jaredzhou/mooncedar/ast

README
U
Condition
U
Context
U
Entity
U
EntityType
U
EntityUID
U
EntityUIDEntry
U
EvalError
U
Expr
U
ParseError
U
PartialValue
U
Policy
U
PolicyEffect
U
Request
U
ScopeConstraint
U
Type
U
Value
T
AuthorizationResult
T
Decision
T
DecisionRecord
T
DiagnosticError
T
DiagnosticReason
T
MapEntityStore
- ::concretizePartialAuthorizationAnswer::concretize
- ::reauthorizePartialAuthorizationAnswer::reauthorize
- ::to_requestRequestJSON::to_request
T
ResidualRecord
V
action
V
bool
V
cedar_entity_from_json
V
cedar_value_from_json
V
cedar_value_from_object
V
context
V
default_policy
V
entity_type
V
entity_uid
V
euid
V
eval_expr
V
evaluate
V
ext_call
V
if_
V
is_authorized
V
is_empty
V
long
V
neg
V
new_map_store
V
not_
V
parse_policies
V
principal
V
record
V
resource
V
set
V
str
V
stringify
V
stringify_expr
V
to_request_json
V
unknown
V
value_to_expr

jaredzhou/mooncedar/ast does not have a README file

ValidationError

pub(all) suberror ValidationError {
  ValidationError(String, String)
} derive(@moonbitlang/core/debug.Debug
Debug)

Validation error with a message and the offending policy id.

Annotation

source

pub(all) struct Annotation {
  key : String
  value : String
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

Annotation — key-value metadata attached to a policy. Has no effect on policy evaluation.

BinaryOp

source

pub(all) enum BinaryOp {
  Eq
  Ne
  Less
  LessEq
  Gt
  Ge
  Add
  Sub
  Mul
  In_
  Contains
  ContainsAll
  ContainsAny
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

Built-in binary operators.

Condition

source

pub(all) struct Condition {
  kind : ConditionKind
  body : Expr
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

ConditionKind

source

pub(all) enum ConditionKind {
  When
  Unless
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

Entity

source

pub(all) struct Entity {
  uid : EntityUID
  attrs : Map[String, Value]
  tags : Map[String, Value]
  parents : Array[EntityUID]
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

An entity as provided by the application. Contains attributes (schema-defined), tags (free-form), and parent relationships for hierarchy traversal (in operator).

impl ToJson for Entity

impl FromJson for Entity

EntityType

source

pub(all) struct EntityType(String) derive(Eq, ToJson, @moonbitlang/core/debug.Debug
Debug, @moonbitlang/core/json.FromJson
FromJson)

An entity type name, e.g. User, Photo.

EntityUID

source

pub(all) struct EntityUID {
  type_ : String
  id : String
} derive(Eq, Hash, @moonbitlang/core/debug.Debug
Debug)

A unique entity identifier, e.g. User::"alice".

impl ToJson for EntityUID

impl FromJson for EntityUID

Expr

source

pub(all) enum Expr {
  Lit(Literal)
  Var(VarKind)
  If(Expr, Expr, Expr)
  And(Expr, Expr)
  Or(Expr, Expr)
  UnaryApp(UnaryOp, Expr)
  BinaryApp(BinaryOp, Expr, Expr)
  GetAttr(Expr, String)
  HasAttr(Expr, String)
  GetTag(Expr, Expr)
  HasTag(Expr, Expr)
  Like(Expr, Pattern)
  Is(Expr, EntityType)
  Set(Array[Expr])
  Record(Array[(String, Expr)])
  ExtensionApp(Name, Array[Expr])
  Slot(String)
  Unknown(String, Type?)
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

The complete expression AST for Cedar. Covers every node type from the Cedar language specification.

