Struct ValidatorSchema 

pub struct ValidatorSchema { /* private fields */ }

Internal representation of the schema for use by the validator.

In this representation, all common types are fully expanded, and all entity type names are fully disambiguated (fully qualified).

Implementations

impl ValidatorSchema

pub fn to_json_schema(&self) -> Result<Fragment<RawName>, String>

Converts a ValidatorSchema into a json_schema::Fragment. Roundtripping through this function gives a semantically equivalent schema but will lose formatting, annotations, and common type definitions. It will also inline the transitive closure of the entity hierarchy for each entity type and action.

pub fn to_cedar_schema(&self) -> Result<String, String>

Converts a ValidatorSchema into a Cedar schema string. This first converts to JSON schema format and then to Cedar syntax.

impl ValidatorSchema

pub fn new( entity_types: impl IntoIterator<Item = ValidatorEntityType>, action_ids: impl IntoIterator<Item = ValidatorActionId>, ) -> Self

Construct a new ValidatorSchema from a set of ValidatorEntityTypes and ValidatorActionIds.

The caller must ensure that there are no duplicate entity type names or action names in the input. Duplicates are silently collapsed (last entry wins).

pub fn common_types(&self) -> impl Iterator<Item = &LocatedCommonType>

Available on crate feature extended-schema only.

Returns an iter of common types in the schema

pub fn namespaces(&self) -> impl Iterator<Item = &LocatedNamespace>

Available on crate feature extended-schema only.

Returns an iter of validator namespaces in the schema

pub fn principals(&self) -> impl Iterator<Item = &EntityType>

Returns an iterator over every entity type that can be a principal for any action in this schema

pub fn resources(&self) -> impl Iterator<Item = &EntityType>

Returns an iterator over every entity type that can be a resource for any action in this schema

pub fn principals_for_action( &self, action: &EntityUID, ) -> Option<impl Iterator<Item = &EntityType>>

Returns an iterator over every entity type that can be a principal for action in this schema

Errors

Returns None if action is not found in the schema

pub fn resources_for_action( &self, action: &EntityUID, ) -> Option<impl Iterator<Item = &EntityType>>

Returns an iterator over every entity type that can be a resource for action in this schema

Errors

Returns None if action is not found in the schema

pub fn actions_for_principal_and_resource<'a: 'b, 'b>( &'a self, principal_type: &'b EntityType, resource_type: &'b EntityType, ) -> impl Iterator<Item = &'a EntityUID> + 'b

Returns an iterator over the actions that apply to this principal and resource type, as specified by the appliesTo block for the action in this schema.

pub fn unlinked_request_envs( &self, mode: ValidationMode, ) -> impl Iterator<Item = RequestEnv<'_>> + '_

Returns an iterator over every valid RequestEnv in the schema

pub fn ancestors<'a>( &'a self, ty: &'a EntityType, ) -> Option<impl Iterator<Item = &'a EntityType> + 'a>

Returns an iterator over all the entity types that can be a parent of ty

Errors

Returns None if the ty is not found in the schema

pub fn action_groups(&self) -> impl Iterator<Item = &EntityUID>

Returns an iterator over all the action groups defined in this schema

pub fn actions(&self) -> impl Iterator<Item = &EntityUID>

Returns an iterator over all actions defined in this schema

pub fn empty() -> ValidatorSchema

Create a ValidatorSchema without any definitions (of entity types, common types, or actions).

pub fn from_json_value(json: Value, extensions: &Extensions<'_>) -> Result<Self>

Construct a ValidatorSchema from a JSON value in the appropriate shape.

pub fn from_json_str(json: &str, extensions: &Extensions<'_>) -> Result<Self>

Construct a ValidatorSchema from a string containing JSON in the appropriate shape.

pub fn from_json_file( file: impl Read, extensions: &Extensions<'_>, ) -> Result<Self>

Construct a ValidatorSchema directly from a file containing JSON in the appropriate shape.

pub fn from_cedarschema_file<'a>( r: impl Read, extensions: &'a Extensions<'a>, ) -> Result<(Self, impl Iterator<Item = SchemaWarning> + 'a), CedarSchemaError>

Construct a ValidatorSchema directly from a file containing the Cedar schema syntax.

pub fn from_cedarschema_str<'a>( src: &str, extensions: &Extensions<'a>, ) -> Result<(Self, impl Iterator<Item = SchemaWarning> + 'a), CedarSchemaError>

