManagerFolder__c)", currentStateMessage: "Related object via CA10__resourceManagerFolder__c is not present", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}});
          }
          if (obj.CA10__resourceManagerFolder__r.CA10__disappearanceTime__c != null) {
              throw new Error("UNDETERMINED condition:103", {cause: {status: 'UNDETERMINED', conditionIndex: 103, conditionText: "extractCheck(obj.CA10__resourceManagerFolder__r.CA10__disappearanceTime__c)", currentStateMessage: "Related object via CA10__resourceManagerFolder__c is present, but deleted in the source", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}});
          }
          return extract3.call(extract3);
      }
      function jsonChecked4() {
          var input = extract6.call(extract6);
          input = TextLib.isEmpty(input) ? null : input;
          var out;
          try {
              out = JSON.parse(input);
          } catch (e) {
              throw new Error("UNDETERMINED condition:104", {cause: {status: 'UNDETERMINED', conditionIndex: 104, conditionText: "extract('CA10__accessApprovalStatus__c').asJson().isInvalid()", currentStateMessage: "JSON is invalid", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: e.message}});
          }
          return out;
      }
      function extract6() { if (!this.out) { this.out = obj.CA10__resourceManagerFolder__r.CA10__accessApprovalStatus__c; } return this.out; };
      function extract3() { if (!this.out) { this.out = jsonChecked4(); } return this.out; };
      function extractChecked8() {
          if (TextLib.isEmpty(obj.CA10__resourceManagerOrganizationId__c)) {
              throw new Error("UNDETERMINED condition:105", {cause: {status: 'UNDETERMINED', conditionIndex: 105, conditionText: "extractCheck(obj.CA10__resourceManagerOrganizationId__c)", currentStateMessage: "Related object via CA10__resourceManagerOrganizationId__c has empty ID", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}});
          }
          if (TextLib.isEmpty(obj.CA10__resourceManagerOrganization__c)) {
              throw new Error("UNDETERMINED condition:106", {cause: {status: 'UNDETERMINED', conditionIndex: 106, conditionText: "extractCheck(obj.CA10__resourceManagerOrganization__c)", currentStateMessage: "Related object via CA10__resourceManagerOrganization__c is not present", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}});
          }
          if (obj.CA10__resourceManagerOrganization__r.CA10__disappearanceTime__c != null) {
              throw new Error("UNDETERMINED condition:107", {cause: {status: 'UNDETERMINED', conditionIndex: 107, conditionText: "extractCheck(obj.CA10__resourceManagerOrganization__r.CA10__disappearanceTime__c)", currentStateMessage: "Related object via CA10__resourceManagerOrganization__c is present, but deleted in the source", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null}});
          }
          return extract9.call(extract9);
      }
      function jsonChecked10() {
          var input = extract12.call(extract12);
          input = TextLib.isEmpty(input) ? null : input;
          var out;
          try {
              out = JSON.parse(input);
          } catch (e) {
              throw new Error("UNDETERMINED condition:108", {cause: {status: 'UNDETERMINED', conditionIndex: 108, conditionText: "extract('CA10__accessApprovalStatus__c').asJson().isInvalid()", currentStateMessage: "JSON is invalid", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: e.message}});
          }
          return out;
      }
      function extract12() { if (!this.out) { this.out = obj.CA10__resourceManagerOrganization__r.CA10__accessApprovalStatus__c; } return this.out; };
      function extract9() { if (!this.out) { this.out = jsonChecked10(); } return this.out; };
      function jsonChecked16() {
          var input = extract18.call(extract18);
          input = TextLib.isEmpty(input) ? null : input;
          var out;
          try {
              out = JSON.parse(input);
