From a6a88a0d934c32a0d3cdbffb8228eb266e1abd68 Mon Sep 17 00:00:00 2001 From: Kesha Hietala Date: Fri, 10 Nov 2023 13:18:59 -0500 Subject: [PATCH 01/57] add json (de)serialization --- cedar-lean/DiffTest.lean | 18 ++ cedar-lean/DiffTest/Main.lean | 38 +++ cedar-lean/DiffTest/Parser.lean | 457 ++++++++++++++++++++++++++++++++ cedar-lean/lakefile.lean | 5 +- 4 files changed, 517 insertions(+), 1 deletion(-) create mode 100644 cedar-lean/DiffTest.lean create mode 100644 cedar-lean/DiffTest/Main.lean create mode 100644 cedar-lean/DiffTest/Parser.lean diff --git a/cedar-lean/DiffTest.lean b/cedar-lean/DiffTest.lean new file mode 100644 index 000000000..a8b78e532 --- /dev/null +++ b/cedar-lean/DiffTest.lean @@ -0,0 +1,18 @@ +/- + Copyright 2022-2023 Amazon.com, Inc. or its affiliates. All Rights Reserved. + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + https://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +-/ + +import DiffTest.Main +import DiffTest.Parser diff --git a/cedar-lean/DiffTest/Main.lean b/cedar-lean/DiffTest/Main.lean new file mode 100644 index 000000000..fb68fce6e --- /dev/null +++ b/cedar-lean/DiffTest/Main.lean @@ -0,0 +1,38 @@ +/- + Copyright 2022-2023 Amazon.com, Inc. or its affiliates. All Rights Reserved. + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + https://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +-/ + +import Lean.Data.Json.FromToJson + +import Cedar.Spec +import DiffTest.Parser + +/-! This file defines the public interfaces for the Lean implementation. + The input and output are stringified JSON objects. -/ + +namespace DiffTest + +open Cedar.Spec +open Cedar.Data + +@[export isAuthorizedDRT] def isAuthorizedDRT (req : String) : String := + let json := Lean.Json.parse req + let request := jsonToRequest json + let entities := jsonToEntities json + let policies := jsonToPolicies json + let json := Lean.toJson (isAuthorized request entities policies) + toString json + +end DiffTest diff --git a/cedar-lean/DiffTest/Parser.lean b/cedar-lean/DiffTest/Parser.lean new file mode 100644 index 000000000..989044524 --- /dev/null +++ b/cedar-lean/DiffTest/Parser.lean @@ -0,0 +1,457 @@ +/- + Copyright 2022-2023 Amazon.com, Inc. or its affiliates. All Rights Reserved. + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + https://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +-/ + +import Lean.Data.Json.Parser +import Lean.Data.Json.Basic +import Lean.Data.Json.FromToJson +import Lean.Data.AssocList +import Lean.Data.RBMap + +import Cedar.Data +import Cedar.Spec +import Cedar.Spec.Ext + +namespace DiffTest + +open Cedar.Spec +open Cedar.Data +open Cedar.Spec.Ext + +def unwrapExcept (e: Except String Lean.Json) : Lean.Json := match e.isOk with + | true => Option.get! e.toOption + | false => panic! "unwrapExcept: is not ok" + +def strNodeToString (node : Lean.Json) : String := match node with + | Lean.Json.str s => s + | _ => panic! "strNodeToString" + +def jsonToEUID (json : Except String Lean.Json) : EntityUID := match json.isOk with + | false => panic! "sorry" + | true => + let json := Option.get! json.toOption + let eid := (match unwrapExcept (json.getObjVal? "eid") with + | Lean.Json.str str => str + | _ => panic! json.pretty) + match json.getObjVal? "ty" with + | .error _ => { + ty := { + id := "Unspecified", + path := [] + }, + eid := eid + } + | .ok (Lean.Json.str str) => { + ty := { + id := str, + path := [] + }, + eid := eid + } + | .ok _ => + let ty := (unwrapExcept (json.getObjVal? "ty")).getObjVal? "Concrete" + let ty := Option.get! ty.toOption + match (unwrapExcept (ty.getObjVal? "id")), (unwrapExcept (ty.getObjVal? "path")) with + | Lean.Json.str id, Lean.Json.arr path_json => + let path := List.map strNodeToString path_json.toList + { + ty := { + id := id, + path := path + }, + eid := eid + } + | _,_ => panic! "sorry" + +def litHelper (json : Except String Lean.Json) : Expr := match json.isOk with + | false => panic! "litHelper: is not ok" + | true => let json := Option.get! json.toOption + match json with + | Lean.Json.bool b => .lit (.bool b) + | Lean.Json.num n => match n.exponent with + | 0 => .lit (.int n.mantissa) + | _ => panic! "litHelper: num has exponent: " ++ json.pretty + | Lean.Json.str s => .lit (.string s) + | _ => panic! "litHelper: not known format for json: " ++ json.pretty + +def handleLit (json : Except String Lean.Json) : Expr := match json.isOk with + | false => panic! "handleLit: not ok json" + | true => let json := Option.get! json.toOption + match (json.getObjVal? "Bool").isOk with + | true => litHelper (json.getObjVal? "Bool") + | false => match (json.getObjVal? "Long").isOk with + | true => litHelper (json.getObjVal? "Long") + | false => match (json.getObjVal? "String").isOk with + | true => litHelper (json.getObjVal? "String") + | false => match (json.getObjVal? "EntityUID").isOk with + | true => .lit (.entityUID (jsonToEUID (json.getObjVal? "EntityUID"))) + | false => panic! "handleLit: not known format" ++ json.pretty + +def handleWildcardObj (json : Lean.Json) : PatElem := match json with +| Lean.Json.str "Wildcard" => .star +| Lean.Json.obj _ => match (json.getObjVal? "Char") with + | .ok (Lean.Json.num n) => match n.exponent with + | 0 => .justChar (Char.ofNat (n.mantissa.toNat)) + | _ => panic! "handleWildcardObj: non zero exponent: " ++ json.pretty + | _ => panic! "handleWildcardObj: something unknown in wildcard: " ++ json.pretty +| _ => panic! "handleWildcardObj: " ++ json.pretty + +def arrayToKVPairList (json : Array Lean.Json) : Prod (List Lean.Json) (List Lean.Json) := +List.unzip (List.map (fun x => match x with + | Lean.Json.arr kv => (kv[0]!, kv[1]!) + | _ => panic! "arrayToKVPairList: " ++ x.pretty) json.toList) + +-- Need to convert JSON structure to Expr structure. We expect JSON to have format: +-- +-- "Expr": { +-- "Lit" : { "Bool" | "Long" | "String" | "EntityUID" : blah} +-- "Var" : { "Principal" | "Action" | "Resource" | "Context" } +-- "If" : {"test_expr": Expr, "then_expr": Expr, "else_expr": Expr} +-- "And" : {"left": Expr, "right": Expr} +-- "Or" : {"left": Expr, "right": Expr} +-- "UnaryApp" : {"op": UnaryOp, "arg": Expr} +-- "BinaryApp" : {"op": UnaryOp, "arg1": Expr, "arg2": Expr} +-- "GetAttr" : {"expr": Expr, "attr": String} +-- "HasAttr" : {"expr": Expr, "arg": String} +-- "Set" : {[Expr]} +-- "Record" : {"pairs": ["id": Expr]} +-- } + +/- +defined as partial to avoid writing the proof of termination, which isn't really required +as we don't need to prove correctness of the parser -- no proofs involve the parser, and +we can be confident it terminates :) +-/ +partial def jsonToExpr (json : Except String Lean.Json) : Expr := match json.isOk with + | false => panic! "sorry" + | true => + let json := Option.get! json.toOption + let json := unwrapExcept (json.getObjVal? "expr_kind") + match json with + | Lean.Json.null => panic! "sorry" + | Lean.Json.bool b => .lit (.bool b) + | Lean.Json.num n => match