mooncakes.io

ast
→
evaluator
→
parser
→
README
U
Condition
U
Context
U
Entity
U
EntityType
U
EntityUID
U
EntityUIDEntry
U
EvalError
U
Expr
U
ParseError
U
PartialValue
U
Policy
U
PolicyEffect
U
Request
U
ScopeConstraint
U
Type
U
Value
T
AuthorizationResult
T
Decision
T
DecisionRecord
T
DiagnosticError
T
DiagnosticReason
T
MapEntityStore
T
PartialAuthorizationAnswer
- ::concretizePartialAuthorizationAnswer::concretize
- ::reauthorizePartialAuthorizationAnswer::reauthorize
T
RequestJSON
- ::to_requestRequestJSON::to_request
T
ResidualRecord
V
action
V
bool
V
cedar_entity_from_json
V
cedar_value_from_json
V
cedar_value_from_object
V
context
V
default_policy
V
entity_type
V
entity_uid
V
euid
V
eval_expr
V
evaluate
V
ext_call
V
if_
V
is_authorized
V
is_empty
V
long
V
neg
V
new_map_store
V
not_
V
parse_policies
V
principal
V
record
V
resource
V
set
V
str
V
stringify
V
stringify_expr
V
to_request_json
V
unknown
V
value_to_expr

README

jaredzhou/mooncedar/evaluator does not have a README file

#
EntityStore

pub(open) trait EntityStore {
  fn get_entity(Self, @jaredzhou/mooncedar/ast.EntityUID
EntityUID) -> @jaredzhou/mooncedar/ast.Entity
Entity?
}

Pluggable entity storage. Implement this trait to provide entity lookups from any backing store (in-memory Map, database, cache, etc.).

#
EvalError

source

pub(all) suberror EvalError {
  TypeMismatch(String)
  IntegerOverflow
  EntityNotFound(String)
  InvalidOperator(String)
  ExtensionNotSupported(String)
  SlotNotSupported
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

Errors that can occur during expression evaluation.

#
Context

source

pub(all) enum Context {
  Concrete(@jaredzhou/mooncedar/ast.Value
Value)
  Unknown
  Partial(@jaredzhou/mooncedar/ast.Expr
Expr)
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

Request context — three states matching Rust's CPE:

Concrete(Value::Record(...)): fully known context
Unknown(Expr): entirely unknown (e.g., Expr::Unknown("context", None))
Partial(Expr): partially known, containing an Expr::Record where individual fields may be Expr::Unknown nodes.

#
Dereference

source

pub(all) enum Dereference {
  Data(@jaredzhou/mooncedar/ast.Entity
Entity)
  NoSuchEntity
  Residual(@jaredzhou/mooncedar/ast.Expr
Expr)
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

Result of looking up an entity in the store.

#
EntityUIDEntry

source

pub(all) enum EntityUIDEntry {
  Concrete(@jaredzhou/mooncedar/ast.EntityUID
EntityUID)
  Unknown(@jaredzhou/mooncedar/ast.EntityType
EntityType)
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

A PARC slot: either a known EntityUID (concrete eval) or a typed Unknown (partial eval).

#
Request

source

pub(all) struct Request {
  principal : EntityUIDEntry
  action : EntityUIDEntry
  resource : EntityUIDEntry
  context : Context
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

The PARC authorization request.

#
concrete_context

source

fn concrete_context(value : @jaredzhou/mooncedar/ast.Value
Value) -> Context

construct a concrete Context from a Value.

#
concrete_uid

source

fn concrete_uid(type_ : String, id : String) -> EntityUIDEntry

Helper: construct a concrete EntityUIDEntry.

#
eval_binary

source

fn eval_binary(op : @jaredzhou/mooncedar/ast.BinaryOp
BinaryOp, lhs : @jaredzhou/mooncedar/ast.Value
Value, rhs : @jaredzhou/mooncedar/ast.Value
Value) -> @jaredzhou/mooncedar/ast.Value
Value raise EvalError

Evaluate a binary operator on two concrete values. Does NOT handle In_ — that requires EntityStore access and is handled in expr_eval.mbt.

#
eval_expr

source

fn[S : EntityStore] eval_expr(expr : @jaredzhou/mooncedar/ast.Expr
Expr, req : Request, store : S) -> @jaredzhou/mooncedar/ast.PartialValue
PartialValue raise EvalError

Evaluate a Cedar expression in the context of a Request and EntityStore. Returns Value(concrete) for fully-reducible expressions, or Residual(expr) for expressions that cannot be fully reduced (partial evaluation).

#
eval_policy

source

fn[S : EntityStore] eval_policy(p : @jaredzhou/mooncedar/ast.Policy
Policy, req : Request, store : S) -> @jaredzhou/mooncedar/ast.PartialValue
PartialValue raise EvalError

Evaluate a single policy against a Request and EntityStore. Returns: Value(Bool(true)) — policy satisfied (scope matched, all conditions passed) Value(Bool(false)) — policy not satisfied (scope didn't match, or condition failed) Residual(Expr) — partial eval: scope matched but some conditions are residual raise EvalError — evaluation error

#
eval_unary

source

fn eval_unary(op : @jaredzhou/mooncedar/ast.UnaryOp
UnaryOp, arg : @jaredzhou/mooncedar/ast.Value
Value) -> @jaredzhou/mooncedar/ast.Value
Value raise EvalError

Evaluate a unary operator on a concrete value.

#
is_descendant

source

fn[S : EntityStore] is_descendant(uid : @jaredzhou/mooncedar/ast.EntityUID
EntityUID, ancestor : @jaredzhou/mooncedar/ast.EntityUID
EntityUID, store : S) -> Bool

Check if uid is equal to or a descendant of ancestor in the entity hierarchy. Uses BFS to traverse parent chains.

#
partial_context

source

fn partial_context(expr : @jaredzhou/mooncedar/ast.Expr
Expr) -> Context

construct a partial Context from an Expr.

#
scope_match

source

fn[S : EntityStore] scope_match(sc : @jaredzhou/mooncedar/ast.ScopeConstraint
ScopeConstraint, uid : @jaredzhou/mooncedar/ast.EntityUID
EntityUID, store : S) -> Bool

Check whether a scope constraint matches the given entity variable.

#
sub_long

source

fn sub_long(lhs : @jaredzhou/mooncedar/ast.Value
Value, rhs : @jaredzhou/mooncedar/ast.Value
Value) -> @jaredzhou/mooncedar/ast.Value
Value raise EvalError

#
unknown_context

source

fn unknown_context() -> Context

construct an unknown Context.

#
unknown_uid

source

fn unknown_uid(type_ : String) -> EntityUIDEntry

construct a unknown EntityUIDEntry.

#
value_to_expr

source

fn value_to_expr(v : @jaredzhou/mooncedar/ast.Value
Value) -> @jaredzhou/mooncedar/ast.Expr
Expr

Convert a concrete Value back into an Expr (inverse of lit_to_value).

#
wildcard_match

source

fn wildcard_match(text : String, pattern : @jaredzhou/mooncedar/ast.Pattern
Pattern) -> Bool

Match a string against a Cedar like-pattern. * matches any sequence of characters (including empty). \* matches a literal * (already parsed as PatternElem::Char('*')).

Uses two-pointer backtracking: on Wildcard, record the star position and advance the text pointer; on mismatch, backtrack to the last star.