          } catch (e) {
              throw new Error("UNDETERMINED condition:109", {cause: {status: 'UNDETERMINED', conditionIndex: 109, conditionText: "extract('CA10__accessApprovalStatus__c').asJson().isInvalid()", currentStateMessage: "JSON is invalid", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: e.message}});
          }
          return out;
      }
      function extract18() { if (!this.out) { this.out = obj.CA10__accessApprovalStatus__c; } return this.out; };
      function extract15() { if (!this.out) { this.out = jsonChecked16(); } return this.out; };
      references1.push('Access Approval Status [obj.CA10__resourceManagerFolder__r.CA10__accessApprovalStatus__c]: ' + obj.CA10__resourceManagerFolder__r.CA10__accessApprovalStatus__c);
      references1.push('Access Approval Status [obj.CA10__resourceManagerOrganization__r.CA10__accessApprovalStatus__c]: ' + obj.CA10__resourceManagerOrganization__r.CA10__accessApprovalStatus__c);
      references1.push('Access Approval Status [obj.CA10__accessApprovalStatus__c]: ' + obj.CA10__accessApprovalStatus__c);
      try {
          if (JsonLib.isNotEmpty(extractChecked2()) || JsonLib.isNotEmpty(extractChecked8()) || JsonLib.isNotEmpty(extract15.call(extract15))) {
              return {status: 'COMPLIANT', conditionIndex: 199, conditionText: "extract('CA10__resourceManagerFolder__r.caJsonFrom__accessApprovalStatus__c').isNotEmpty() || extract('CA10__resourceManagerOrganization__r.caJsonFrom__accessApprovalStatus__c').isNotEmpty() || extract('caJsonFrom__accessApprovalStatus__c').isNotEmpty()", currentStateMessage: "Resource Manager Project with Access Approval enabled.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
          }
      } catch (err) {
          if (err.cause && err.cause.status) { return err.cause; } else { throw err; }
      }
      return {status: 'INCOMPLIANT', conditionIndex: 200, conditionText: "otherwise", currentStateMessage: "Resource Manager Project without Access Approval.", currentStateReferences: references1.join('\n'), remediation: null, runtimeError: null};
  """;


  SELECT
    expectedResult.Id as Id,
    IF (
      IFNULL(expectedResult.expectedResult.status, '') = IFNULL(sObject.result.status, '')
      AND IFNULL(expectedResult.expectedResult.conditionIndex, -1) = IFNULL(sObject.result.conditionIndex, -1)
      AND IFNULL(expectedResult.expectedResult.conditionText, '') = IFNULL(sObject.result.conditionText, '')
      AND IFNULL(expectedResult.expectedResult.runtimeError, '') = IFNULL(sObject.result.runtimeError, ''),
      "MATCH",
      "FAIL"
    ) as match,
    expectedResult.expectedResult.status as expectedStatus, sObject.result.status as actualStatus,
    expectedResult.expectedResult.conditionIndex as expectedConditionIndex, sObject.result.conditionIndex as actualConditionIndex,
    expectedResult.expectedResult.conditionText as expectedConditionText, sObject.result.conditionText as actualConditionText,
    expectedResult.expectedResult.runtimeError as expectedRuntimeError, sObject.result.runtimeError as actualRuntimeError
  FROM UNNEST(mock_ExpectedResult()) expectedResult
  LEFT JOIN (
      SELECT
          sObject.Id AS Id,
          `CA10__Google_Resource_Manager_Projects__r`.arr AS CA10__Google_Resource_Manager_Projects__r,
          process_CA10__CaGoogleProject__c(
              STRUCT(
                  sObject.Id AS Id,
                  `CA10__Google_Resource_Manager_Projects__r`.arr AS CA10__Google_Resource_Manager_Projects__r
              ),
              sObject.context.snapshotTime
          ) as result
      FROM UNNEST(mock_CA10__CaGoogleProject__c()) AS sObject
      LEFT JOIN (
          SELECT
              sObject.CA10__googleProject__c,
              ARRAY_AGG(
                  STRUCT(
                      sObject.Id AS Id,
                      sObject.CA10__disappearanceTime__c AS CA10__disappearanceTime__c,
                      sObject.CA10__resourceManagerFolder__c AS CA10__resourceManagerFolder__c,
