---
Function {
 argument: None,
 arguments: FunctionArguments {
  arguments: [
   FunctionArgument {
    identifier: "user",
    default: None,
   },
   FunctionArgument {
    identifier: "groups",
    default: None,
   },
   FunctionArgument {
    identifier: "group",
    default: None,
   },
   FunctionArgument {
    identifier: "cert",
    default: None,
   },
  ],
  ellipsis: false,
 },
 definition: Map {
  bindings: [
   KeyValue(
    AttributePath {
     attributes: [
      Raw {
       content: "assertion",
       position: (2, 3),
      },
     ],
    },
    BinaryOperation {
     operator: LogicalOr,
     operands: [
      BinaryOperation {
       operator: EqualTo,
       operands: [
        PropertyAccess {
         expression: Variable {
          identifier: "cert",
          position: (2, 15),
         },
         attribute_path: AttributePath {
          attributes: [
           Raw {
            content: "group",
            position: (2, 20),
           },
          ],
         },
         default: None,
        },
        Variable {
         identifier: "group",
         position: (2, 29),
        },
       ],
       position: (2, 26),
      },
      FunctionApplication {
       function: PropertyAccess {
        expression: Variable {
         identifier: "builtins",
         position: (2, 38),
        },
        attribute_path: AttributePath {
         attributes: [
          Raw {
           content: "any",
           position: (2, 47),
          },
         ],
        },
        default: None,
       },
       arguments: [
        Function {
         argument: Some(
          "u",
         ),
         arguments: FunctionArguments {
          arguments: [],
          ellipsis: false,
         },
         definition: BinaryOperation {
          operator: EqualTo,
          operands: [
           Variable {
            identifier: "u",
            position: (2, 55),
           },
           Variable {
            identifier: "user",
            position: (2, 60),
           },
          ],
          position: (2, 57),
         },
         position: (2, 52),
        },
        PropertyAccess {
         expression: Variable {
          identifier: "groups",
          position: (2, 66),
         },
         attribute_path: AttributePath {
          attributes: [
           Expression {
            expression: PropertyAccess {
             expression: Variable {
              identifier: "cert",
              position: (2, 75),
             },
             attribute_path: AttributePath {
              attributes: [
               Raw {
                content: "group",
                position: (2, 80),
               },
              ],
             },
             default: None,
            },
           },
           Raw {
            content: "members",
            position: (2, 87),
           },
          ],
         },
         default: None,
        },
       ],
      },
     ],
     position: (2, 35),
    },
   ),
   KeyValue(
    AttributePath {
     attributes: [
      Raw {
       content: "message",
       position: (3, 3),
      },
     ],
    },
    String {
     parts: [
      Raw {
       content: "Group for certificate ",
       position: (3, 14),
      },
      Expression {
       expression: PropertyAccess {
        expression: Variable {
         identifier: "cert",
         position: (3, 38),
        },
        attribute_path: AttributePath {
         attributes: [
          Raw {
           content: "domain",
           position: (3, 43),
          },
         ],
        },
        default: None,
       },
      },
      Raw {
       content: " must be ",
       position: (3, 50),
      },
      Expression {
       expression: Variable {
        identifier: "group",
        position: (3, 61),
       },
      },
      Raw {
       content: ", or user ",
       position: (3, 67),
      },
      Expression {
       expression: Variable {
        identifier: "user",
        position: (3, 79),
       },
      },
      Raw {
       content: " must be a member of group ",
       position: (3, 84),
      },
      Expression {
       expression: PropertyAccess {
        expression: Variable {
         identifier: "cert",
         position: (3, 113),
        },
        attribute_path: AttributePath {
         attributes: [
          Raw {
           content: "group",
           position: (3, 118),
          },
         ],
        },
        default: None,
       },
      },
     ],
    },
   ),
  ],
  recursive: false,
  position: (1, 32),
 },
 position: (1, 1),
}