n.exponent with + | 0 => .lit (.int n.mantissa) + | _ => panic! "sorry" + | Lean.Json.str s => .lit (.string s) + | Lean.Json.arr _ => panic! "sorry" + | _ => + match (json.getObjVal? "Lit").isOk with + | true => handleLit (json.getObjVal? "Lit") + | false => match (json.getObjVal? "Var").isOk with + | true => + let v := unwrapExcept (json.getObjVal? "Var") + match v with + | Lean.Json.str s => match s with + | "principal" => .var .principal + | "action" => .var .action + | "resource" => .var .resource + | "context" => .var .context + | _ => panic! "unknown string in var" + | _ => panic! "var not string" + | false => match (json.getObjVal? "And").isOk with + | true => + let lhs := (unwrapExcept (json.getObjVal? "And")).getObjVal? "left" + let rhs := (unwrapExcept (json.getObjVal? "And")).getObjVal? "right" + .and (jsonToExpr lhs) (jsonToExpr rhs) + | false => match (json.getObjVal? "Or").isOk with + | true => + let lhs := (unwrapExcept (json.getObjVal? "Or")).getObjVal? "left" + let rhs := (unwrapExcept (json.getObjVal? "Or")).getObjVal? "right" + .or (jsonToExpr lhs) (jsonToExpr rhs) + | false => match (json.getObjVal? "If").isOk with + | true => + let g := (unwrapExcept (json.getObjVal? "If")).getObjVal? "test_expr" + let t := (unwrapExcept (json.getObjVal? "If")).getObjVal? "then_expr" + let e := (unwrapExcept (json.getObjVal? "If")).getObjVal? "else_expr" + .ite (jsonToExpr g) (jsonToExpr t) (jsonToExpr e) + | false => match (json.getObjVal? "UnaryApp").isOk with + | true => + let json := unwrapExcept (json.getObjVal? "UnaryApp") + match (json.getObjVal? "op").isOk, (json.getObjVal? "arg").isOk with + | true, true => + let objVal := Option.get! (json.getObjVal? "op").toOption + let arg := json.getObjVal? "arg" + match objVal with + | Lean.Json.str s => match s with + | "Not" => .unaryApp .not (jsonToExpr arg) + | "Neg" => .unaryApp .neg (jsonToExpr arg) + | _ => panic! "unknown unary op" + | _ => panic! "incorrect op for unary app" + | _ , _ => panic! "unary app does not have right fields: " ++ json.pretty + | false => match (json.getObjVal? "MulByConst").isOk with + | true => + let json := Option.get! (json.getObjVal? "MulByConst").toOption + let arg := json.getObjVal? "arg" + let constJson := unwrapExcept (json.getObjVal? "constant") + match constJson with + | Lean.Json.num n => match n.exponent with + | 0 => .unaryApp (.mulBy n.mantissa) (jsonToExpr arg) + | _ => panic! "sorry" + | _ => panic! "constant for mul by is not a numebr" + | false => match (json.getObjVal? "Like").isOk with + | true => + let json := Option.get! (json.getObjVal? "Like").toOption + let expr := jsonToExpr (json.getObjVal? "expr") + match (json.getObjVal? "pattern") with + | .ok (Lean.Json.arr arr) => .unaryApp (.like (List.map handleWildcardObj arr.toList)) expr + | _ => panic! "not an array in Like" + | false => match (json.getObjVal? "BinaryApp").isOk with + | true => + let json := unwrapExcept (json.getObjVal? "BinaryApp") + let op := unwrapExcept (json.getObjVal? "op") + let arg1 := jsonToExpr (json.getObjVal? "arg1") + let arg2 := jsonToExpr (json.getObjVal? "arg2") + match op with + | Lean.Json.str s => match s with + | "Eq" => .binaryApp .eq arg1 arg2 + | "In" => .binaryApp .mem arg1 arg2 + | "Less" => .binaryApp .less arg1 arg2 + | "LessEq" => .binaryApp .lessEq arg1 arg2 + | "Add" => .binaryApp .add arg1 arg2 + | "Sub" => .binaryApp .sub arg1 arg2 + | "Contains" => .binaryApp .contains arg1 arg2 + | "ContainsAll" => .binaryApp .containsAll arg1 arg2 + | "ContainsAny" => .binaryApp .containsAny arg1 arg2 + | _ => panic! "unknown op for binary app" + | _ => panic "op for binary app is not a string" + | false => match (json.getObjVal? "GetAttr").isOk with + | true => + let e := (unwrapExcept (json.getObjVal? "GetAttr")).getObjVal? "expr" + let wrapped_attr := (unwrapExcept (json.getObjVal? "GetAttr")).getObjVal? "attr" + match e.isOk, wrapped_attr.isOk with + | true,true => match unwrapExcept wrapped_attr with + | Lean.Json.str s => .getAttr (jsonToExpr e) s + | _ => panic! "sorry" + | _,_ => panic! "sorry" + | false => match (json.getObjVal? "HasAttr").isOk with + | true => + let e := (unwrapExcept (json.getObjVal? "HasAttr")).getObjVal? "expr" + let wrapped_attr := (unwrapExcept (json.getObjVal? "HasAttr")).getObjVal? "attr" + match e.isOk, wrapped_attr.isOk with + | true,true => match unwrapExcept wrapped_attr with + | Lean.Json.str s => .hasAttr (jsonToExpr e) s + | _ => panic! "sorry" + | _,_ => panic! "sorry" + | false => match (json.getObjVal? "Record").isOk with + | true => + let e := (unwrapExcept (json.getObjVal? "Record")).getObjVal? "pairs" + match e.isOk with + | true => + let e := (unwrapExcept e).getArr? + match e.isOk with + | true => + let e := Option.get! e.toOption + let kv := arrayToKVPairList e + let v_exprs := List.map jsonToExpr (List.map Except.ok kv.snd) + let k_strs := List.map strNodeToString kv.fst + let er : Expr := .record (List.zip k_strs v_exprs) + er + | false => panic! "sorry" + | false => panic! "sorry" + | false => match (json.getObjVal? "Set").isOk with + | true => + let e := (unwrapExcept (json.getObjVal? "Set")).getArr? + match e.isOk with + | true => + let e := Option.get! e.toOption + let es := List.map jsonToExpr (List.map Except.ok e.toList) + let exs : Expr := .set es + exs + | false => panic! "sorry" + | false => match (json.getObjVal? "ExtensionFunctionApp").isOk with + | true => + let e := (unwrapExcept (json.getObjVal? "ExtensionFunctionApp")) + let args := Option.get! ((unwrapExcept (e.getObjVal? "args")).getArr?).toOption + let args := List.map (jsonToExpr ∘ Except.ok) args.toList + let fn_name := (unwrapExcept ((unwrapExcept (e.getObjVal? "fn_name")).getObjVal? "id")).getStr? + match fn_name with + | .ok "decimal" => .call .decimal args + | .ok "lessThan" => .call .lessThan args + | .ok "lessThanOrEqual" => .call .lessThanOrEqual args + | .ok "greaterThan" => .call .greaterThan args + | .ok "greaterThanOrEqual" => .call .greaterThanOrEqual args + | .ok "ip" => .call .ip args + | .ok "isIpv4" => .call .isIpv4 args + | .ok "isIpv6" => .call .isIpv6 args + | .ok "isLoopback" => .call .isLoopback args + | .ok "isMulticast" => .call .isMulticast args + | .ok "isInRange" => .call .isInRange args + | .ok name => panic! "unknown extension function: "++name + | .error e => panic! "extension fn name error: "++e + | false => panic! json.pretty + +partial def exprToValue (expr : Expr) : Value := match expr with + | Expr.lit p => Value.prim p + | Expr.record r => Value.record (Map.mk (List.map (λ (a,ex) => (a , exprToValue ex)) r)) + | Expr.set s => Value.set (Set.mk (List.map exprToValue s)) + | Expr.call ty arg => match ty, arg with + | .decimal, [.lit (.string s)] => match Decimal.decimal s with + | .some v => .ext (.decimal v) + | .none => panic! "could not parse decimal" + | .ip, [.lit (.string s)] => match IPAddr.ip s with + | .some v => .ext (.ipaddr v) + | .none => panic! "could not parse