Module ast 

This module contains the AST datatypes.

Structs

BorrowedLiteralPolicy

A borrowed version of LiteralPolicy exclusively for serialization

BorrowedRestrictedExpr

While RestrictedExpr wraps an owned Expr, BorrowedRestrictedExpr wraps a borrowed Expr, with the same invariants.

Context

Context field of a Request

Eid

EID type is just a SmolStr for now

Entity

Entity datatype

EntityUID

Unique ID for an entity. These represent entities in the AST.

Expr

Internal AST for expressions used by the policy evaluator. This structure is a wrapper around an ExprKind, which is the expression variant this object contains. It also contains source information about where the expression was written in policy source code, and some generic data which is stored on each node of the AST. Cloning is O(1).

ExprBuilder

Builder for constructing Expr objects annotated with some data (possibly taking default value) and optional some source_info.

ExprIterator

This structure implements the iterator used to traverse subexpressions of an expression.

ExprShapeOnly

A new type wrapper around Expr that provides Eq and Hash implementations that ignore any source information or other generic data used to annotate the Expr.

Extension

Cedar extension.

ExtensionFunction

Extension function. These can be called by the given name in Ceder expressions.

ExtensionFunctionOp

Extension functions Clone is O(1).

ExtensionValueWithArgs

Object container for extension values, also stores the fully reduced AST for the arguments

Id

Identifiers. Anything in Id should be a valid identifier (and not contain, for instance, spaces or characters like ‘+’).

LiteralPolicy

Represents either an static policy or a template linked policy This is the serializable version because it simply refers to the Template by its Id;

Name

This is the Name type used to name types, functions, etc. The name can include namespaces. Clone is O(1).

Pattern

Represent a pattern literal (the RHS of the like operator) Also provides an implementation of the Display trait as well as a wildcard matching method.

Policy

A Policy that contains: a pointer to its template an link ID (unless it’s an static policy) the bound values for slots in the template

PolicyID

A unique identifier for a policy statement

PolicySet

Represents a set of Policys

PrincipalConstraint

Template constraint on principal head variables

Request

Represents the request tuple <P, A, R, C> (see the Cedar design doc).

ResourceConstraint

Template constraint on resource head variables

RestrictedExpr

A few places in Core use these “restricted expressions” (for lack of a better term) which are in some sense the minimal subset of Expr required to express all possible Values.

RestrictedExprShapeOnly

Like ExprShapeOnly, but for restricted expressions.

Set

Value’s internal representation of a Set

SlotId

Identifier for a slot Clone is O(1).

StaticPolicy

Static Policies are policy that do not come from templates. They have the same structure as a template definition, but cannot contain slots

Template

Top level structure for a policy template. Contains both the AST for template, and the list of open slots in the template.

TemplateBody

Policy datatype.

Enums

ActionConstraint

Constraint for action head variables. Action variables can be constrained to be in any variable in a list.

BinaryOp

Built-in operators with exactly two arguments

CallStyle

Which “style” is a function call

ContainsSlot

Error for unexpected slots

Effect

the Effect of a policy

EntityReference

A reference to an EntityUID that may be a Slot

EntityType

We support two types of entities. The first is a nominal type (e.g., User, Action) and the second is an unspecified type, which is used (internally) to represent cases where the input request does not provide a principal, action, and/or resource.

EntityUIDEntry

An entry in a request for a Entity UID. It may either be a concrete EUID or an unknown in the case of partial evaluation

ExprKind

The possible expression variants. This enum should be matched on by code recursively traversing the AST.

ExtensionOutputValue

The output of an extension call, either a value or an unknown

LinkingError

Errors instantiating templates

Literal

First-class values which may appear as literals in Expr::Lit.

NotValue

An error that can be thrown converting an expression to a value

PartialValue

Intermediate results of partial evaluation

PatternElem

Represent an element in a pattern literal (the RHS of the like operation)

PolicySetError

Potential errors when working with PolicySets.

PrincipalOrResource

Subset of AST variables that have the same constraint form

PrincipalOrResourceConstraint

Represents the constraints for principals and resources. Can either not constrain, or constrain via == or in for a single entity literal.

ReificationError

Errors that can happen during policy reification

RestrictedExpressionError

Errors generated in the restricted_expr module

SubstitutionError

Enum for errors encountered during substitution

Type

This represents the runtime type of a Cedar value. Nominal types: two entity types are equal if they have the same Name.

UnaryOp

Built-in operators with exactly one argument

Value

This describes all the values which could be the dynamic result of evaluating an Expr. Cloning is O(1).

Var

AST variables

Traits

ExtensionValue

Extension value.

InternalExtensionValue

Extensions provide a type implementing ExtensionValue, Eq, and Ord. We automatically implement InternalExtensionValue for that type (with the impl below). Internally, we use dyn InternalExtensionValue instead of dyn ExtensionValue.

StaticallyTyped

Trait for everything in Cedar that has a type known statically.

Functions

split

Collect an iterator of either residuals or values into one of the following a) An iterator over values, if everything evaluated to values b) An iterator over residuals expressions, if anything only evaluated to a residual Order is preserved.

Type Aliases

ExtensionFunctionObject

Trait object that implements the extension function call.

SlotEnv

Map from Slot Ids to Entity UIDs which fill the slots