🥮 mooncakes.io
README

jaredzhou/mooncedar/ast does not have a README file

#
ValidationError

source
pub(all) suberror ValidationError {
  ValidationError(String, String)
} derive(
Debug)

Validation error with a message and the offending policy id.

#
Annotation

source
pub(all) struct Annotation {
  key : String
  value : String
} derive(Eq, 
Debug)

Annotation — key-value metadata attached to a policy. Has no effect on policy evaluation.

#
BinaryOp

source
pub(all) enum BinaryOp {
  Eq
  Ne
  Less
  LessEq
  Gt
  Ge
  Add
  Sub
  Mul
  In_
  Contains
  ContainsAll
  ContainsAny
} derive(Eq, 
Debug)

Built-in binary operators.

#
Condition

source
pub(all) struct Condition {
  kind : ConditionKind
  body : Expr
} derive(Eq, 
Debug)

#
ConditionKind

source
pub(all) enum ConditionKind {
  When
  Unless
} derive(Eq, 
Debug)

#
Entity

source
pub(all) struct Entity {
  uid : EntityUID
  attrs : Map[String, Value]
  tags : Map[String, Value]
  parents : Array[EntityUID]
} derive(Eq, 
Debug)

An entity as provided by the application. Contains attributes (schema-defined), tags (free-form), and parent relationships for hierarchy traversal (in operator).
impl ToJson for Entity
impl FromJson for Entity

#
EntityType

source

An entity type name, e.g. User, Photo.

#
EntityUID

source
pub(all) struct EntityUID {
  type_ : String
  id : String
} derive(Eq, Hash, 
Debug)

A unique entity identifier, e.g. User::"alice".
impl ToJson for EntityUID

#
Expr

source
pub(all) enum Expr {
  Lit(Literal)
  Var(VarKind)
  If(Expr, Expr, Expr)
  And(Expr, Expr)
  Or(Expr, Expr)
  UnaryApp(UnaryOp, Expr)
  BinaryApp(BinaryOp, Expr, Expr)
  GetAttr(Expr, String)
  HasAttr(Expr, String)
  GetTag(Expr, Expr)
  HasTag(Expr, Expr)
  Like(Expr, Pattern)
  Is(Expr, EntityType)
  Set(Array[Expr])
  Record(Array[(String, Expr)])
  ExtensionApp(Name, Array[Expr])
  Slot(String)
  Unknown(String, Type?)
} derive(Eq, 
Debug)

The complete expression AST for Cedar. Covers every node type from the Cedar language specification.

#
Expr::access

source
fn Expr::access(self : Expr, attr : String) -> Expr

self.attr

#
Expr::add

source
fn Expr::add(self : Expr, rhs : Expr) -> Expr

self + rhs

#
Expr::and_

source
fn Expr::and_(self : Expr, rhs : Expr) -> Expr

self && rhs (keyword: and)

#
Expr::contains

source
fn Expr::contains(self : Expr, rhs : Expr) -> Expr

self.contains(rhs)

#
Expr::contains_all

source
fn Expr::contains_all(self : Expr, rhs : Expr) -> Expr

self.contains_all(rhs)

#
Expr::contains_any

source
fn Expr::contains_any(self : Expr, rhs : Expr) -> Expr

self.contains_any(rhs)

#
Expr::eq

source
fn Expr::eq(self : Expr, rhs : Expr) -> Expr

self == rhs

#
Expr::ge

source
fn Expr::ge(self : Expr, rhs : Expr) -> Expr

self >= rhs

#
Expr::get_tag

source
fn Expr::get_tag(self : Expr, tag : Expr) -> Expr

self.get_tag(tag)

#
Expr::gt

source
fn Expr::gt(self : Expr, rhs : Expr) -> Expr

self > rhs

#
Expr::has

source
fn Expr::has(self : Expr, attr : String) -> Expr

self has attr

#
Expr::has_tag

source
fn Expr::has_tag(self : Expr, tag : Expr) -> Expr

self.has_tag(tag)

#
Expr::in_

source
fn Expr::in_(self : Expr, rhs : Expr) -> Expr

self in rhs (keyword: in)

#
Expr::is_

source
fn Expr::is_(self : Expr, ty : EntityType) -> Expr

self is EntityType (keyword: is)