ip" + | _,_ => panic! "unexpected extension function in exprToValue" + | _ => panic! toString (repr expr) + +def jsonToValue (json : Except String Lean.Json) : Value := match json.isOk with + | false => panic! "sorry" + | true => + (exprToValue ∘ jsonToExpr) json + +def jsonToContext (json : Except String Lean.Json) : Map Attr Value := match json.isOk with + | false => panic! "sorry" + | true => + let json := Option.get! json.toOption + let pairs_arr := unwrapExcept ((unwrapExcept (json.getObjVal? "expr_kind")).getObjVal? "Record") + match unwrapExcept (pairs_arr.getObjVal? "pairs") with + | Lean.Json.arr pairs_json => + let kvs := arrayToKVPairList pairs_json + let keys := List.map strNodeToString kvs.fst + let vals := List.map (jsonToValue ∘ Except.ok) kvs.snd + Map.mk (List.zip keys vals) + | _ => panic! "sorry" + +partial def jsonToRequest (json : Except String Lean.Json) : Request := match json.isOk with + | false => panic! "sorry" + | true => + let json := Option.get! json.toOption + let json := unwrapExcept (json.getObjVal? "request") + let principal := jsonToEUID ((unwrapExcept (json.getObjVal? "principal")).getObjVal? "Concrete") + let action := jsonToEUID ((unwrapExcept (json.getObjVal? "action")).getObjVal? "Concrete") + let resource := jsonToEUID ((unwrapExcept (json.getObjVal? "resource")).getObjVal? "Concrete") + let context := (jsonToContext ∘ json.getObjVal?) "context" + { + principal := principal, + action := action, + resource := resource, + context := context + } + +def jsonToEntityData (json : Except String Lean.Json) : EntityData := match json.isOk with +| false => panic! "sorry" +| true => + let json := Option.get! json.toOption + let ancestors_json := unwrapExcept (json.getObjVal? "ancestors") + let ancestors := match ancestors_json with + | Lean.Json.arr arr => Set.mk (List.map (jsonToEUID ∘ Except.ok) arr.toList) + | _ => Set.empty + let attrs_json := unwrapExcept (json.getObjVal? "attrs") + let attrs := match attrs_json with + | Lean.Json.obj obj => + let pairs := (obj.fold (fun l s j => (s,j) :: l) []) + let keys := List.map Prod.fst pairs + let vals := List.map (exprToValue ∘ jsonToExpr ∘ Except.ok ∘ Prod.snd) pairs + Map.mk (List.zip keys vals) + | _ => panic! "uh oh" + { + ancestors := ancestors, + attrs := attrs + } + +def jsonToEntities (json : Except String Lean.Json) : Entities := match json.isOk with +| false => panic! "sorry" +| true => + let json := Option.get! json.toOption + let json := unwrapExcept (json.getObjVal? "entities") + let entities := unwrapExcept (json.getObjVal? "entities") + match entities with + | Lean.Json.arr arr => + let vs := (arrayToKVPairList arr).snd + let entityid := List.map (fun x => jsonToEUID (x.getObjVal? "uid")) vs + let entitydata := List.map (jsonToEntityData ∘ Except.ok) vs + Map.mk (List.zip entityid entitydata) + | _ => panic! "sorry" + +def strToScopeAny (str : String) : Scope := match str with +| "Any" => .any +| _ => panic! "sorry" + +def jsonToArgedScopePR (json : Lean.Json) (isEq : Bool) (isActionScope : Bool) : Scope := + let euidJson := if isActionScope then json else unwrapExcept (json.getObjVal? "EUID") + let euid := jsonToEUID (Except.ok euidJson) + if isEq then .eq euid else .mem euid + +def jsonToActionInAnyListEUID (json : Lean.Json) : List EntityUID := match json.getArr? with +| .ok arr => List.map (jsonToEUID ∘ Except.ok) arr.toList +| .error _ => panic! "sorry" + +def jsonToPolicy (json : Except String Lean.Json) : Policy := match json.isOk with + | false => panic! "sorry" + | true => + let json := Option.get! json.toOption + let idJson := unwrapExcept (json.getObjVal? "id") + let id := match idJson.getStr? with + | .ok str => str + | _ => panic! "sorry" + let effectJson := unwrapExcept (json.getObjVal? "effect") + let effect := match effectJson.getStr? with + | .ok str => match str with + | "permit" => Effect.permit + | "forbid" => Effect.forbid + | _ => panic! "sorry" + | .error _ => panic! "sorry" + let principalConstraintWrapped := unwrapExcept (json.getObjVal? "principal_constraint") + let principalConstraintJson := unwrapExcept (principalConstraintWrapped.getObjVal? "constraint") + let principalConstraint := match principalConstraintJson.getStr? with + | .ok str => .principalScope (strToScopeAny str) + | .error _ => match principalConstraintJson.getObjVal? "Eq" with + | .ok eqObj => .principalScope (jsonToArgedScopePR eqObj true false) + | .error _ => match principalConstraintJson.getObjVal? "In" with + | .ok inObj => .principalScope (jsonToArgedScopePR inObj false false) + | _ => panic! "sorry" + let actionConstraintJson := unwrapExcept (json.getObjVal? "action_constraint") + let actionConstraint := match actionConstraintJson.getStr? with + | .ok str => .actionScope (strToScopeAny str) + | .error _ => match actionConstraintJson.getObjVal? "Eq" with + | .ok eqObj => .actionScope (jsonToArgedScopePR eqObj true true) + | .error _ => match actionConstraintJson.getObjVal? "In" with + | .ok inObj => match inObj.getArr? with + | .ok _ => .actionInAny (jsonToActionInAnyListEUID inObj) + | .error _ => .actionScope (jsonToArgedScopePR inObj false true) + | _ => panic! "sorry" + let resourceConstraintWrapped := unwrapExcept (json.getObjVal? "resource_constraint") + let resourceConstraintJson := unwrapExcept (resourceConstraintWrapped.getObjVal? "constraint") + let resourceConstraint := match resourceConstraintJson.getStr? with + | .ok str => .resourceScope (strToScopeAny str) + | .error _ => match resourceConstraintJson.getObjVal? "Eq" with + | .ok eqObj => .resourceScope (jsonToArgedScopePR eqObj true false) + | .error _ => match resourceConstraintJson.getObjVal? "In" with + | .ok inObj => .resourceScope (jsonToArgedScopePR inObj false false) + | _ => panic! "sorry" + let condition := jsonToExpr (json.getObjVal? "non_head_constraints") + { + id := id + effect := effect, + principalScope := principalConstraint, + resourceScope := resourceConstraint, + actionScope := actionConstraint, + condition := condition + } + +-- for now, doesn't include policy templates. +-- a static policy is just a policy template with no blanks. +def jsonToPolicies (json : Except String Lean.Json) : Policies := match json.isOk with + | false => panic! "sorry" + | true => + let json := Option.get! json.toOption + let json := unwrapExcept (json.getObjVal? "policies") + let templates := unwrapExcept (json.getObjVal? "templates") + match templates.getObj? with + | .ok obj => List.map (jsonToPolicy ∘ Except.ok ∘ Prod.snd) (obj.fold (fun l s j => (s,j) :: l) []) + | _ => panic! "sorry" + +end DiffTest diff --git a/cedar-lean/lakefile.lean b/cedar-lean/lakefile.lean index 2e0eb5134..fcb7d6385 100644 --- a/cedar-lean/lakefile.lean +++ b/cedar-lean/lakefile.lean @@ -28,5 +28,8 @@ lean_lib Cedar where lean_lib UnitTest where defaultFacets := #[LeanLib.staticFacet] +lean_lib DiffTest where + defaultFacets := #[LeanLib.staticFacet] + lean_exe CedarUnitTests where - root := `UnitTest.Main \ No newline at end of file + root := `UnitTest.Main From fdcca0b261913a6f407c245159da1a62758b9a92 Mon Sep 17 00:00:00 2001 From: Kesha Hietala Date: Fri, 10 Nov 2023 15:37:22 -0500 Subject: [PATCH 02/57] first pass adding Lean DRT --- cedar-drt/Cargo.toml | 1 + cedar-drt/Makefile | 18 ++++ cedar-drt/build.rs | 11 ++ cedar-drt/fuzz/build.rs | 11 ++ cedar-drt/src/dafny_java_impl.rs | 8 +- cedar-drt/src/lean_impl.rs | 149 +++++++++++++++++++++++++++ cedar-drt/src/lib.rs | 4 +- cedar-drt/tests/integration_tests.rs | 7 ++ cedar-lean/DiffTest/Parser.lean | 6 +- 9 files changed, 207 insertions(+), 8 deletions(-) create mode 100644 cedar-drt/Makefile create mode 100644 cedar-drt/build.rs create mode 100644 cedar-drt/fuzz/build.rs create mode 100644 cedar-drt/src/lean_impl.rs diff --git a/cedar-drt/Cargo.toml b/cedar-drt/Cargo.toml index ee872c67d..df26838be 100644 --- a/cedar-drt/Cargo.toml +++ b/cedar-drt/Cargo.toml @@ -13,6 +13,7 @@ cedar-policy-core = { path = "../cedar/cedar-policy-core", version = "3.