treetop-core 0.0.17

Core library for Treetop, a Cedar policy engine implementation.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161

use super::*;

#[test]
fn test_reload_policy() {
    let engine = engine_from_policy(TEST_POLICY);
    let request = user_request(
        "bob",
        "view",
        Resource::from_str("Photo::VacationPhoto94.jpg").unwrap(),
    );

    let before_reload = engine.evaluate(&request).unwrap();
    assert_allow(&before_reload);

    engine.reload_from_str(TEST_POLICY_WITHOUT_BOB).unwrap();

    let after_reload = engine.evaluate(&request).unwrap();
    assert_deny(&after_reload);
}

#[test]
fn test_policy_reload_during_evaluation() {
    use std::sync::Arc;
    use std::thread;
    use std::time::Duration;

    let initial_policy = r#"
        permit (
            principal == User::"alice",
            action == Action::"read",
            resource == Document::"doc1"
        );
    "#;

    let updated_policy = r#"
        permit (
            principal == User::"bob",
            action == Action::"write",
            resource == Document::"doc2"
        );
    "#;

    let engine = Arc::new(engine_from_policy(initial_policy));
    let engine_eval = Arc::clone(&engine);
    let engine_reload = Arc::clone(&engine);

    // Thread 1: Continuously evaluate
    let eval_handle = thread::spawn(move || {
        for _ in 0..100 {
            let request = Request {
                principal: Principal::User(User::new("alice", None, None)),
                action: Action::new("read", None),
                resource: Resource::new("Document", "doc1"),
            };
            let _ = engine_eval.evaluate(&request);
            thread::sleep(Duration::from_micros(10));
        }
    });

    // Thread 2: Reload policies
    let reload_handle = thread::spawn(move || {
        for _ in 0..10 {
            let _ = engine_reload.reload_from_str(updated_policy);
            thread::sleep(Duration::from_millis(1));
        }
    });

    eval_handle.join().unwrap();
    reload_handle.join().unwrap();
}

#[test]
fn test_policy_version_changes_on_reload() {
    let policy1 = r#"
        permit (
            principal == User::"alice",
            action == Action::"read",
            resource == Document::"doc1"
        );
    "#;

    let policy2 = r#"
        permit (
            principal == User::"bob",
            action == Action::"write",
            resource == Document::"doc2"
        );
    "#;

    let engine = engine_from_policy(policy1);
    let version1 = engine.current_version();

    engine.reload_from_str(policy2).unwrap();
    let version2 = engine.current_version();

    assert_ne!(version1.hash, version2.hash);
    assert_ne!(version1.loaded_at, version2.loaded_at);
}

#[test]
fn test_snapshot_immutable_after_reload() {
    let policy1 = r#"
        permit (
            principal == User::"alice",
            action == Action::"read",
            resource == Document::"doc1"
        );
    "#;

    let policy2 = r#"
        permit (
            principal == User::"bob",
            action == Action::"write",
            resource == Document::"doc2"
        );
    "#;

    let engine = engine_from_policy(policy1);
    let snapshot1 = engine.current_snapshot();
    let version1 = snapshot1.version();

    engine.reload_from_str(policy2).unwrap();

    // Old snapshot should still have old version
    let still_version1 = snapshot1.version();
    assert_eq!(version1.hash, still_version1.hash);

    // New snapshot should have new version
    let snapshot2 = engine.current_snapshot();
    let version2 = snapshot2.version();
    assert_ne!(version1.hash, version2.hash);
}

#[test]
fn test_reload_failure_preserves_snapshot_and_behavior() {
    let engine = engine_from_policy(TEST_POLICY);
    let request = user_request(
        "bob",
        "view",
        Resource::from_str("Photo::VacationPhoto94.jpg").unwrap(),
    );
    let version_before = engine.current_version();

    let decision_before = engine.evaluate(&request).unwrap();
    assert_allow(&decision_before);

    let malformed_policy = r#"
        permit (
            principal == User::"bob"
            // missing comma and remaining fields
    "#;
    let result = engine.reload_from_str(malformed_policy);
    assert!(matches!(result, Err(PolicyError::ParseError(_))));

    let version_after = engine.current_version();
    assert_eq!(version_before.hash, version_after.hash);
    assert_eq!(version_before.loaded_at, version_after.loaded_at);

    let decision_after = engine.evaluate(&request).unwrap();
    assert_allow(&decision_after);
}