Construct a ValidatorSchema from a string containing the Cedar schema syntax.

pub fn from_schema_fragments( fragments: impl IntoIterator<Item = ValidatorSchemaFragment<ConditionalName, ConditionalName>>, extensions: &Extensions<'_>, ) -> Result<ValidatorSchema>

Construct a ValidatorSchema from some number of ValidatorSchemaFragments.

pub fn get_action_id(&self, action_id: &EntityUID) -> Option<&ValidatorActionId>

Lookup the ValidatorActionId object in the schema with the given name.

pub fn get_entity_type<'a>( &'a self, entity_type_id: &EntityType, ) -> Option<&'a ValidatorEntityType>

Lookup the ValidatorEntityType object in the schema with the given name.

pub fn action_ids(&self) -> impl Iterator<Item = &ValidatorActionId>

An iterator over the ValidatorActionIds in the schema.

pub fn entity_type_names(&self) -> impl Iterator<Item = &EntityType>

An iterator over the entity type names in the schema.

pub fn entity_types(&self) -> impl Iterator<Item = &ValidatorEntityType>

An iterator over the ValidatorEntityTypes in the schema.

pub fn context_type(&self, action: &EntityUID) -> Option<&Type>

Get the Type of context expected for the given action. This always returns a closed record type.

Returns None if the action is not in the schema.

pub fn action_entities(&self) -> Result<Entities, EntitiesError>

Construct an Entity object for each action in the schema

pub fn try_validate(self) -> Result<Self, SchemaError>

Validate that a schema is well-formed according to the rules of the schema language. This is useful when the schema has been constructed directly from Rust code, without going through the JSON or Cedar schema syntax, and thus may not have been checked for well-formedness by the JSON or Cedar schema parsers.

More specifically, this checks the following:

• all entity types referenced are declared,
• all extension types in the schema are known extensions,
• entity_types does not declare actions and action_ids declares only actions,
• enum entities do not appear as descendants,
• RFC 70 shadowing rules are satisfied. Additionally, this recomputes the transitive closure computation for entity types and actions.

This does NOT check the following, which must be ensured before construction:

• duplicate entity type or action declarations (duplicates are silently collapsed by ValidatorSchema::new since it collects into a HashMap; the protobuf conversion path detects duplicates before calling new),
• that context types are records
• common type resolution

impl ValidatorSchema

pub fn from_deprecated_json_value( json: Value, extensions: &Extensions<'_>, ) -> Result<Self, SchemaError>

Construct a ValidatorSchema from a JSON value in the appropriate shape.

pub fn from_deprecated_json_str( json: &str, extensions: &Extensions<'_>, ) -> Result<Self, SchemaError>

Construct a ValidatorSchema from a string containing JSON in the appropriate shape.

pub fn from_deprecated_json_file( file: impl Read, extensions: &Extensions<'_>, ) -> Result<Self, SchemaError>

Construct a ValidatorSchema directly from a file containing JSON in the appropriate shape.

Trait Implementations

impl Clone for ValidatorSchema

fn clone(&self) -> ValidatorSchema

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ValidatorSchema

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for ValidatorSchema

impl FromStr for ValidatorSchema

Construct ValidatorSchema from a string containing a schema formatted in the Cedar schema format.

type Err = CedarSchemaError

The associated error which can be returned from parsing.

fn from_str(s: &str) -> Result<Self, Self::Err>

Parses a string s to return a value of this type.

impl PartialEq for ValidatorSchema

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl RequestSchema for ValidatorSchema

fn validate_context<'a>( &self, context: &Context, action: &EntityUID, extensions: &Extensions<'a>, ) -> Result<(), RequestValidationError>

Validate a context against a schema for a specific action

fn validate_scope_variables( &self, principal: Option<&EntityUID>, action: Option<&EntityUID>, resource: Option<&EntityUID>, ) -> Result<(), RequestValidationError>

Validate entities against a schema for a specific action

type Error = RequestValidationError

Error type returned when a request fails validation

fn validate_request( &self, request: &Request, extensions: &Extensions<'_>, ) -> Result<(), Self::Error>

Validate the given request, returning Err if it fails validation

impl TryFrom<Fragment<RawName>> for ValidatorSchema

type Error = SchemaError

The type returned in the event of a conversion error.

fn try_from(frag: Fragment<RawName>) -> Result<ValidatorSchema>

Performs the conversion.