*", feat cedar-policy-validator = { path = "../cedar/cedar-policy-validator", version = "3.*", features = ["arbitrary"] } cedar-policy-formatter = { path = "../cedar/cedar-policy-formatter", version = "3.*" } jni = { version = "0.19.0", features = ["invocation"] } +lean-sys = { version = "0.0.5", features = ["small_allocator"], default-features = false } serde = { version = "1.0", features = ["derive"] } serde_json = "1.0" lazy_static = "1.4" diff --git a/cedar-drt/Makefile b/cedar-drt/Makefile new file mode 100644 index 000000000..45a203f74 --- /dev/null +++ b/cedar-drt/Makefile @@ -0,0 +1,18 @@ +.PHONY: all run test + +all: + cd ../cedar-lean && lake build Cedar DiffTest Std:static + LEAN_LIB_DIR=`lean --print-libdir` \ + cargo build; + LEAN_LIB_DIR=`lean --print-libdir` \ + cd fuzz && LEAN_LIB_DIR=`lean --print-libdir` cargo build + +test: all + LEAN_LIB_DIR=`lean --print-libdir` \ + cargo test + +run: all + DYLD_LIBRARY_PATH=`lean --print-libdir` \ + LD_LIBRARY_PATH=`lean --print-libdir` \ + LEAN_LIB_DIR=`lean --print-libdir` \ + cargo fuzz run -s none $(target) \ No newline at end of file diff --git a/cedar-drt/build.rs b/cedar-drt/build.rs new file mode 100644 index 000000000..d80321f57 --- /dev/null +++ b/cedar-drt/build.rs @@ -0,0 +1,11 @@ +use std::env; +fn main() { + let lean_dir = env::var("LEAN_LIB_DIR").unwrap(); + println!("cargo:rustc-link-search=native=../cedar-lean/build/lib"); + println!("cargo:rustc-link-search=native={lean_dir}"); + println!("cargo:rustc-link-search=native=../cedar-lean/lake-packages/std/build/lib"); + println!("cargo:rustc-link-search=native=../cedar-lean/lake-packages/mathlib/build/lib"); + println!("cargo:rustc-link-search=native=../cedar-lean/lake-packages/Qq/build/lib"); + println!("cargo:rustc-link-search=native=../cedar-lean/lake-packages/aesop/build/lib"); + println!("cargo:rustc-link-search=native=../cedar-lean/lake-packages/proofwidgets/build/lib"); + } \ No newline at end of file diff --git a/cedar-drt/fuzz/build.rs b/cedar-drt/fuzz/build.rs new file mode 100644 index 000000000..ae39e53da --- /dev/null +++ b/cedar-drt/fuzz/build.rs @@ -0,0 +1,11 @@ +use std::env; +fn main() { + let lean_dir = env::var("LEAN_LIB_DIR").unwrap(); + println!("cargo:rustc-link-search=native=../../cedar-lean/build/lib"); + println!("cargo:rustc-link-search=native={lean_dir}"); + println!("cargo:rustc-link-search=native=../../cedar-lean/lake-packages/std/build/lib"); + println!("cargo:rustc-link-search=native=../../cedar-lean/lake-packages/mathlib/build/lib"); + println!("cargo:rustc-link-search=native=../../cedar-lean/lake-packages/Qq/build/lib"); + println!("cargo:rustc-link-search=native=../../cedar-lean/lake-packages/aesop/build/lib"); + println!("cargo:rustc-link-search=native=../../cedar-lean/lake-packages/proofwidgets/build/lib"); + } \ No newline at end of file diff --git a/cedar-drt/src/dafny_java_impl.rs b/cedar-drt/src/dafny_java_impl.rs index 1ab2db61e..7ce1fc18c 100644 --- a/cedar-drt/src/dafny_java_impl.rs +++ b/cedar-drt/src/dafny_java_impl.rs @@ -68,10 +68,10 @@ lazy_static! { } #[derive(Debug, Serialize)] -struct RequestForDefEngine<'a> { - request: &'a ast::Request, - policies: &'a ast::PolicySet, - entities: &'a Entities, +pub struct RequestForDefEngine<'a> { + pub request: &'a ast::Request, + pub policies: &'a ast::PolicySet, + pub entities: &'a Entities, } #[derive(Debug, Serialize, Deserialize)] diff --git a/cedar-drt/src/lean_impl.rs b/cedar-drt/src/lean_impl.rs new file mode 100644 index 000000000..cf95a2b81 --- /dev/null +++ b/cedar-drt/src/lean_impl.rs @@ -0,0 +1,149 @@ +/* + * Copyright 2022-2023 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +//! Implementation of the [`CedarTestImplementation`] trait for the Cedar Lean +//! implementation. + +use core::panic; +use std::{collections::HashSet, ffi::CString}; + +use crate::cedar_test_impl::*; +use crate::dafny_java_impl::RequestForDefEngine; +use cedar_policy::frontend::is_authorized::InterfaceResponse; +use cedar_policy::integration_testing::{CustomCedarImpl, IntegrationTestValidationResult}; +pub use cedar_policy::Response; +use cedar_policy_core::ast::{Expr, Value}; +pub use cedar_policy_core::*; +pub use cedar_policy_validator::{ValidationMode, ValidationResult, ValidatorSchema}; +pub use entities::Entities; +pub use lean_sys::init::lean_initialize; +pub use lean_sys::lean_object; +pub use lean_sys::string::lean_mk_string; +use lean_sys::{lean_initialize_runtime_module, lean_io_mark_end_initialization, lean_io_mk_world}; + +/// Times for JSON (de)serialization, authorization, and validation as reported +/// by the Lean implementation. +pub const LEAN_SERIALIZATION_MSG: &str = "lean_serialization (ns) : "; +pub const LEAN_DESERIALIZATION_MSG: &str = "lean_deserialization (ns) : "; +pub const LEAN_AUTH_MSG: &str = "lean_auth (ns) : "; +pub const LEAN_VALIDATION_MSG: &str = "lean_validation (ns) : "; + +#[link(name = "Cedar")] +#[link(name = "Lean")] +#[link(name = "Std")] +extern "C" { + fn isAuthorizedDRT(req: *mut lean_object) -> *mut lean_object; + fn initialize_Cedar(builtin: i8, ob: *mut lean_object) -> *mut lean_object; +} + +pub struct LeanDefinitionalEngine {} + +impl LeanDefinitionalEngine { + pub fn new() -> Self { + Self {} + } + + fn serialize_request( + request: &ast::Request, + policies: &ast::PolicySet, + entities: &Entities, + ) -> *mut lean_object { + let request: String = serde_json::to_string(&RequestForDefEngine { + request, + policies, + entities, + }) + .expect("Failed to serialize request, policies, or entities"); + eprintln!("{request}"); + println!("{:?}", request.clone().as_ptr()); + let cstring = CString::new(request).expect("CString::new failed"); + let s = unsafe { lean_mk_string(cstring.as_ptr() as *const u8) }; + return s; + } + + fn deserialize_response(response: *mut lean_object) -> InterfaceResponse { + println!("{:?