Struct Template 

pub struct Template {
    pub id: PolicyID,
    pub effect: Effect,
    pub principal: PrincipalConstraint,
    pub action: ActionConstraint,
    pub resource: ResourceConstraint,
    pub annotations: BTreeMap<String, SmolStr>,
    /* private fields */
}

A Cedar policy template.

Represents a complete Cedar policy template including its scope constraints, condition clauses, and annotations. If there are no slots used, this is effectively a policy.

For example:

@id("policy0")
permit (
  principal == User::"alice",
  action == Action::"view",
  resource in Album::"vacation"
)
when { resource.public == true }
unless { context.is_blocked };

Is the following Template:

let user_alice = EntityUID {
    ty: EntityType::from_name(Name::unqualified("User").unwrap()),
    eid: SmolStr::from("alice"),
};
let action_view = EntityUID {
    ty: EntityType::from_name(Name::unqualified("Action").unwrap()),
    eid: SmolStr::from("view"),
};
let album_vacation = EntityUID {
    ty: EntityType::from_name(Name::unqualified("Album").unwrap()),
    eid: SmolStr::from("vacation"),
};
let template = Template::new(
    PolicyID(SmolStr::from("policy0")),
    Effect::Permit,
    PrincipalConstraint::Eq(EntityOrSlot::Entity(user_alice)),
    ActionConstraint::Eq(action_view),
    ResourceConstraint::In(EntityOrSlot::Entity(album_vacation)),
)
.try_with_clauses(vec![
    Clause::When(Arc::new(Expr::BinaryOp {
        op: BinaryOp::Eq,
        left: Arc::new(Expr::GetAttr {
            expr: Arc::new(Expr::Var(Var::Resource)),
            attr: SmolStr::from("public"),
        }),
        right: Arc::new(Expr::Literal(Literal::Bool(true))),
    })),
    Clause::Unless(Arc::new(Expr::GetAttr {
        expr: Arc::new(Expr::Var(Var::Context)),
        attr: SmolStr::from("is_blocked"),
    })),
])
.unwrap()
.with_annotations(BTreeMap::from([
    ("id".to_string(), SmolStr::from("policy0")),
]));

Fields

id: PolicyID

Template ID

effect: Effect

Permit or forbid

principal: PrincipalConstraint

Principal constraint

action: ActionConstraint

Action constraint

resource: ResourceConstraint

Resource constraint

annotations: BTreeMap<String, SmolStr>

Annotations (empty string for no value)

Implementations

impl Template

pub fn new( id: impl Into<PolicyID>, effect: Effect, principal: PrincipalConstraint, action: ActionConstraint, resource: ResourceConstraint, ) -> Template

Create a new policy with the given id, effect and scope. Constraints need to be added with try_with_clauses (or try_add_clause)

pub fn clauses(&self) -> &Vec<Clause>

Get a reference to the clauses of the policy

pub fn into_clauses(self) -> Vec<Clause>

Get the clauses of the policy

pub fn try_with_clauses( self, clauses: impl IntoIterator<Item = Clause>, ) -> Result<Template, PstConstructionError>

Replace all clauses on this template. Fails if any clause contains a slot or unknown.

pub fn try_add_clause( &mut self, clause: Clause, ) -> Result<(), PstConstructionError>

Append a single clause to this template. Fails if the clause contains a slot or unknown.

pub fn with_annotations( self, annotations: BTreeMap<String, SmolStr>, ) -> Template

Set the annotations on this template, replacing any existing annotations.

pub fn with_id(self, id: PolicyID) -> Template

Return a copy of this template with a new id.

pub fn link( self, vals: &HashMap<SlotId, EntityUID>, ) -> Result<StaticPolicy, PstConstructionError>

Fill in any slots in this policy using the values in vals. Performing the link operation should result in a StaticPolicy. If there are unfilled slots, this results in an Error.

pub fn slots(&self) -> HashSet<SlotId>

Get the slots used by the template

pub fn is_static(&self) -> bool

Check if the template has any slots

Trait Implementations

impl Clone for Template

fn clone(&self) -> Template

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Template

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Display for Template

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl PartialEq for Template

fn eq(&self, other: &Template) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl TryFrom<Template> for StaticPolicy

type Error = ContainsSlotError

The type returned in the event of a conversion error.

fn try_from( body: Template, ) -> Result<StaticPolicy, <StaticPolicy as TryFrom<Template>>::Error>

Performs the conversion.

impl Eq for Template

impl StructuralPartialEq for Template