Expr::access

source

fn Expr::access(self : Expr, attr : String) -> Expr

self.attr

Expr::add

source

fn Expr::add(self : Expr, rhs : Expr) -> Expr

self + rhs

Expr::and_

source

fn Expr::and_(self : Expr, rhs : Expr) -> Expr

self && rhs (keyword: and)

Expr::contains

source

fn Expr::contains(self : Expr, rhs : Expr) -> Expr

self.contains(rhs)

Expr::contains_all

source

fn Expr::contains_all(self : Expr, rhs : Expr) -> Expr

self.contains_all(rhs)

Expr::contains_any

source

fn Expr::contains_any(self : Expr, rhs : Expr) -> Expr

self.contains_any(rhs)

Expr::eq

source

fn Expr::eq(self : Expr, rhs : Expr) -> Expr

self == rhs

Expr::ge

source

fn Expr::ge(self : Expr, rhs : Expr) -> Expr

self >= rhs

Expr::get_tag

source

fn Expr::get_tag(self : Expr, tag : Expr) -> Expr

self.get_tag(tag)

Expr::gt

source

fn Expr::gt(self : Expr, rhs : Expr) -> Expr

self > rhs

Expr::has

source

fn Expr::has(self : Expr, attr : String) -> Expr

self has attr

Expr::has_tag

source

fn Expr::has_tag(self : Expr, tag : Expr) -> Expr

self.has_tag(tag)

Expr::in_

source

fn Expr::in_(self : Expr, rhs : Expr) -> Expr

self in rhs (keyword: in)

Expr::is_

source

fn Expr::is_(self : Expr, ty : EntityType) -> Expr

self is EntityType (keyword: is)

Expr::is_in

source

fn Expr::is_in(self : Expr, ty : EntityType, entity : Expr) -> Expr

self is ty AND self in entity — desugared to and_ + is_ + in_

Expr::le

source

fn Expr::le(self : Expr, rhs : Expr) -> Expr

self <= rhs

Expr::like

source

fn Expr::like(self : Expr, pattern : Pattern) -> Expr

self like pattern

Expr::lt

source

fn Expr::lt(self : Expr, rhs : Expr) -> Expr

self < rhs

Expr::mul

source

fn Expr::mul(self : Expr, rhs : Expr) -> Expr

self * rhs

Expr::ne

source

fn Expr::ne(self : Expr, rhs : Expr) -> Expr

self != rhs

Expr::or_

source

fn Expr::or_(self : Expr, rhs : Expr) -> Expr

self || rhs (keyword: or)

Expr::sub

source

fn Expr::sub(self : Expr, rhs : Expr) -> Expr

self - rhs

Literal

source

pub(all) enum Literal {
  Bool(Bool)
  Long(Int64)
  String(String)
  EntityUID(EntityUID)
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

A literal value that can appear directly in Cedar source text. Set and Record are NOT literals — they are compound expressions.

Name

source

pub(all) struct Name {
  ns : Array[String]
  name : String
} derive(Eq, ToJson, @moonbitlang/core/debug.Debug
Debug, @moonbitlang/core/json.FromJson
FromJson)

A namespaced path for extension functions, e.g. ip, decimal.

PartialValue

source

pub(all) enum PartialValue {
  Value(Value)
  Residual(Expr)
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

Result of evaluating an expression — either a concrete value or a residual expression that could not be reduced (partial evaluation).

Also used as the value type in Entity attrs/tags, because entity attributes and tags can be unknown during partial evaluation (source #5 of Unknown).

Pattern

source

pub(all) struct Pattern {
  elements : Array[PatternElem]
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

Pattern for the like operator (IAM-style StringLike). The wildcard * matches any string; \* matches a literal *.

PatternElem

source

pub(all) enum PatternElem {
  Char(Char)
  Wildcard
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

Policy

source

pub(all) struct Policy {
  id : String
  effect : PolicyEffect
  annotations : Array[Annotation]
  principal : ScopeConstraint
  action : ScopeConstraint
  resource : ScopeConstraint
  conditions : Array[Condition]
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

A complete Cedar policy.