}", response); + InterfaceResponse::new(authorizer::Decision::Deny, HashSet::new(), HashSet::new()) + } + + /// Ask the definitional engine whether `isAuthorized` for the given `request`, + /// `policies`, and `entities` + pub fn is_authorized( + &self, + request: &ast::Request, + policies: &ast::PolicySet, + entities: &Entities, + ) -> InterfaceResponse { + unsafe { lean_initialize_runtime_module() }; + unsafe { lean_initialize() }; + unsafe { initialize_Cedar(1, lean_io_mk_world()) }; + unsafe { lean_io_mark_end_initialization() }; + + let req = Self::serialize_request(request, policies, entities); + let response = unsafe { isAuthorizedDRT(req) }; + Self::deserialize_response(response) + } +} + +impl CedarTestImplementation for LeanDefinitionalEngine { + fn is_authorized( + &self, + request: &ast::Request, + policies: &ast::PolicySet, + entities: &Entities, + ) -> InterfaceResponse { + self.is_authorized(request, policies, entities) + } + + fn interpret( + &self, + _request: &ast::Request, + _entities: &Entities, + _expr: &Expr, + _expected: Option, + ) -> bool { + panic!("Unimplemented: interpret"); + } + + fn validate( + &self, + _schema: &cedar_policy_validator::ValidatorSchema, + _policies: &ast::PolicySet, + _mode: ValidationMode, + ) -> ValidationInterfaceResponse { + panic!("Unimplemented: validate"); + } +} + +/// Implementation of the trait used for integration testing. +impl CustomCedarImpl for LeanDefinitionalEngine { + fn is_authorized( + &self, + request: &ast::Request, + policies: &ast::PolicySet, + entities: &Entities, + ) -> InterfaceResponse { + self.is_authorized(request, policies, entities) + } + + fn validate( + &self, + _schema: cedar_policy_validator::ValidatorSchema, + _policies: &ast::PolicySet, + ) -> IntegrationTestValidationResult { + panic!("Unimplemented: validate (test)"); + } +} diff --git a/cedar-drt/src/lib.rs b/cedar-drt/src/lib.rs index 5f5c79f45..986a31df5 100644 --- a/cedar-drt/src/lib.rs +++ b/cedar-drt/src/lib.rs @@ -14,11 +14,13 @@ * limitations under the License. */ -#![forbid(unsafe_code)] +// #![forbid(unsafe_code)] mod cedar_test_impl; mod dafny_java_impl; +mod lean_impl; mod logger; pub use cedar_test_impl::*; pub use dafny_java_impl::*; +pub use lean_impl::*; pub use logger::*; diff --git a/cedar-drt/tests/integration_tests.rs b/cedar-drt/tests/integration_tests.rs index 871a4c9a1..c7b5e2886 100644 --- a/cedar-drt/tests/integration_tests.rs +++ b/cedar-drt/tests/integration_tests.rs @@ -74,3 +74,10 @@ fn integration_tests_on_java_def_impl() { JavaDefinitionalEngine::new().expect("failed to create definitional engine"); run_integration_tests(&java_def_impl) } + +#[test] +fn integration_tests_on_lean_def_impl() { + let lean_def_impl = + LeanDefinitionalEngine::new(); + run_integration_tests(&lean_def_impl) +} diff --git a/cedar-lean/DiffTest/Parser.lean b/cedar-lean/DiffTest/Parser.lean index 989044524..5b78c7205 100644 --- a/cedar-lean/DiffTest/Parser.lean +++ b/cedar-lean/DiffTest/Parser.lean @@ -81,7 +81,7 @@ def litHelper (json : Except String Lean.Json) : Expr := match json.isOk with match json with | Lean.Json.bool b => .lit (.bool b) | Lean.Json.num n => match n.exponent with - | 0 => .lit (.int n.mantissa) + | 0 => .lit (.int (Int64.mk! n.mantissa)) | _ => panic! "litHelper: num has exponent: " ++ json.pretty | Lean.Json.str s => .lit (.string s) | _ => panic! "litHelper: not known format for json: " ++ json.pretty @@ -143,7 +143,7 @@ partial def jsonToExpr (json : Except String Lean.Json) : Expr := match json.isO | Lean.Json.null => panic! "sorry" | Lean.Json.bool b => .lit (.bool b) | Lean.Json.num n => match n.exponent with - | 0 => .lit (.int n.mantissa) + | 0 => .lit (.int (Int64.mk! n.mantissa)) | _ => panic! "sorry" | Lean.Json.str s => .lit (.string s) | Lean.Json.arr _ => panic! "sorry" @@ -198,7 +198,7 @@ partial def jsonToExpr (json : Except String Lean.Json) : Expr := match json.isO let constJson := unwrapExcept (json.getObjVal? "constant") match constJson with | Lean.Json.num n => match n.exponent with - | 0 => .unaryApp (.mulBy n.mantissa) (jsonToExpr arg) + | 0 => .unaryApp (.mulBy (Int64.mk! n.mantissa)) (jsonToExpr arg) | _ => panic! "sorry" | _ => panic! "constant for mul by is not a numebr" | false => match (json.getObjVal? "Like").isOk with From 015a13c141912b076a79e340fdda386e296e09dc Mon Sep 17 00:00:00 2001 From: Andrew Wells Date: Mon, 13 Nov 2023 11:23:23 -0800 Subject: [PATCH 03/57] Compiles and tests start to run but panic --- cedar-drt/Cargo.toml | 1 - cedar-drt/Makefile | 2 + .../fuzz/fuzz_targets/abac-type-directed.rs | 8 +- cedar-drt/fuzz/fuzz_targets/abac.rs | 6 +- .../fuzz/fuzz_targets/eval-type-directed.rs | 6 +- .../fuzz/fuzz_targets/rbac-authorizer.rs | 6 +- cedar-drt/fuzz/fuzz_targets/rbac.rs | 6 +- .../strict-validation-drt-type-directed.rs | 6 +- .../validation-drt-type-directed.rs | 6 +- cedar-drt/fuzz/fuzz_targets/validation-drt.rs | 6 +- cedar-drt/fuzz/src/lib.rs | 8 +- cedar-drt/src/dafny_java_impl.rs | 459 ------------------ cedar-drt/src/definitional_request_types.rs | 78 +++ cedar-drt/src/lean_impl.rs | 13 +- cedar-drt/src/lib.rs | 4 +- cedar-drt/tests/integration_tests.rs | 9 +- 16 files changed, 122 insertions(+), 502 deletions(-) delete mode 100644 cedar-drt/src/dafny_java_impl.rs create mode 100644 cedar-drt/src/definitional_request_types.rs diff --git a/cedar-drt/Cargo.toml b/cedar-drt/Cargo.toml index df26838be..7e898042b 100644 --- a/cedar-drt/Cargo.toml +++ b/cedar-drt/Cargo.toml @@ -12,7 +12,6 @@ cedar-policy = { path = "../cedar/cedar-policy", version = "3.*", features = ["i cedar-policy-core = { path = "../cedar/cedar-policy-core", version = "3.*", features = ["arbitrary"] } cedar-policy-validator = { path = "../cedar/cedar-policy-validator", version = "3.*", features = ["arbitrary"] } cedar-policy-formatter = { path = "../cedar/cedar-policy-formatter", version = "3.*" } -jni = { version = "0.19.0", features = ["invocation"] } lean-sys = { version = "0.0.5", features = ["small_allocator"], default-features = false } serde = { version = "1.0", features = ["derive"] } serde_json = "1.0" diff --git a/cedar-drt/Makefile b/cedar-drt/Makefile index 45a203f74..c9ee4d07b 100644 --- a/cedar-drt/Makefile +++ b/cedar-drt/Makefile @@ -8,6 +8,8 @@ all: cd fuzz && LEAN_LIB_DIR=`lean --print-libdir` cargo build test: all + DYLD_LIBRARY_PATH=`lean --print-libdir` \ + LD_LIBRARY_PATH=`lean --print-libdir` \ LEAN_LIB_DIR=`lean --print-libdir` \ cargo test diff --git a/cedar-drt/fuzz/fuzz_targets/abac-type-directed.rs b/cedar-drt/fuzz/fuzz_targets/abac-type-directed.rs index b79ee61d4..63aa7750f 100644 --- a/cedar-drt/fuzz/fuzz_targets/abac-type-directed.rs +++ b/cedar-drt/fuzz/fuzz_targets/abac-type-directed.rs @@ -143,8 +143,8 @@ fuzz_target!(|input: FuzzTargetInput| { initialize_log(); let mut policyset = ast::PolicySet::new(); policyset.add_static(input.policy.into()).unwrap(); - let java_def_engine = - JavaDefinitionalEngine::new().expect("failed to create definitional engine"); + let lean_def_engine = + LeanDefinitionalEngine::new().expect("failed to create definitional engine"); debug!