#
Expr::is_in

source
fn Expr::is_in(self : Expr, ty : EntityType, entity : Expr) -> Expr

self is ty AND self in entity — desugared to and_ + is_ + in_

#
Expr::le

source
fn Expr::le(self : Expr, rhs : Expr) -> Expr

self <= rhs

#
Expr::like

source
fn Expr::like(self : Expr, pattern : Pattern) -> Expr

self like pattern

#
Expr::lt

source
fn Expr::lt(self : Expr, rhs : Expr) -> Expr

self < rhs

#
Expr::mul

source
fn Expr::mul(self : Expr, rhs : Expr) -> Expr

self * rhs

#
Expr::ne

source
fn Expr::ne(self : Expr, rhs : Expr) -> Expr

self != rhs

#
Expr::or_

source
fn Expr::or_(self : Expr, rhs : Expr) -> Expr

self || rhs (keyword: or)

#
Expr::sub

source
fn Expr::sub(self : Expr, rhs : Expr) -> Expr

self - rhs

#
Literal

source
pub(all) enum Literal {
  Bool(Bool)
  Long(Int64)
  String(String)
  EntityUID(EntityUID)
} derive(Eq, 
Debug)

A literal value that can appear directly in Cedar source text. Set and Record are NOT literals — they are compound expressions.

#
Name

source
pub(all) struct Name {
  ns : Array[String]
  name : String
} derive(Eq, ToJson, 
Debug, 
FromJson)

A namespaced path for extension functions, e.g. ip, decimal.

#
PartialValue

source
pub(all) enum PartialValue {
  Value(Value)
  Residual(Expr)
} derive(Eq, 
Debug)

Result of evaluating an expression — either a concrete value or a residual expression that could not be reduced (partial evaluation).

Also used as the value type in Entity attrs/tags, because entity attributes and tags can be unknown during partial evaluation (source #5 of Unknown).

#
Pattern

source
pub(all) struct Pattern {
  elements : Array[PatternElem]
} derive(Eq, 
Debug)

Pattern for the like operator (IAM-style StringLike). The wildcard * matches any string; \* matches a literal *.

#
PatternElem

source
pub(all) enum PatternElem {
  Char(Char)
  Wildcard
} derive(Eq, 
Debug)

#
Policy

source
pub(all) struct Policy {
  id : String
  effect : PolicyEffect
  annotations : Array[Annotation]
  principal : ScopeConstraint
  action : ScopeConstraint
  resource : ScopeConstraint
  conditions : Array[Condition]
} derive(Eq, 
Debug)

A complete Cedar policy.

#
Policy::action_eq

source
fn Policy::action_eq(self : Policy, type_ : String, id : String) -> Policy

#
Policy::action_in

source
fn Policy::action_in(self : Policy, type_ : String, id : String) -> Policy

#
Policy::action_in_set

source
fn Policy::action_in_set(self : Policy, entities : Array[(String, String)]) -> Policy

#
Policy::annotate

source
fn Policy::annotate(self : Policy, key : String, value : String) -> Policy

#
Policy::forbid

source
fn Policy::forbid(self : Policy) -> Policy

#
Policy::permit

source
fn Policy::permit(self : Policy) -> Policy

#
Policy::principal_eq

source
fn Policy::principal_eq(self : Policy, type_ : String, id : String) -> Policy

#
Policy::principal_in

source
fn Policy::principal_in(self : Policy, type_ : String, id : String) -> Policy

#
Policy::principal_is

source
fn Policy::principal_is(self : Policy, type_ : String) -> Policy

#
Policy::principal_is_in

source
fn Policy::principal_is_in(self : Policy, ty : String, parent_ty : String, parent_id : String) -> Policy

#
Policy::resource_eq

source
fn Policy::resource_eq(self : Policy, type_ : String, id : String) -> Policy

#
Policy::resource_in

source
fn Policy::resource_in(self : Policy, type_ : String, id : String) -> Policy

#
Policy::resource_is

source
fn Policy::resource_is(self : Policy, type_ : String) -> Policy

#
Policy::resource_is_in

source
fn Policy::resource_is_in(self : Policy, ty : String, parent_ty : String, parent_id : String) -> Policy

#
Policy::unless

source
fn Policy::unless(self : Policy, body : Expr) -> Policy

#
Policy::when_

source
fn Policy::when_(self : Policy, body : Expr) -> Policy

#
Policy::with_id

source
fn Policy::with_id(self : Policy, id : String) -> Policy

#
PolicyEffect

source
pub(all) enum PolicyEffect {
  Permit
  Forbid
} derive(Eq, 
Debug)

#
Position

source
pub(all) struct Position {
  filename : String
  offset : Int
  line : Int
  column : Int
} derive(Eq, 
Debug)

Source position for diagnostics / error messages.

