jaredzhou/mooncedar/evaluator

README
U
Condition
U
Context
U
Entity
U
EntityType
U
EntityUID
U
EntityUIDEntry
U
EvalError
U
Expr
U
ParseError
U
PartialValue
U
Policy
U
PolicyEffect
U
Request
U
ScopeConstraint
U
Type
U
Value
T
AuthorizationResult
T
Decision
T
DecisionRecord
T
DiagnosticError
T
DiagnosticReason
T
MapEntityStore
- ::concretizePartialAuthorizationAnswer::concretize
- ::reauthorizePartialAuthorizationAnswer::reauthorize
- ::to_requestRequestJSON::to_request
T
ResidualRecord
V
action
V
bool
V
cedar_entity_from_json
V
cedar_value_from_json
V
cedar_value_from_object
V
context
V
default_policy
V
entity_type
V
entity_uid
V
euid
V
eval_expr
V
evaluate
V
ext_call
V
if_
V
is_authorized
V
is_empty
V
long
V
neg
V
new_map_store
V
not_
V
parse_policies
V
principal
V
record
V
resource
V
set
V
str
V
stringify
V
stringify_expr
V
to_request_json
V
unknown
V
value_to_expr

jaredzhou/mooncedar/evaluator does not have a README file

EntityStore

pub(open) trait EntityStore {
  fn get_entity(Self, @jaredzhou/mooncedar/ast.EntityUID
EntityUID) -> @jaredzhou/mooncedar/ast.Entity
Entity?
}

Pluggable entity storage. Implement this trait to provide entity lookups from any backing store (in-memory Map, database, cache, etc.).

EvalError

source

pub(all) suberror EvalError {
  TypeMismatch(String)
  IntegerOverflow
  EntityNotFound(String)
  InvalidOperator(String)
  ExtensionNotSupported(String)
  SlotNotSupported
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

Errors that can occur during expression evaluation.

Context

source

pub(all) enum Context {
  Concrete(@jaredzhou/mooncedar/ast.Value
Value)
  Unknown
  Partial(@jaredzhou/mooncedar/ast.Expr
Expr)
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

Request context — three states matching Rust's CPE:

Concrete(Value::Record(...)): fully known context
Unknown(Expr): entirely unknown (e.g., Expr::Unknown("context", None))
Partial(Expr): partially known, containing an Expr::Record where individual fields may be Expr::Unknown nodes.

Dereference

source

pub(all) enum Dereference {
  Data(@jaredzhou/mooncedar/ast.Entity
Entity)
  NoSuchEntity
  Residual(@jaredzhou/mooncedar/ast.Expr
Expr)
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

Result of looking up an entity in the store.

EntityUIDEntry

source

pub(all) enum EntityUIDEntry {
  Concrete(@jaredzhou/mooncedar/ast.EntityUID
EntityUID)
  Unknown(@jaredzhou/mooncedar/ast.EntityType
EntityType)
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

A PARC slot: either a known EntityUID (concrete eval) or a typed Unknown (partial eval).

Request

source

pub(all) struct Request {
  principal : EntityUIDEntry
  action : EntityUIDEntry
  resource : EntityUIDEntry
  context : Context
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

The PARC authorization request.

concrete_context

source

fn concrete_context(value : @jaredzhou/mooncedar/ast.Value
Value) -> Context

construct a concrete Context from a Value.

concrete_uid

source

fn concrete_uid(type_ : String, id : String) -> EntityUIDEntry

Helper: construct a concrete EntityUIDEntry.

eval_binary

source

fn eval_binary(op : @jaredzhou/mooncedar/ast.BinaryOp
BinaryOp, lhs : @jaredzhou/mooncedar/ast.Value
Value, rhs : @jaredzhou/mooncedar/ast.Value
Value) -> @jaredzhou/mooncedar/ast.Value
Value raise EvalError

Evaluate a binary operator on two concrete values. Does NOT handle In_ — that requires EntityStore access and is handled in expr_eval.mbt.

