Struct CedarEngine 

pub struct CedarEngine { /* private fields */ }

A Cedar policy set, compiled once.

Compiled at construction rather than per request: parsing on every effect would put a parser in the hot path and, worse, would make a malformed policy a runtime failure at an arbitrary moment instead of a startup one.

Implementations

impl CedarEngine

pub fn new(source: &str) -> Result<Self, CedarError>

Compile a policy set from Cedar source.

Errors

If the source does not parse. Failing here — at startup, loudly — is the point: a policy set that cannot be compiled must never become a plane that denies everything for reasons nobody can see.

pub fn from_bundle( source: &str, schema_json: Option<&str>, entities_json: Option<&str>, ) -> Result<Self, CedarError>

Compile a complete Cedar policy bundle.

A declared schema is used to validate the policies at startup, parse static entities, parse each request context, and construct the request. Static entities are the facts intentionally frozen into this bundle; per-call facts remain in PolicyRequest::context.

Errors

If rules/schema/entities do not parse, or the policies do not validate strictly against the schema. Every failure is a startup refusal.

Trait Implementations

impl Debug for CedarEngine

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PolicyEngine for CedarEngine

fn preflight(&self, requests: &[PolicyRequest<'_>]) -> Vec<String>

Evaluate each probe and report the rules that could not be evaluated.

The trap this catches is Cedar’s totality: every rule is evaluated against every request, so a when clause reading an attribute the request does not carry errors rather than failing to match, and an unevaluable rule refuses the call because it may be the forbid that would have stopped it. One such rule denies every effect of every run, from a policy set that parsed and validated cleanly — which is exactly how a deployment found itself with a plane that refused everything.

Each probe is asked on its own resource and again on every resource a rule’s scope names that no probe names itself. A probe’s placeholder resource reaches only the rules scoped to any resource, so a forbid on resource == Resource::"payment.transfer" whose condition is unguarded would otherwise never be evaluated here — and would refuse every transfer. Its arguments are the probe’s, which carry none, so a rule reading one guards it with context.args has ….

Only unevaluable sets are reported. A set that merely denies the probes is a working default-deny plane, and reporting it would make this check the reason nobody writes one.

fn authorize(&self, request: &PolicyRequest<'_>) -> PolicyDecision

fn bundle(&self) -> PolicyBundleIdentity

Identifies every static input that can affect evaluation.

fn digest(&self) -> Digest

Compact digest of bundle.