Crate cedar_policy_validator 

Validator for Cedar policies

Modules

human_schema

typecheck

Implements typechecking for Cedar policies. Typechecking is done using the Typechecker struct by calling the typecheck_policy method given a policy.

types

Defines the type structure for typechecking and various utilities for constructing and manipulating types.

Structs

ActionEntityUID

ActionType

An action type describes a specific action entity. It also describes what kinds of entities it can be used on.

ApplySpec

The apply spec specifies what principals and resources an action can be used with. This specification can either be done through containing to entity types. The fields of this record are optional so that they can be omitted to declare that the apply spec for the principal or resource is undefined, meaning that the action can be applied to any principal or resource. This is different than providing an empty list because the empty list is interpreted as specifying that there are no principals or resources that an action applies to.

AttributesOrContext

ContextSchema

Struct which carries enough information that it can impl Core’s ContextSchema.

CoreSchema

Struct which carries enough information that it can (efficiently) impl Core’s Schema

EntityType

Entity types describe the relationships in the entity store, including what entities can be members of groups of what types, and what attributes can/should be included on entities of each type.

EntityTypeDescription

Struct which carries enough information that it can impl Core’s EntityTypeDescription

FunctionArgumentValidationError

Structure containing details about a function argument validation error.

HierarchyNotRespected

Structure containing details about a hierarchy not respected error

IncompatibleTypes

Structure containing details about an incompatible type error.

InvalidActionApplication

Structure containing details about an invalid action application error.

MultiplyDefinedFunction

Structure containing details about a multiply defined function error.

SchemaFragment

A SchemaFragment describe the types for a given instance of Cedar. SchemaFragments are composed of Entity Types and Action Types. The schema fragment is split into multiple namespace definitions, eac including a namespace name which is applied to all entity types (and the implicit Action entity type for all actions) in the schema.

SourceLocation

Represents a location in Cedar policy source.

TypeError

The structure for type errors. A type errors knows the expression that triggered the type error, as well as additional information for specific kinds of type errors.

TypeOfAttribute

Used to describe the type of a record or entity attribute. It contains a the type of the attribute and whether the attribute is required. The type is flattened for serialization, so, in JSON format, this appears as a regular type with one extra property required.

UndefinedFunction

Structure containing details about an undefined function error.

UnexpectedType

Structure containing details about an unexpected type error.

UnrecognizedActionId

Structure containing details about an unrecognized action id error.

UnrecognizedEntityType

Structure containing details about an unrecognized entity type error.

UnsafeAttributeAccess

Structure containing details about a missing attribute error.

UnsafeOptionalAttributeAccess

Structure containing details about an unsafe optional attribute error.

UnspecifiedEntityError

Structure containing details about an unspecified entity error.

ValidationError

An error generated by the validator when it finds a potential problem in a policy. The error contains a enumeration that specifies the kind of problem, and provides details specific to that kind of problem. The error also records where the problem was encountered.

ValidationResult

Contains the result of policy validation. The result includes the list of issues found by validation and whether validation succeeds or fails. Validation succeeds if there are no fatal errors. There may still be non-fatal warnings present when validation passes.

ValidationWarning

The structure for validation warnings.

Validator

Structure containing the context needed for policy validation. This is currently only the EntityTypes and ActionTypes from a single schema.

ValidatorActionId

Contains information about actions used by the validator. The contents of the struct are the same as the schema entity type structure, but the member_of relation is reversed to instead be descendants.

ValidatorEntityType

Contains entity type information for use by the validator. The contents of the struct are the same as the schema entity type structure, but the member_of relation is reversed to instead be descendants.

ValidatorNamespaceDef

A single namespace definition from the schema json processed into a form which is closer to that used by the validator. The processing includes detection of some errors, for example, parse errors in entity type names or entity type which are declared multiple times. This does not detect references to undeclared entity types because any entity type may be declared in a different fragment that will only be known about when building the complete ValidatorSchema.

ValidatorSchema

ValidatorSchemaFragment

WrongCallStyle

Structure containing details about a wrong call style error.

WrongNumberArguments

Structure containing details about a wrong number of arguments error.

Enums

ActionBehavior

ContextOrShape

HumanSchemaError

RequestValidationError

SchemaError

SchemaType

A restricted version of the Type enum containing only the types which are exposed to users.

SchemaTypeVariant

TypeErrorKind

Represents the different kinds of type errors and contains information specific to that type error kind.

UnsupportedFeature

ValidationErrorKind

Enumeration of the possible diagnostic error that could be found by the verification steps.

ValidationMode

Used to select how a policy will be validated.

ValidationWarningKind

Represents the different kinds of validation warnings and information specific to that warning. Marked as non_exhaustive to allow adding additional warnings in the future as a non-breaking change.

Functions

confusable_string_checks

Perform identifier and string safety checks.

context_schema_for_action

Since different Actions have different schemas for Context, you must specify the Action in order to get a ContextSchema.

is_builtin_type_name

Type Aliases

Result