cedar-policy

Cedar Language Version: 2.1

Fixed

• Issue #370 related to how the validator handles template-linked policies. The validator will now produce the same result for an equivalent static and template-linked policy. (#371, resolving #370)

Cedar Language Version: 2.1

Added

• Experimental API to construct queries with Unknown fields for partial evaluation.

Changed

• Improve validation error messages for access to undeclared attributes and unsafe access to optional attributes to report the target of the access. (#295)
• EntityUid's impl of FromStr is no longer marked as deprecated. (#319)

Fixed

• Issue #299 related to how partial evaluation handled conditions of if, resulting in a panic on some inputs.
• Request::principal(), Request::action(), and Request::resource() will now return None if the entities are unspecified (i.e., constructed by passing None to Request::new()). (#339)

Cedar Language Version: 2.1

Added

• New methods for EntityTypeName.
  • basename to get the basename (without namespaces).
  • namespace_components to get the namespace as an iterator over its components.
  • namespace to get the namespace as a single string.

Changed

• Some error types now carry more information about the error, with error messages updated appropriately. For instance, the RecordAttrDoesNotExist error message now contains a list of attributes that do exist.
• Improve error messages for some schema parsing errors.
  • When an entity type shape or action context is declared with type other than Record, the error message will indicated the affected entity type or action.
• Various other improvements to error messages and documentation for errors raised during policy parsing, validation, and evaluation.
• Increase precision for validating records. Previously, permit(principal, action, resource) when {{"foo": 5} has bar}; would validate. Now it will not, since we know {"foo": 5} has bar is False, and the validator will return an error for a policy that can never fire.

Removed

• Uses of deprecated __expr escapes from integration tests.

Cedar Language Version: 2.1

Fixed

• Fixed parsing of small negative decimal literals. (#1964)

Cedar Language Version: 2.1

Added

• Re-export cedar_policy_core::entities::EntitiesError.

Changed

• Improve error messages and documentation for some errors raised during policy parsing, validation, and evaluation.
• More precise "expected tokens" lists in some parse errors.

Fixed

• Issue #150 related to implicit namespaces for actions in memberOf lists in schemas. An action without an explicit namespace in a memberOf now correctly uses the default namespace. (#151)

Cedar Language Version: 2.1

Changed

• Improve error messages for some validation errors
• Improve error messages for some schema parsing errors.
  • Parsing a schema type without the "type" field will generate an error stating that "type" is a required field instead of an inscrutable error complaining about the untagged enum SchemaType.
  • Parsing a schema type with a "type" field corresponding to one of the builtin types but missing a required field for that type will generate an error stating that a required field is missing instead of claiming that it could not find "common types" definition for that builtin type.

Fixed

• Issues #73 and #74 related to schema-based parsing.
  • Detect entities with parents of an incorrect entity type.
  • Detect entities with an undeclared entity type.

Removed

• Move public API for partial evaluation behind experimental feature flag. To continue using this feature you must enable the partial-eval feature flag.

Cedar Language Version: 2.1

Fixed

• Panic in PolicySet::link() that could occur when the function was called with a policy id corresponding to a static policy. (#203)

Cedar Language Version: 2.1

Changed

• Implement RFC 9 which disallows embedded whitespace, comments, and control characters in the inputs to several Rust API functions including EntityTypeName::from_str() and EntityNamespace::from_str(), as well as in some fields of the Cedar JSON schema format (e.g., namespace declarations, entity type names), Cedar JSON entities format (e.g., entity type names, extension function names) and the Cedar JSON policy format used by Policy::from_json() (e.g., entity type names, extension function names). The risk that this may be a breaking change for some Cedar users was accepted due to the potential security ramifications; see discussion in the RFC.

Cedar Language Version: 2.0

Added

• Entities::write_to_json function to api.rs.

Cedar Language Version: 2.0

Added

• Schema::action_entities to provide access to action entities defined in a schema.

Changed

• Update cedar-policy-core dependency.

Fixed

• Resolve warning in Cargo.toml due to having both license and license-file metadata entries.

Cedar Language Version: 2.0

Fixed

• Update Cargo.toml metadata to correctly represent this crate as Apache-2.0 licensed.

Cedar Language Version: 2.0

Cedar Language Version: 2.0

Cedar Language Version: 2.0

• Initial release of cedar-policy.