cedar-policy-core

Release 4.12.0, available on crates.io

Fixed

• Fixed schema_to_json_with_resolved_types to support converting schemas that use the Action entity type as an attribute type.
  Previously this was reported as an error; it now converts to a correct JSON schema. (#2400)
• Added missing validation check when decoding a protobuf policy set that template-linked policy IDs do not collide with template IDs. (#2441)
• PolicySet::from_pst now returns an error if a map key doesn't match the id of its corresponding template or policy, instead of silently accepting the malformed input (#2444).
• For the experimental tpe feature, fixed PartialEntities::from_json_value to return an error given two entities with duplicate ids.
• Fixed issue where the derived implementations of Ord and PartialOrd for EntityUids did not order instances lexicographically by type, then by entity id (#2463, #2483).

Added

• Public syntax tree (pst) support for variadic-is-in-range feature: a variadic isInRange is modelled by a pst::Expr::VariadicOp{...} in the PST (#2380).
• For the experimental tpe feature, added functions for inspecting partial evaluation results. Adds TpeResponse::reason to get the ids for policies
  contributing to the authorization decision, and specific iterators to list true/false/error/residual permit/forbid policy IDs. Also adds TpeResponse::get_policy
  to lookup a partially evaluated policy by id, and TpeResponse::policy_set to retrieve all partial evaluated policies as a PolicySet.

Changed

• The experimental protobuf encode method now returns Result<Vec<u8>, EncodeError> instead of Vec<u8>. Encoding rejects expressions and schema types whose nesting depth would exceed prost's decode recursion limit, returning EncodeError::MaxDepthExceeded. This prevents a class of bugs where successfully encoded data could not be decoded.
• The experimental protobuf decoding API now validates its inputs, checking structural invariants on entities, expressions, templates, policy sets, and schemas. Additionally, Entities::decode now computes the transitive closure instead of assuming it is already computed. These changes may result in lower performance for protobuf decoding. The previous, unvalidated behavior is available via the new decode_unchecked methods (e.g., Entities::decode_unchecked) for trusted encoded data.
• For the experimental tpe feature, TpeResponse::residual_policies is updated to return only non-trivial residuals and
  TpeResponse::nontrivial_residual_policies is deprecated. The previous behavior (iterating all residuals including trivial ones)
  is available via TpeResponse::policies.
• Validating policies with Validator against a Schema with a large action set now uses substantially less peak memory and avoids redundant per-request work, especially under concurrent load. (#2439)

Install cedar-policy-cli 4.12.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/cedar-policy/cedar/releases/download/cedar-policy-cli-v4.12.0/cedar-policy-cli-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/cedar-policy/cedar/releases/download/cedar-policy-cli-v4.12.0/cedar-policy-cli-installer.ps1 | iex"

Download cedar-policy-cli 4.12.0

Fixed

• Fixed transitive closure computation for schemas with cyclic entity type hierarchies of length ≥ 3 (introduced in 4.11.0).

Full Changelog: v4.11.1...v4.11.2

Release 3.4.3, available on crates.io

Fixed

• Slot identifiers are now checked for JSON policy templates using slots in is Type in ?slot scope constraints. Loading a JSON format policy using principal is Type in ?resource or resource is Type in ?principal. (#2351)

Cedar Language Version: 3.0.0

Fixed

• Possible panic (when stack size limit reached) in Context::empty() (#524, fixed by #526)

Cedar Language Version: 3.0.0

Added

• The is operation as described in RFC 5. (#396)
• Marked the Template::from_json and Template::to_json apis as public (#458)
• New APIs to Entities to make it easy to add a collection of entities to an existing Entities structure. (#276)
• PolicySet::remove_static, PolicySet::remove_template and PolicySet::unlink to remove policies from the policy set. (#337, resolving #328)
• PolicySet::get_linked_policies to get the policies linked to a Template. (#337)
• Export the cedar_policy_core::evaluator::{EvaluationError, EvaluationErrorKind} and cedar_policy_core::authorizer::AuthorizationError error types. (#260, #271)
• ParseError::primary_source_span to get the primary source span locating an error. (#324)
• ValidationResult::validation_warnings to access non-fatal warnings returned by the validator and ValidationResult::validation_passed_without_warnings. The main validation entry point now checks for warnings previously only available through confusable_string_checker. (#404)
• Entity::new_no_attrs() which provides an infallible constructor for Entity in the case that there are no attributes. (See changes to Entity::new() below.) (#430)
• RestrictedExpression::new_entity_uid() (#442, resolving #350)
• Experimental API PolicySet::unknown_entities to collect unknown entity UIDs from a PartialResponse. (#353, resolving #321)