Policy::action_eq

source

fn Policy::action_eq(self : Policy, type_ : String, id : String) -> Policy

Policy::action_in

source

fn Policy::action_in(self : Policy, type_ : String, id : String) -> Policy

Policy::action_in_set

source

fn Policy::action_in_set(self : Policy, entities : Array[(String, String)]) -> Policy

Policy::annotate

source

fn Policy::annotate(self : Policy, key : String, value : String) -> Policy

Policy::forbid

source

fn Policy::forbid(self : Policy) -> Policy

Policy::permit

source

fn Policy::permit(self : Policy) -> Policy

Policy::principal_eq

source

fn Policy::principal_eq(self : Policy, type_ : String, id : String) -> Policy

Policy::principal_in

source

fn Policy::principal_in(self : Policy, type_ : String, id : String) -> Policy

Policy::principal_is

source

fn Policy::principal_is(self : Policy, type_ : String) -> Policy

Policy::principal_is_in

source

fn Policy::principal_is_in(self : Policy, ty : String, parent_ty : String, parent_id : String) -> Policy

Policy::resource_eq

source

fn Policy::resource_eq(self : Policy, type_ : String, id : String) -> Policy

Policy::resource_in

source

fn Policy::resource_in(self : Policy, type_ : String, id : String) -> Policy

Policy::resource_is

source

fn Policy::resource_is(self : Policy, type_ : String) -> Policy

Policy::resource_is_in

source

fn Policy::resource_is_in(self : Policy, ty : String, parent_ty : String, parent_id : String) -> Policy

Policy::unless

source

fn Policy::unless(self : Policy, body : Expr) -> Policy

Policy::when_

source

fn Policy::when_(self : Policy, body : Expr) -> Policy

Policy::with_id

source

fn Policy::with_id(self : Policy, id : String) -> Policy

PolicyEffect

source

pub(all) enum PolicyEffect {
  Permit
  Forbid
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

Position

source

pub(all) struct Position {
  filename : String
  offset : Int
  line : Int
  column : Int
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

Source position for diagnostics / error messages.

ScopeConstraint

source

pub(all) enum ScopeConstraint {
  All
  Eq(EntityUID)
  In(EntityUID)
  InSet(Array[EntityUID])
  Is(EntityType)
  IsIn(EntityType, EntityUID)
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

Scope constraint for principal, action, or resource in a policy.

Not every variant is valid for every PARC position:

Principal: All | Eq | In | Is | IsIn
Action: All | Eq | In | InSet
Resource: All | Eq | In | Is | IsIn

Type

source

pub(all) enum Type {
  Bool
  Long
  String
  Set
  Record
  Entity(EntityType)
  Extension(Name)
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

The runtime type of a Cedar value. Two entity types are equal iff they have the same Name. Two extension types are equal iff they have the same Name.

UnaryOp

source

pub(all) enum UnaryOp {
  Not
  Neg
  IsEmpty
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

Built-in unary operators.

Value

source

pub(all) enum Value {
  Bool(Bool)
  Long(Int64)
  String(String)
  EntityUID(EntityUID)
  Set(Array[Value])
  Record(Map[String, Value])
  Extension(Name, String)
} derive(Eq, ToJson, @moonbitlang/core/debug.Debug
Debug, @moonbitlang/core/json.FromJson
FromJson)

All values that can be the dynamic result of evaluating an Expr. Includes extension values (ip, decimal, datetime, duration, etc.) as opaque Extension(Name, String) entries for MVP.

VarKind

source

pub(all) enum VarKind {
  Principal
  Action
  Resource
  Context
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

The four PARC variables that Cedar expressions can reference.

action

source

fn action() -> Expr

bool

source

fn bool(b : Bool) -> Expr

context

source

fn context() -> Expr

default

source

fn default() -> Policy

Return a zero-valued Policy with Permit effect, All scopes, empty arrays.

entity_type

source

fn entity_type(name : String) -> EntityType

Construct an EntityType newtype in builder contexts.

entity_uid

source

fn entity_uid(type_ : String, id : String) -> EntityUID

Construct an EntityUID in builder contexts.