#
ScopeConstraint

source
pub(all) enum ScopeConstraint {
  All
  Eq(EntityUID)
  In(EntityUID)
  InSet(Array[EntityUID])
  Is(EntityType)
  IsIn(EntityType, EntityUID)
} derive(Eq, 
Debug)

Scope constraint for principal, action, or resource in a policy.

Not every variant is valid for every PARC position:
  • Principal: All | Eq | In | Is | IsIn
  • Action: All | Eq | In | InSet
  • Resource: All | Eq | In | Is | IsIn

#
Type

source
pub(all) enum Type {
  Bool
  Long
  String
  Set
  Record
  Entity(EntityType)
  Extension(Name)
} derive(Eq, 
Debug)

The runtime type of a Cedar value. Two entity types are equal iff they have the same Name. Two extension types are equal iff they have the same Name.

#
UnaryOp

source
pub(all) enum UnaryOp {
  Not
  Neg
  IsEmpty
} derive(Eq, 
Debug)

Built-in unary operators.

#
Value

source
pub(all) enum Value {
  Bool(Bool)
  Long(Int64)
  String(String)
  EntityUID(EntityUID)
  Set(Array[Value])
  Record(Map[String, Value])
  Extension(Name, String)
} derive(Eq, ToJson, 
Debug, 
FromJson)

All values that can be the dynamic result of evaluating an Expr. Includes extension values (ip, decimal, datetime, duration, etc.) as opaque Extension(Name, String) entries for MVP.

#
VarKind

source
pub(all) enum VarKind {
  Principal
  Action
  Resource
  Context
} derive(Eq, 
Debug)

The four PARC variables that Cedar expressions can reference.

#
action

source
fn action() -> Expr

#
bool

source
fn bool(b : Bool) -> Expr

#
context

source
fn context() -> Expr

#
default

source
fn default() -> Policy

Return a zero-valued Policy with Permit effect, All scopes, empty arrays.

#
entity_type

source
fn entity_type(name : String) -> EntityType

Construct an EntityType newtype in builder contexts.

#
entity_uid

source
fn entity_uid(type_ : String, id : String) -> EntityUID

Construct an EntityUID in builder contexts.

#
euid

source
fn euid(type_ : String, id : String) -> Expr

#
ext_call

source
fn ext_call(name : Name, args : Array[Expr]) -> Expr

#
if_

source
fn if_(cond : Expr, t : Expr, e : Expr) -> Expr

#
is_empty

source
fn is_empty(e : Expr) -> Expr

#
long

source
fn long(l : Int64) -> Expr

#
neg

source
fn neg(e : Expr) -> Expr

#
not_

source
fn not_(e : Expr) -> Expr

#
principal

source
fn principal() -> Expr

#
record

source
fn record(pairs : Array[(String, Expr)]) -> Expr

#
resource

source
fn resource() -> Expr

#
set

source
fn set(elements : Array[Expr]) -> Expr

#
str

source
fn str(s : String) -> Expr

#
unknown

source
fn unknown(name : String, typ? : Type) -> Expr

Convenience constructor for Unknown. Call unknown("x") for an untyped unknown, or unknown("x", typ=EntityType("User")) for a typed one.

#
validate_policies

source
fn validate_policies(policies : Array[Policy]) -> Unit raise ValidationError

Validate all policies in a policy set. Raises on the first invalid policy found.

#
validate_policy

source
fn validate_policy(policy : Policy) -> Unit raise ValidationError

Validate a single policy's scope constraints.

PositionValid variantsInvalid
PrincipalAll, Eq, In, Is, IsInInSet
ActionAll, Eq, In, InSetIs, IsIn
ResourceAll, Eq, In, Is, IsInInSet

Source Files

Powered by MoonBit

Site sourceReport issuePackagesBuild queueSkillsStatistics

© 2026 mooncakes.io