("Schema: {}\n", input.schema.schemafile_string()); debug!("Policies: {policyset}\n"); debug!("Entities: {}\n", input.entities); @@ -157,14 +157,14 @@ fuzz_target!(|input: FuzzTargetInput| { for request in input.requests.into_iter().map(Into::into) { debug!("Request : {request}"); let (rust_res, total_dur) = time_function(|| { - run_auth_test(&java_def_engine, &request, &policyset, &original_entities) + run_auth_test(&lean_def_engine, &request, &policyset, &original_entities) }); if let Some(ref entities) = cached_entities { match entities { Ok(entities) => { let (cached_rust_res, _total_dur) = time_function(|| { - run_auth_test(&java_def_engine, &request, &policyset, entities) + run_auth_test(&lean_def_engine, &request, &policyset, entities) }); assert_eq!(rust_res, cached_rust_res); } diff --git a/cedar-drt/fuzz/fuzz_targets/abac.rs b/cedar-drt/fuzz/fuzz_targets/abac.rs index 20d61c15f..8c37e009d 100644 --- a/cedar-drt/fuzz/fuzz_targets/abac.rs +++ b/cedar-drt/fuzz/fuzz_targets/abac.rs @@ -123,8 +123,8 @@ fuzz_target!(|input: FuzzTargetInput| { policyset.add_static(input.policy.into()).unwrap(); debug!("Policies: {policyset}"); debug!("Entities: {entities}"); - let java_def_engine = - JavaDefinitionalEngine::new().expect("failed to create definitional engine"); + let lean_def_engine = + LeanDefinitionalEngine::new().expect("failed to create definitional engine"); let requests = input .requests .into_iter() @@ -134,7 +134,7 @@ fuzz_target!(|input: FuzzTargetInput| { for request in &requests { debug!("Request: {request}"); let (ans, total_dur) = - time_function(|| run_auth_test(&java_def_engine, request, &policyset, &entities)); + time_function(|| run_auth_test(&lean_def_engine, request, &policyset, &entities)); info!("{}{}", TOTAL_MSG, total_dur.as_nanos()); responses.push(ans); } diff --git a/cedar-drt/fuzz/fuzz_targets/eval-type-directed.rs b/cedar-drt/fuzz/fuzz_targets/eval-type-directed.rs index e08308bc4..afdc25d27 100644 --- a/cedar-drt/fuzz/fuzz_targets/eval-type-directed.rs +++ b/cedar-drt/fuzz/fuzz_targets/eval-type-directed.rs @@ -135,13 +135,13 @@ fn drop_some_entities(entities: Entities, u: &mut Unstructured<'_>) -> arbitrary // The main fuzz target. This is for type-directed fuzzing of expression evaluation fuzz_target!(|input: FuzzTargetInput| { initialize_log(); - let java_def_engine = - JavaDefinitionalEngine::new().expect("failed to create definitional engine"); + let lean_def_engine = + LeanDefinitionalEngine::new().expect("failed to create definitional engine"); debug!("Schema: {}\n", input.schema.schemafile_string()); debug!("expr: {}\n", input.expression); debug!("Entities: {}\n", input.entities); run_eval_test( - &java_def_engine, + &lean_def_engine, &input.request.into(), &input.expression, &input.entities, diff --git a/cedar-drt/fuzz/fuzz_targets/rbac-authorizer.rs b/cedar-drt/fuzz/fuzz_targets/rbac-authorizer.rs index 16df75f65..d1e053b76 100644 --- a/cedar-drt/fuzz/fuzz_targets/rbac-authorizer.rs +++ b/cedar-drt/fuzz/fuzz_targets/rbac-authorizer.rs @@ -111,9 +111,9 @@ fuzz_target!(|input: AuthorizerInputAbstractEvaluator| { // Check agreement with definitional engine. Note that run_auth_test returns // the result of the call to is_authorized. - let java_def_engine = - JavaDefinitionalEngine::new().expect("failed to create definitional engine"); - let res = run_auth_test(&java_def_engine, &request, &policyset, &entities); + let lean_def_engine = + LeanDefinitionalEngine::new().expect("failed to create definitional engine"); + let res = run_auth_test(&lean_def_engine, &request, &policyset, &entities); // Check the following property: there should be an error reported iff we // had either PermitError or ForbidError diff --git a/cedar-drt/fuzz/fuzz_targets/rbac.rs b/cedar-drt/fuzz/fuzz_targets/rbac.rs index 7f541a201..b7f8ebc2c 100644 --- a/cedar-drt/fuzz/fuzz_targets/rbac.rs +++ b/cedar-drt/fuzz/fuzz_targets/rbac.rs @@ -198,12 +198,12 @@ fuzz_target!(|input: FuzzTargetInput| { } }; } - let java_def_engine = - JavaDefinitionalEngine::new().expect("failed to create definitional engine"); + let lean_def_engine = + LeanDefinitionalEngine::new().expect("failed to create definitional engine"); for rbac_request in input.requests.into_iter() { let request = ast::Request::from(rbac_request); let (_, dur) = - time_function(|| run_auth_test(&java_def_engine, &request, &policyset, &entities)); + time_function(|| run_auth_test(&lean_def_engine, &request, &policyset, &entities)); info!("{}{}", TOTAL_MSG, dur.as_nanos()); } } diff --git a/cedar-drt/fuzz/fuzz_targets/strict-validation-drt-type-directed.rs b/cedar-drt/fuzz/fuzz_targets/strict-validation-drt-type-directed.rs index 199623e0c..b2c3bc642 100644 --- a/cedar-drt/fuzz/fuzz_targets/strict-validation-drt-type-directed.rs +++ b/cedar-drt/fuzz/fuzz_targets/strict-validation-drt-type-directed.rs @@ -79,10 +79,10 @@ fuzz_target!(|input: FuzzTargetInput| { debug!("Policies: {policyset}"); // run the policy through both validators and compare the result - let java_def_engine = - JavaDefinitionalEngine::new().expect("failed to create definitional engine"); + let lean_def_engine = + LeanDefinitionalEngine::new().expect("failed to create definitional engine"); let (_, total_dur) = time_function(|| { - run_val_test(&java_def_engine, schema, &policyset, ValidationMode::Strict) + run_val_test(&lean_def_engine, schema, &policyset, ValidationMode::Strict) }); info!("{}{}", TOTAL_MSG, total_dur.as_nanos()); } diff --git a/cedar-drt/fuzz/fuzz_targets/validation-drt-type-directed.rs b/cedar-drt/fuzz/fuzz_targets/validation-drt-type-directed.rs index 2d8dd71db..e0a92fd87 100644 --- a/cedar-drt/fuzz/fuzz_targets/validation-drt-type-directed.rs +++ b/cedar-drt/fuzz/fuzz_targets/validation-drt-type-directed.rs @@ -79,11 +79,11 @@ fuzz_target!(|input: FuzzTargetInput| { debug!("Policies: {policyset}"); // run the policy through both validators and compare the result - let java_def_engine = - JavaDefinitionalEngine::new().expect("failed to create definitional engine"); + let lean_def_engine = + LeanDefinitionalEngine::new().expect("failed to create definitional engine"); let (_, total_dur) = time_function(|| { run_val_test( - &java_def_engine, + &lean_def_engine, schema, &policyset, ValidationMode::Permissive, diff --git a/cedar-drt/fuzz/fuzz_targets/validation-drt.rs b/cedar-drt/fuzz/fuzz_targets/validation-drt.rs index 2e9598f2f..9a8e95bf3 100644 --- a/cedar-drt/fuzz/fuzz_targets/validation-drt.rs +++ b/cedar-drt/fuzz/fuzz_targets/validation-drt.rs @@ -79,11 +79,11 @@ fuzz_target!(|input: FuzzTargetInput| { debug!