euid

source

fn euid(type_ : String, id : String) -> Expr

ext_call

source

fn ext_call(name : Name, args : Array[Expr]) -> Expr

if_

source

fn if_(cond : Expr, t : Expr, e : Expr) -> Expr

is_empty

source

fn is_empty(e : Expr) -> Expr

long

source

fn long(l : Int64) -> Expr

neg

source

fn neg(e : Expr) -> Expr

not_

source

fn not_(e : Expr) -> Expr

principal

source

fn principal() -> Expr

record

source

fn record(pairs : Array[(String, Expr)]) -> Expr

resource

source

fn resource() -> Expr

set

source

fn set(elements : Array[Expr]) -> Expr

str

source

fn str(s : String) -> Expr

unknown

source

fn unknown(name : String, typ? : Type) -> Expr

Convenience constructor for Unknown. Call unknown("x") for an untyped unknown, or unknown("x", typ=EntityType("User")) for a typed one.

validate_policies

source

fn validate_policies(policies : Array[Policy]) -> Unit raise ValidationError

Validate all policies in a policy set. Raises on the first invalid policy found.

validate_policy

source

fn validate_policy(policy : Policy) -> Unit raise ValidationError

Validate a single policy's scope constraints.

Position	Valid variants	Invalid
Principal	All, Eq, In, Is, IsIn	InSet
Action	All, Eq, In, InSet	Is, IsIn
Resource	All, Eq, In, Is, IsIn	InSet

Source Files

Site source Report issue Packages Build queue Skills Statistics

#ValidationError

#Annotation

#BinaryOp

#Condition

#ConditionKind

#Entity

#EntityType

#EntityUID

#Expr

#Expr::access

#Expr::add

#Expr::and_

#Expr::contains

#Expr::contains_all

#Expr::contains_any

#Expr::eq

#Expr::ge

#Expr::get_tag

#Expr::gt

#Expr::has

#Expr::has_tag

#Expr::in_

#Expr::is_

#Expr::is_in

#Expr::le

#Expr::like

#Expr::lt

#Expr::mul

#Expr::ne

#Expr::or_

#Expr::sub

#Literal

#Name

#PartialValue

#Pattern

#PatternElem

#Policy

#Policy::action_eq

#Policy::action_in

#Policy::action_in_set

#Policy::annotate

#Policy::forbid

#Policy::permit

#Policy::principal_eq

#Policy::principal_in

#Policy::principal_is

#Policy::principal_is_in

#Policy::resource_eq

#Policy::resource_in

#Policy::resource_is

#Policy::resource_is_in

#Policy::unless

#Policy::when_

#Policy::with_id

#PolicyEffect

#Position

#ScopeConstraint

#Type

#UnaryOp

#Value

#VarKind

#action

#bool

#context

#default

#entity_type

#entity_uid

#euid

#ext_call

#if_

#is_empty

#long

#neg

#not_

#principal

#record

#resource

#set

#str

#unknown

ValidationError

Annotation

BinaryOp

Condition

ConditionKind

Entity

EntityType

EntityUID

Expr

Expr::access

Expr::add

Expr::and_

Expr::contains

Expr::contains_all

Expr::contains_any

Expr::eq

Expr::ge

Expr::get_tag

Expr::gt

Expr::has

Expr::has_tag

Expr::in_

Expr::is_

Expr::is_in

Expr::le

Expr::like

Expr::lt

Expr::mul

Expr::ne

Expr::or_

Expr::sub

Literal

Name

PartialValue

Pattern

PatternElem

Policy

Policy::action_eq

Policy::action_in

Policy::action_in_set

Policy::annotate

Policy::forbid

Policy::permit

Policy::principal_eq

Policy::principal_in

Policy::principal_is

Policy::principal_is_in

Policy::resource_eq

Policy::resource_in

Policy::resource_is

Policy::resource_is_in

Policy::unless

Policy::when_

Policy::with_id

PolicyEffect

Position

ScopeConstraint

Type

UnaryOp

Value

VarKind

action

bool

context

default

entity_type

entity_uid

euid

ext_call

if_

is_empty

long

neg

not_

principal

record

resource

set

str

unknown