Changed

• Implement RFC 19, making validation slightly more strict, but more explainable. (#282)
• Implement RFC 20, disallowing duplicate keys in record values (including record literals in policies, request context, and records in entity attributes). (#375)
• Request::new() now takes an optional schema argument, and validates the request against that schema. To signal validation errors, it now returns a Result. (#393, resolving #191)
• Entities::from_*() methods now automatically add action entities present in the schema to the constructed Entities, if a schema is provided. (#360)
• Entities::from_*() methods now validate the entities against the schema, if a schema is provided. (#360)
• Entities::from_entities() and Entities::add_entities() now take an optional schema argument. (#360)
• Diagnostics::errors() now returns an iterator over AuthorizationErrors. (#260)
• Response::new() now expects a Vec<AuthorizationError> as its third argument. (#260)
• Change the semantics of equality for IP ranges. For example, ip("192.168.0.1/24") == ip("192.168.0.3/24") was previously true and is now false. The behavior of equality on single IP addresses is unchanged, and so is the behavior of .isInRange(). (#348)
• Standardize on duplicates being errors instead of last-write-wins in the JSON-based APIs in the frontend module. This also means some error types have changed. (#365, #448)
• Entity::new() now eagerly evaluates entity attributes, leading to performance improvements (particularly when entity data is reused across multiple is_authorized calls). As a result, it returns Result, because attribute evaluation can fail. (#430)
• Entities::from_json_*() also now eagerly evaluates entity attributes, and as a result returns errors when attribute evaluation fails. (#430)
• Entity::attr() now returns errors in many fewer cases (because the attribute is stored in already-evaluated form), and its error type has changed. (#430)
• Context::from_*() methods also now eagerly evaluate the Context, and as a result return errors when evaluation fails. (#430)
• Rename cedar_policy_core::est::EstToAstError to cedar_policy_core::est::FromJsonError. (#197)
• Rename cedar_policy_core::entities::JsonDeserializationError::ExtensionsError to cedar_policy_core::entities::JsonDeserializationError::ExtensionFunctionLookup. (#360)
• Rename variants in SchemaError. (#231)
• SchemaError has a new variant corresponding to errors evaluating action attributes. (#430)
• Improve schema parsing error messages when a cycle exists in the action hierarchy to includes an action which is part of the cycle (#436, resolving #416).
• <EntityId as FromStr>::Error is now Infallible instead of ParseErrors. (#372)
• Improve the Display impls for Policy and PolicySet, and add a Display impl for Template. The displayed representations now more closely match the original input, whether the input was in string or JSON form. (#167, resolving #125)
• ValidationWarning::location and ValidationWarning::to_kind_and_location now return &SourceLocation<'a> instead of &'a PolicyID, matching ValidationError::location. (#405)
• ValidationWarningKind is now non_exhaustive, allowing future warnings to be added without a breaking change. (#404)

Fixed

• Evaluation order of operand to > and >=. They now evaluate left to right, matching all other operators. This affects what error is reported when there is an evaluation error in both operands, but does not otherwise change the result of evaluation. (#402, resolving #112)
• Updated PolicySet::link to not mutate internal state when failing to link a static policy. With this fix it is possible to create a link with a policy id after previously failing to create that link with the same id from a static policy. (#412)
• Fixed schema-based parsing of entity data that includes unknowns (for the partial-eval experimental feature). (#419, resolving #418)

Removed

• Removed __expr escape from Cedar JSON formats, which has been deprecated since Cedar 1.2. (#333)
• Move ValidationMode::Permissive behind an experimental feature flag. To continue using this feature you must enable the permissive-validate feature flag. (#428)