Struct Policy

pub struct Policy { /* private fields */ }

Structure for a Policy. Includes both static policies and template-linked policies.

Implementations

impl Policy

pub fn template_id(&self) -> Option<&PolicyId>

Get the PolicyId of the Template this is linked to. If this is a static policy, this will return None.

pub fn template_links(&self) -> Option<HashMap<SlotId, EntityUid>>

Get the values this Template is linked to, expressed as a map from SlotId to EntityUid. If this is a static policy, this will return None.

pub fn effect(&self) -> Effect

Get the Effect (Permit or Forbid) for this instance

pub fn annotation(&self, key: impl AsRef<str>) -> Option<&str>

Get an annotation value of this template-linked or static policy If the annotation is present without an explicit value (e.g., @annotation), then this function returns Some(""). It returns None only when the annotation is not present.

pub fn annotations(&self) -> impl Iterator<Item = (&str, &str)>

Iterate through annotation data of this template-linked or static policy Annotations which do not have an explicit value (e.g., @annotation), are included in the iterator with the value "".

pub fn id(&self) -> &PolicyId

Get the PolicyId for this template-linked or static policy

pub fn new_id(&self, id: PolicyId) -> Self

Clone this Policy with a new PolicyId

pub fn is_static(&self) -> bool

Returns true if this is a static policy, false otherwise.

pub fn principal_constraint(&self) -> PrincipalConstraint

Get the scope constraint on this policy’s principal

pub fn action_constraint(&self) -> ActionConstraint

Get the scope constraint on this policy’s action

pub fn resource_constraint(&self) -> ResourceConstraint

Get the scope constraint on this policy’s resource

pub fn parse( id: Option<PolicyId>, policy_src: impl AsRef<str>, ) -> Result<Self, ParseErrors>

Parse a single policy. If id is Some, the policy will be given that Policy Id. If id is None, then “policy0” will be used. The behavior around None may change in the future.

This can fail if the policy fails to parse. It can also fail if a template was passed in, as this function only accepts static policies

pub fn from_json( id: Option<PolicyId>, json: Value, ) -> Result<Self, PolicyFromJsonError>

Create a Policy from its JSON representation. If id is Some, the policy will be given that Policy Id. If id is None, then “JSON policy” will be used. The behavior around None may change in the future.

let json: serde_json::Value = serde_json::json!(
       {
           "effect":"permit",
           "principal":{
           "op":"==",
           "entity":{
               "type":"User",
               "id":"bob"
           }
           },
           "action":{
           "op":"==",
           "entity":{
               "type":"Action",
               "id":"view"
           }
           },
           "resource":{
           "op":"==",
           "entity":{
               "type":"Album",
               "id":"trip"
           }
           },
           "conditions":[
           {
               "kind":"when",
               "body":{
                  ">":{
                       "left":{
                       ".":{
                           "left":{
                               "Var":"principal"
                           },
                           "attr":"age"
                       }
                       },
                       "right":{
                       "Value":18
                       }
                   }
               }
           }
           ]
       }
);
let json_policy = Policy::from_json(None, json).unwrap();
let src = r#"
  permit(
    principal == User::"bob",
    action == Action::"view",
    resource == Album::"trip"
  )
  when { principal.age > 18 };"#;
let text_policy = Policy::parse(None, src).unwrap();
assert_eq!(json_policy.to_json().unwrap(), text_policy.to_json().unwrap());

pub fn get_valid_request_envs( &self, s: &Schema, ) -> impl Iterator<Item = RequestEnv>

Get valid RequestEnvs. A RequestEnv is valid when the policy type checks w.r.t requests that satisfy it.

pub fn entity_literals(&self) -> Vec<EntityUid>

Get all entity literals occuring in a Policy

pub fn sub_entity_literals( &self, mapping: BTreeMap<EntityUid, EntityUid>, ) -> Result<Self, PolicyFromJsonError>

Return a new policy where all occurences of key EntityUids are replaced by value EntityUid (as a single, non-sequential substitution).

pub fn to_json(&self) -> Result<Value, PolicyToJsonError>

Get the JSON representation of this Policy.

let src = r#"
 permit(
   principal == User::"bob",
   action == Action::"view",
   resource == Album::"trip"
 )
 when { principal.age > 18 };"#;

let policy = Policy::parse(None, src).unwrap();
println!("{}", policy);
// convert the policy to JSON
let json = policy.to_json().unwrap();
println!("{}", json);
assert_eq!(json, Policy::from_json(None, json.clone()).unwrap().to_json().unwrap());

pub fn unknown_entities(&self) -> HashSet<EntityUid>

Available on crate feature partial-eval only.

Get all the unknown entities from the policy

This feature is experimental. For more information see https://github.com/cedar-policy/rfcs/blob/main/README.md#experimental-features

Trait Implementations

impl Clone for Policy

fn clone(&self) -> Policy

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Policy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for Policy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl FromStr for Policy

fn from_str(policy: &str) -> Result<Self, Self::Err>

Create a policy

Important note: Policies have ids, but this interface does not allow them to be set. It will use the default “policy0”, which may cause id conflicts if not handled. Use Policy::parse to set the id when parsing, or Policy::new_id to clone a policy with a new id.

type Err = ParseErrors

The associated error which can be returned from parsing.

impl PartialEq for Policy

fn eq(&self, other: &Self) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Eq for Policy