("Policies: {policyset}"); // run the policy through both validators and compare the result - let java_def_engine = - JavaDefinitionalEngine::new().expect("failed to create definitional engine"); + let lean_def_engine = + LeanDefinitionalEngine::new().expect("failed to create definitional engine"); let (_, total_dur) = time_function(|| { run_val_test( - &java_def_engine, + &lean_def_engine, schema, &policyset, ValidationMode::Permissive, diff --git a/cedar-drt/fuzz/src/lib.rs b/cedar-drt/fuzz/src/lib.rs index de14cf70e..1451eb574 100644 --- a/cedar-drt/fuzz/src/lib.rs +++ b/cedar-drt/fuzz/src/lib.rs @@ -176,13 +176,13 @@ pub fn run_val_test( #[test] fn test_run_auth_test() { - use cedar_drt::JavaDefinitionalEngine; + use cedar_drt::LeanDefinitionalEngine; use cedar_policy_core::ast::{Entity, EntityUID, RestrictedExpr}; use cedar_policy_core::entities::{NoEntitiesSchema, TCComputation}; use smol_str::SmolStr; - let java_def_engine = - JavaDefinitionalEngine::new().expect("failed to create definitional engine"); + let lean_def_engine = + LeanDefinitionalEngine::new().expect("failed to create definitional engine"); let principal = ast::EntityUIDEntry::Concrete(std::sync::Arc::new( EntityUID::with_eid_and_type("User", "alice").unwrap(), )); @@ -246,5 +246,5 @@ fn test_run_auth_test() { Extensions::all_available(), ) .unwrap(); - run_auth_test(&java_def_engine, &query, &policies, &entities); + run_auth_test(&lean_def_engine, &query, &policies, &entities); } diff --git a/cedar-drt/src/dafny_java_impl.rs b/cedar-drt/src/dafny_java_impl.rs deleted file mode 100644 index 7ce1fc18c..000000000 --- a/cedar-drt/src/dafny_java_impl.rs +++ /dev/null @@ -1,459 +0,0 @@ -/* - * Copyright 2022-2023 Amazon.com, Inc. or its affiliates. All Rights Reserved. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * https://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -//! Implementation of the [`CedarTestImplementation`] trait for the Cedar Java -//! implementation extracted from the Dafny specification. - -use crate::cedar_test_impl::*; -use crate::logger::*; -use cedar_policy::frontend::is_authorized::InterfaceResponse; -use cedar_policy::integration_testing::{CustomCedarImpl, IntegrationTestValidationResult}; -pub use cedar_policy::Response; -use cedar_policy_core::ast::{Expr, Value}; -pub use cedar_policy_core::*; -pub use cedar_policy_validator::{ValidationMode, ValidationResult, ValidatorSchema}; -pub use entities::Entities; -use jni::objects::{JObject, JString, JValue}; -use jni::{JNIVersion, JavaVM}; -use lazy_static::lazy_static; -use log::info; -use serde::{Deserialize, Serialize}; - -/// Times to (de)serialize JSON content sent to / received from the Dafny-Java -/// implementation. -pub const RUST_SERIALIZATION_MSG: &str = "rust_serialization (ns) : "; -pub const RUST_DESERIALIZATION_MSG: &str = "rust_deserialization (ns) : "; - -/// Times for cedar-policy authorization and validation. -pub const RUST_AUTH_MSG: &str = "rust_auth (ns) : "; -pub const RUST_VALIDATION_MSG: &str = "rust_validation (ns) : "; - -/// Times for JSON (de)serialization, authorization, and validation as reported -/// by the Dafny-Java implementation. -pub const JAVA_SERIALIZATION_MSG: &str = "java_serialization (ns) : "; -pub const JAVA_DESERIALIZATION_MSG: &str = "java_deserialization (ns) : "; -pub const JAVA_AUTH_MSG: &str = "java_auth (ns) : "; -pub const JAVA_VALIDATION_MSG: &str = "java_validation (ns) : "; - -lazy_static! { - /// The JVM instance - static ref JVM: JavaVM = { - let classpath_opt = match std::env::var("CLASSPATH") { - Ok(val) => format!("-Djava.class.path={val}"), - Err(std::env::VarError::NotPresent) => String::new(), - Err(std::env::VarError::NotUnicode(_)) => panic!("classpath not unicode"), - }; - let jvm_args = jni::InitArgsBuilder::new() - .version(JNIVersion::V8) - .option("-Xcheck:jni") - //.option("-verbose:class") - .option(&classpath_opt) - .build() - .expect("failed to create JVM args"); - JavaVM::new(jvm_args).expect("failed to create JVM instance") - }; -} - -#[derive(Debug, Serialize)] -pub struct RequestForDefEngine<'a> { - pub request: &'a ast::Request, - pub policies: &'a ast::PolicySet, - pub entities: &'a Entities, -} - -#[derive(Debug, Serialize, Deserialize)] -pub struct DefinitionalAuthResponse { - serialization_nanos: i64, - deserialization_nanos: i64, - auth_nanos: i64, - response: InterfaceResponse, -} - -#[derive(Debug, Serialize)] -struct EvalRequestForDefEngine<'a> { - request: &'a ast::Request, - entities: &'a Entities, - expr: &'a ast::Expr, - expected: Option<&'a ast::Expr>, -} - -#[derive(Debug, Serialize, Deserialize, Clone, Copy)] -#[repr(transparent)] -struct DefinitionalEvalResponse { - matches: bool, -} - -#[derive(Debug, Serialize)] -struct RequestForDefValidator<'a> { - schema: &'a ValidatorSchema, - policies: &'a ast::PolicySet, - mode: ValidationMode, -} - -#[derive(Debug, Deserialize)] -pub struct DefinitionalValResponse { - serialization_nanos: i64, - deserialization_nanos: i64, - validation_nanos: i64, - response: ValidationInterfaceResponse, -} - -/// The lifetime parameter 'j is the lifetime of the JVM instance -pub struct JavaDefinitionalEngine<'j> { - /// Thread attached to the JVM - thread: jni::AttachGuard<'j>, - /// Definitional authorizer instance - def_authorizer: JObject<'j>, - /// Definitional validator instance - def_validator: JObject<'j>, -} - -impl<'j> JavaDefinitionalEngine<'j> { - /// Create a new `JavaDefinitionalEngine` instance. - /// - /// This is a relatively expensive operation, so avoid calling it frequently. - pub fn new() -> Result { - let thread = JVM - .attach_current_thread() - .map_err(|e| format!("failed to attach current thread: {e}"))?; - let def_authorizer_class = thread - .find_class("com/CedarDefinitionalImplementation/DefinitionalEngine") - .map_err(|e| format!("failed to find class: {e}"))?; - let def_authorizer = thread - .new_object(def_authorizer_class, "()V", &[]) - .map_err(|e| format!("failed to construct DefinitionalEngine instance: {e}"))?; - let def_validator_class = thread - .find_class("com/CedarDefinitionalImplementation/DefinitionalValidator") - .map_err(|e| format!("failed to find class: {e}"))?; - let def_validator = thread - .new_object(def_validator_class, "()V", &[]) - .map_err(|e| format!("failed to construct DefinitionalValidator instance: {e}"))?; - Ok(Self { - thread, - def_authorizer, - def_validator, - }) - } - - fn serialize_eval_request( - &self, - request: &ast::Request, - entities: &Entities, - expr: &Expr, - expected: Option<&Expr>, - ) -> JString { - let request: String = serde_json::to_string(&EvalRequestForDefEngine { - request, - entities, - expr, - expected, - }) - .expect("Failed to serialize request"); - self.thread - .new_string(request) - .expect("failed to create Java object for eval request string") - } - - fn deserialize_eval_response(&self, response: JValue) -> bool { - let jstr = response - .l() - .unwrap_or_else(|_| { - panic!( - "expected eval_str to return an Object (String), but it returned {:?}", - response - ) - }) - .into(); - let response: String = self - .thread - .get_string(jstr) - .expect("Failed to get JavaStr") - .into(); - self.thread - .delete_local_ref(*jstr) - .expect("Deletion failed"); - let r: DefinitionalEvalResponse = serde_json::from_str(&response).unwrap_or_else(|_| { - panic!