adding support for linked policies in symcc#2338
Conversation
Signed-off-by: Victor Nicolet <victornl@amazon.com>
victornicolet
changed the title
Coverage ReportHead Commit: Base Commit: Download the full coverage report. Coverage of Added or Modified Lines of Rust CodeRequired coverage: 80.00% Actual coverage: 97.30% Status: PASSED ✅ Details
Coverage of All Lines of Rust CodeRequired coverage: 80.00% Actual coverage: 87.77% Status: PASSED ✅ Details
|
victornicolet
changed the title
| pub policy_format: PolicyFormat, | ||
| /// File containing template-linked policies | ||
| #[arg(short = 'k', long = "template-linked", value_name = "FILE")] | ||
| pub template_linked_file: Option<String>, |
There was a problem hiding this comment.
Do we need a separate SymccPoliciesArg now that it accepts templates links? I think I remember @katherine-hough duplicated in order to not accept templates here.
There was a problem hiding this comment.
Thanks, I should have remembered too.
| env: &RequestEnv<'_>, | ||
| schema: &Schema, | ||
| ) -> Result<Policy> { | ||
| // For linked policies, create a static equivalent by resolving slots in the |
There was a problem hiding this comment.
Could we change the model to match this? IIRC, the lean FFI layer currently does this, but it could make sense to handle this is the corresponding lean function
here, I think:
might be a larger update than i'm thinking though
There was a problem hiding this comment.
Yes the Lean FFI layer is currently doing the slot replacement.
I attempted changing that function in Lean, but it would be a large update. We can decide that it's necessary though.
Another difference between the Rust and Lean is that the Lean env doesn't get the extra information that the linked env in Rust passes. However, trying to integrate that alone in Lean doesn't seem trivial either.
There was a problem hiding this comment.
If you have a decent idea of what would be needed, can you type up an issue on cedar-spec?
3 participants
This adds support for templated-linked policies in symcc.
DRT changes: cedar-policy/cedar-spec#948
Issue #2288
Checklist for requesting a review
The change in this PR is (choose one, and delete the other options):
cedar-policy(e.g., addition of a new API).I confirm that this PR (choose one, and delete the other options):
I confirm that
cedar-spec(choose one, and delete the other options):cedar-spec, and how you have tested that your updates are correct.)I confirm that
docs.cedarpolicy.com(choose one, and delete the other options):