#MoonCedar

#Installation

moon add jaredzhou/mooncedar@0.1.2

#Quick Start

// 1. Parse a Cedar policy
let policies = parse_policies(
  #|permit (principal == User::"alice", action == Action::"view", resource in Album::"jane_vacation");|
)

// 2. Build an entity store from JSON
let entities_src =
  #|[{"uid":{"type":"User","id":"alice"},"attrs":{},"tags":{},"parents":[]},{"uid":{"type":"Photo","id":"VacationPhoto94.jpg"},"attrs":{},"tags":{},"parents":[{"type":"Album","id":"jane_vacation"}]}]
let store : MapEntityStore = @json.from_json(@json.parse(entities_src))

// 3. Create a request
let req = Request::{
  principal: @evaluator.concrete_uid("User", "alice"),
  action: @evaluator.concrete_uid("Action", "view"),
  resource: @evaluator.concrete_uid("Photo", "VacationPhoto94.jpg"),
  context: Context::Concrete(Value::Record(Map([]))),
}

// 4. Authorize
let result = is_authorized(req, policies.iter(), store)
match result.decision {
  Decision::Allow => println("permitted")
  Decision::Deny => println("denied")
}
// => permitted

#Packages

#Features

#Policy Language

• permit / forbid effects with annotations
• Scope constraints (==, in, in [set], All)
• when / unless conditions
• Expression language: &&, ||, !, >, <, >=, <=, !=, like, in, contains, has, ., .tag
• Records, sets, if-then-else, extension function calls

#Expression Builder

let e = expr_principal()
  .eq(expr_str("alice"))
  .and_(expr_resource()
    .has_tag(expr_str("confidential"))
  )

#Policy Builder

let policy = default_policy()
  .permit()
  .principal_eq("User", "alice")
  .action_eq("Action", "view")
  .resource_in("Album", "photos")
  .when_(expr_resource().has_tag(expr_str("public")))

#Strategy Validation

let errors = @ast.validate_policies(policies)

#Entity Store (Pluggable)

// In-memory store (built-in)
let store = new_map_store()

// From Cedar JSON
let store : MapEntityStore = @json.from_json(@json.parse(entities_src))

// Custom backend via pub(open) trait
struct DbStore { conn : Connection }
pub impl @evaluator.EntityStore for DbStore with get_entity(self, uid) {
  db_lookup(self.conn, uid)
}

#Partial Evaluation

let answer = evaluate(req, policies.iter(), store1)        // partial result
let answer = answer.reauthorize(req, store2, mapping)      // fill unknowns
let result = answer.concretize()                           // final decision

#Request JSON

// Strings: "Type::\"id\"" → Concrete, "Type" → Unknown
// Objects: {"type":"...","id":"..."} → Concrete
let src =
  #|{"principal":"User::\"alice\"","action":"Action::\"view\"","resource":"Photo::\"x\"","context":{}}|
let dto : RequestJSON = @json.from_json(@json.parse(src))
let req : Request = dto.to_request()
let json = to_request_json(req).to_json()

#Stringify (AST -> Cedar Source)

let src = stringify(policies)

#Status

• 494 tests passing (parser, evaluator, authorizer, JSON, reauthorize, RequestJSON)
• Entity stores as pluggable pub(open) traits
• JSON serialization (Cedar-compatible format) for entities and requests
• Policy validation
• Full expression evaluation (18 expression variants, 12 binary + 3 unary operators)
• Partial evaluation with reauthorize (4-category coverage)

#License