                      sObject.CA10__resourceManagerFolderId__c AS CA10__resourceManagerFolderId__c,
                      sObject.CA10__resourceManagerOrganization__c AS CA10__resourceManagerOrganization__c,
                      sObject.CA10__resourceManagerOrganizationId__c AS CA10__resourceManagerOrganizationId__c,
                      sObject.CA10__accessApprovalStatus__c AS CA10__accessApprovalStatus__c,
                      sObject.CA10__googleProject__c AS CA10__googleProject__c,
                      STRUCT (
                          `CA10__resourceManagerFolder__r`.Id AS Id,
                          `CA10__resourceManagerFolder__r`.CA10__disappearanceTime__c AS CA10__disappearanceTime__c,
                          `CA10__resourceManagerFolder__r`.CA10__accessApprovalStatus__c AS CA10__accessApprovalStatus__c
                      ) AS CA10__resourceManagerFolder__r,
                      STRUCT (
                          `CA10__resourceManagerOrganization__r`.Id AS Id,
                          `CA10__resourceManagerOrganization__r`.CA10__disappearanceTime__c AS CA10__disappearanceTime__c,
                          `CA10__resourceManagerOrganization__r`.CA10__accessApprovalStatus__c AS CA10__accessApprovalStatus__c
                      ) AS CA10__resourceManagerOrganization__r,
                      process_CA10__Google_Resource_Manager_Projects__r(
                          STRUCT(
                              sObject.Id AS Id,
                              sObject.CA10__disappearanceTime__c AS CA10__disappearanceTime__c,
                              sObject.CA10__resourceManagerFolder__c AS CA10__resourceManagerFolder__c,
                              sObject.CA10__resourceManagerFolderId__c AS CA10__resourceManagerFolderId__c,
                              sObject.CA10__resourceManagerOrganization__c AS CA10__resourceManagerOrganization__c,
                              sObject.CA10__resourceManagerOrganizationId__c AS CA10__resourceManagerOrganizationId__c,
                              sObject.CA10__accessApprovalStatus__c AS CA10__accessApprovalStatus__c,
                              sObject.CA10__googleProject__c AS CA10__googleProject__c,
                              STRUCT (
                                  `CA10__resourceManagerFolder__r`.Id AS Id,
                                  `CA10__resourceManagerFolder__r`.CA10__disappearanceTime__c AS CA10__disappearanceTime__c,
                                  `CA10__resourceManagerFolder__r`.CA10__accessApprovalStatus__c AS CA10__accessApprovalStatus__c
                              ) AS CA10__resourceManagerFolder__r,
                              STRUCT (
                                  `CA10__resourceManagerOrganization__r`.Id AS Id,
                                  `CA10__resourceManagerOrganization__r`.CA10__disappearanceTime__c AS CA10__disappearanceTime__c,
                                  `CA10__resourceManagerOrganization__r`.CA10__accessApprovalStatus__c AS CA10__accessApprovalStatus__c
                              ) AS CA10__resourceManagerOrganization__r
                          ),
                          sObject.context.snapshotTime
                      ) as result
                  )
              ) AS arr
          FROM UNNEST(mock_CA10__CaGoogleResourceManagerProject__c()) AS sObject
          LEFT JOIN UNNEST(mock_CA10__CaGoogleResourceManagerFolder__c()) AS `CA10__resourceManagerFolder__r`
              ON sObject.CA10__resourceManagerFolder__c = `CA10__resourceManagerFolder__r`.Id
          LEFT JOIN UNNEST(mock_CA10__CaGoogleResourceManagerOrganization__c()) AS `CA10__resourceManagerOrganization__r`
              ON sObject.CA10__resourceManagerOrganization__c = `CA10__resourceManagerOrganization__r`.Id
          GROUP BY sObject.CA10__googleProject__c
      ) AS `CA10__Google_Resource_Manager_Projects__r`
          ON sObject.Id = `CA10__Google_Resource_Manager_Projects__r`.CA10__googleProject__c
  ) sObject ON sObject.Id = expectedResult.Id;