eval_expr

source

fn[S : EntityStore] eval_expr(expr : @jaredzhou/mooncedar/ast.Expr
Expr, req : Request, store : S) -> @jaredzhou/mooncedar/ast.PartialValue
PartialValue raise EvalError

Evaluate a Cedar expression in the context of a Request and EntityStore. Returns Value(concrete) for fully-reducible expressions, or Residual(expr) for expressions that cannot be fully reduced (partial evaluation).

eval_policy

source

fn[S : EntityStore] eval_policy(p : @jaredzhou/mooncedar/ast.Policy
Policy, req : Request, store : S) -> @jaredzhou/mooncedar/ast.PartialValue
PartialValue raise EvalError

Evaluate a single policy against a Request and EntityStore. Returns: Value(Bool(true)) — policy satisfied (scope matched, all conditions passed) Value(Bool(false)) — policy not satisfied (scope didn't match, or condition failed) Residual(Expr) — partial eval: scope matched but some conditions are residual raise EvalError — evaluation error

eval_unary

source

fn eval_unary(op : @jaredzhou/mooncedar/ast.UnaryOp
UnaryOp, arg : @jaredzhou/mooncedar/ast.Value
Value) -> @jaredzhou/mooncedar/ast.Value
Value raise EvalError

Evaluate a unary operator on a concrete value.

is_descendant

source

fn[S : EntityStore] is_descendant(uid : @jaredzhou/mooncedar/ast.EntityUID
EntityUID, ancestor : @jaredzhou/mooncedar/ast.EntityUID
EntityUID, store : S) -> Bool

Check if uid is equal to or a descendant of ancestor in the entity hierarchy. Uses BFS to traverse parent chains.

partial_context

source

fn partial_context(expr : @jaredzhou/mooncedar/ast.Expr
Expr) -> Context

construct a partial Context from an Expr.

scope_match

source

fn[S : EntityStore] scope_match(sc : @jaredzhou/mooncedar/ast.ScopeConstraint
ScopeConstraint, uid : @jaredzhou/mooncedar/ast.EntityUID
EntityUID, store : S) -> Bool

Check whether a scope constraint matches the given entity variable.

sub_long

source

fn sub_long(lhs : @jaredzhou/mooncedar/ast.Value
Value, rhs : @jaredzhou/mooncedar/ast.Value
Value) -> @jaredzhou/mooncedar/ast.Value
Value raise EvalError

unknown_context

source

fn unknown_context() -> Context

construct an unknown Context.

unknown_uid

source

fn unknown_uid(type_ : String) -> EntityUIDEntry

construct a unknown EntityUIDEntry.

value_to_expr

source

fn value_to_expr(v : @jaredzhou/mooncedar/ast.Value
Value) -> @jaredzhou/mooncedar/ast.Expr
Expr

Convert a concrete Value back into an Expr (inverse of lit_to_value).

wildcard_match

source

fn wildcard_match(text : String, pattern : @jaredzhou/mooncedar/ast.Pattern
Pattern) -> Bool

Match a string against a Cedar like-pattern. * matches any sequence of characters (including empty). \* matches a literal * (already parsed as PatternElem::Char('*')).

Uses two-pointer backtracking: on Wildcard, record the star position and advance the text pointer; on mismatch, backtrack to the last star.

Source Files

Site source Report issue Packages Build queue Skills Statistics

#EntityStore

#EvalError

#Context

#Dereference

#EntityUIDEntry

#Request

#concrete_context

#concrete_uid

#eval_binary

#eval_expr

#eval_policy

#eval_unary

#is_descendant

#partial_context

#scope_match

#sub_long

#unknown_context

#unknown_uid

#value_to_expr

#wildcard_match

Source Files

EntityStore

EvalError

Context

Dereference

EntityUIDEntry

Request

concrete_context

concrete_uid

eval_binary

eval_expr

eval_policy

eval_unary

is_descendant

partial_context

scope_match

sub_long

unknown_context

unknown_uid

value_to_expr

wildcard_match