Struct cedar_policy::Policy

pub struct Policy { /* private fields */ }

Structure for a Policy. Includes both static policies and template-linked policies.

Implementations

impl Policy

pub fn template_id(&self) -> Option<&PolicyId>

Get the PolicyId of the Template this is linked to. If this is a static policy, this will return None.

pub fn template_links(&self) -> Option<HashMap<SlotId, EntityUid>>

Get the values this Template is linked to, expressed as a map from SlotId to EntityUid. If this is a static policy, this will return None.

pub fn effect(&self) -> Effect

Get the Effect (Permit or Forbid) for this instance

pub fn annotation(&self, key: impl AsRef<str>) -> Option<&str>

Get an annotation value of this template-linked or static policy

pub fn annotations(&self) -> impl Iterator<Item = (&str, &str)>

Iterate through annotation data of this template-linked or static policy

pub fn id(&self) -> &PolicyId

Get the PolicyId for this template-linked or static policy

pub fn new_id(&self, id: PolicyId) -> Self

Clone this Policy with a new PolicyId

pub fn is_static(&self) -> bool

Returns true if this is a static policy, false otherwise.

pub fn principal_constraint(&self) -> PrincipalConstraint

Get the scope constraint on this policy’s principal

pub fn action_constraint(&self) -> ActionConstraint

Get the scope constraint on this policy’s action

pub fn resource_constraint(&self) -> ResourceConstraint

Get the scope constraint on this policy’s resource

pub fn parse( id: Option<String>, policy_src: impl AsRef<str> ) -> Result<Self, ParseErrors>

Parse a single policy. If id is Some, the policy will be given that Policy Id. If id is None, then “policy0” will be used. The behavior around None may change in the future.

This can fail if the policy fails to parse. It can also fail if a template was passed in, as this function only accepts static policies

pub fn from_json( id: Option<PolicyId>, json: Value ) -> Result<Self, FromJsonError>

Create a Policy from its JSON representation. If id is Some, the policy will be given that Policy Id. If id is None, then “JSON policy” will be used. The behavior around None may change in the future.

let json: serde_json::Value = serde_json::json!(
       {
           "effect":"permit",
           "principal":{
           "op":"==",
           "entity":{
               "type":"User",
               "id":"bob"
           }
           },
           "action":{
           "op":"==",
           "entity":{
               "type":"Action",
               "id":"view"
           }
           },
           "resource":{
           "op":"==",
           "entity":{
               "type":"Album",
               "id":"trip"
           }
           },
           "conditions":[
           {
               "kind":"when",
               "body":{
                  ">":{
                       "left":{
                       ".":{
                           "left":{
                               "Var":"principal"
                           },
                           "attr":"age"
                       }
                       },
                       "right":{
                       "Value":18
                       }
                   }
               }
           }
           ]
       }
);
let json_policy = Policy::from_json(None, json).unwrap();
let src = r#"
  permit(
    principal == User::"bob",
    action == Action::"view",
    resource == Album::"trip"
  )
  when { principal.age > 18 };"#;
let text_policy = Policy::parse(None, src).unwrap();
assert_eq!(json_policy.to_json().unwrap(), text_policy.to_json().unwrap());

pub fn to_json(&self) -> Result<Value, impl Diagnostic>

Get the JSON representation of this Policy.

let src = r#"
 permit(
   principal == User::"bob",
   action == Action::"view",
   resource == Album::"trip"
 )
 when { principal.age > 18 };"#;

let policy = Policy::parse(None, src).unwrap();
println!("{}", policy);
// convert the policy to JSON
let json = policy.to_json().unwrap();
println!("{}", json);
assert_eq!(json, Policy::from_json(None, json.clone()).unwrap().to_json().unwrap());

pub fn unknown_entities(&self) -> HashSet<EntityUid>

Available on crate feature partial-eval only.

Get all the unknown entities from the policy

This feature is experimental. For more information see https://github.com/cedar-policy/rfcs/blob/main/README.md#experimental-features

Trait Implementations

impl Clone for Policy

fn clone(&self) -> Policy

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Policy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for Policy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl FromStr for Policy

fn from_str(policy: &str) -> Result<Self, Self::Err>

Create a policy

Important note: Policies have ids, but this interface does not allow them to be set. It will use the default “policy0”, which may cause id conflicts if not handled. Use Policy::parse to set the id when parsing, or Policy::new_id to clone a policy with a new id.

type Err = ParseErrors

The associated error which can be returned from parsing.

impl PartialEq for Policy

fn eq(&self, other: &Self) -> bool

This method tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

This method tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Eq for Policy