( - "JSON response received from the definitional engine was malformed: \n{response}" - ) - }); - r.matches - } - - pub fn eval( - &self, - request: &ast::Request, - entities: &Entities, - expr: &Expr, - expected: Option, - ) -> bool { - let expected_as_expr = expected.map(|v| v.into()); - let jstr = self.serialize_eval_request(request, entities, expr, expected_as_expr.as_ref()); - let response = self.thread.call_method( - self.def_authorizer, - "eval_str", - "(Ljava/lang/String;)Ljava/lang/String;", - &[jstr.into()], - ); - match response { - Ok(v) => self.deserialize_eval_response(v), - Err(e) => { - self.thread - .exception_describe() - .expect("Failed to print exception information"); - panic!("JVM Exception Occurred!: {:?}", e); - } - } - } - - fn serialize_auth_request( - &self, - request: &ast::Request, - policies: &ast::PolicySet, - entities: &Entities, - ) -> JString { - let request: String = serde_json::to_string(&RequestForDefEngine { - request, - policies, - entities, - }) - .expect("Failed to serialize request, policies, or entities"); - self.thread - .new_string(request) - .expect("failed to create Java object for authorization request string") - } - - fn deserialize_auth_response(&self, response: JValue) -> InterfaceResponse { - let jresponse: JString = response - .l() - .unwrap_or_else(|_| { - panic!( - "expected isAuthorized_str to return an Object (String), but it returned {:?}", - response - ) - }) - .into(); - let response: String = self - .thread - .get_string(jresponse) - .expect("failed to get JavaStr") - .into(); - self.thread - .delete_local_ref(*jresponse) - .expect("Deletion failed"); - let d_response: DefinitionalAuthResponse = serde_json::from_str(&response).unwrap_or_else(|_| { - panic!( - "JSON response received from the definitional engine was the wrong format:\n{response}", - ) - }); - - info!( - "{}{}", - JAVA_SERIALIZATION_MSG, d_response.serialization_nanos - ); - info!( - "{}{}", - JAVA_DESERIALIZATION_MSG, d_response.deserialization_nanos - ); - info!("{}{}", JAVA_AUTH_MSG, d_response.auth_nanos); - - d_response.response - } - - /// Ask the definitional engine whether `isAuthorized` for the given `request`, - /// `policies`, and `entities` - pub fn is_authorized( - &self, - request: &ast::Request, - policies: &ast::PolicySet, - entities: &Entities, - ) -> InterfaceResponse { - let (jstring, dur) = - time_function(|| self.serialize_auth_request(request, policies, entities)); - info!("{}{}", RUST_SERIALIZATION_MSG, dur.as_nanos()); - let response = self.thread.call_method( - self.def_authorizer, - "isAuthorized_str", - // https://stackoverflow.com/questions/8066253/compute-a-java-functions-signature - "(Ljava/lang/String;)Ljava/lang/String;", - &[jstring.into()], - ); - if response.is_err() { - self.thread - .exception_describe() - .expect("Failed to print exception information"); - panic!("JVM Exception Occurred!"); - } - let response: JValue = response.expect("failed to call Java isAuthorized_str"); - let (response, dur) = time_function(|| self.deserialize_auth_response(response)); - info!("{}{}", RUST_DESERIALIZATION_MSG, dur.as_nanos()); - self.thread - .delete_local_ref(*jstring) - .expect("Deletion failed"); - response - } - - fn serialize_val_request( - &self, - schema: &ValidatorSchema, - policies: &ast::PolicySet, - mode: ValidationMode, - ) -> JString { - let request: String = serde_json::to_string(&RequestForDefValidator { - schema, - policies, - mode, - }) - .expect("Failed to serialize schema or policies"); - self.thread - .new_string(request) - .expect("failed to create Java object for validation request string") - } - - fn deserialize_val_response(&self, response: JValue) -> ValidationInterfaceResponse { - let jresponse: JString = response - .l() - .unwrap_or_else(|_| { - panic!( - "expected validate_str to return an Object (String), but it returned {:?}", - response - ) - }) - .into(); - let response: String = self - .thread - .get_string(jresponse) - .expect("failed to get JavaStr") - .into(); - self.thread - .delete_local_ref(*jresponse) - .expect("Deletion failed"); - let d_response: DefinitionalValResponse = - serde_json::from_str(&response).unwrap_or_else(|_| { - panic!( - "JSON response received from the definitional validator was the wrong format:\n{response}", - ) - }); - - info!( - "{}{}", - JAVA_SERIALIZATION_MSG, d_response.serialization_nanos - ); - info!( - "{}{}", - JAVA_DESERIALIZATION_MSG, d_response.deserialization_nanos - ); - info!("{}{}", JAVA_VALIDATION_MSG, d_response.validation_nanos); - - d_response.response - } - - /// Use the definitional validator to validate the given `policies` given a `schema` - pub fn validate( - &self, - schema: &ValidatorSchema, - policies: &ast::PolicySet, - mode: ValidationMode, - ) -> ValidationInterfaceResponse { - let (jstring, dur) = time_function(|| self.serialize_val_request(schema, policies, mode)); - info!("{}{}", RUST_SERIALIZATION_MSG, dur.as_nanos()); - let response = self.thread.call_method( - self.def_validator, - "validate_str", - // https://stackoverflow.com/questions/8066253/compute-a-java-functions-signature - "(Ljava/lang/String;)Ljava/lang/String;", - &[jstring.into()], - ); - if response.is_err() { - self.thread - .exception_describe() - .expect("Failed to print exception information"); - panic!("JVM Exception Occurred!"); - } - let response: JValue = response.expect("failed to call Java validate_str"); - let (response, dur) = time_function(|| self.deserialize_val_response(response)); - info!("{}{}", RUST_DESERIALIZATION_MSG, dur.as_nanos()); - self.thread - .delete_local_ref(*jstring) - .expect("Deletion failed"); - response - } -} - -impl<'j> CedarTestImplementation for JavaDefinitionalEngine<'j> { - fn is_authorized( - &self, - request: &ast::Request, - policies: &ast::PolicySet, - entities: &Entities, - ) -> InterfaceResponse { - self.is_authorized(request, policies, entities) - } - - fn interpret( - &self, - request: &ast::Request, - entities: &Entities, - expr: &Expr, - expected: Option, - ) -> bool { - self.eval(request, entities, expr, expected) - } - - fn validate( - &self, - schema: &cedar_policy_validator::ValidatorSchema, - policies: &ast::PolicySet, - mode: ValidationMode, - ) -> ValidationInterfaceResponse { - self.validate(schema, policies, mode) - } -} - -/// Implementation of the trait used for integration testing. -impl<'j> CustomCedarImpl for JavaDefinitionalEngine<'j> { - fn is_authorized( - &self, - request: &ast::Request, - policies: &ast::PolicySet, - entities: &Entities, - ) -> InterfaceResponse { - self.is_authorized(request, policies, entities) - } - - fn validate( - &self, - schema: cedar_policy_validator::ValidatorSchema, - policies: &ast::PolicySet, - ) -> cedar_policy::integration_testing::IntegrationTestValidationResult { - let definitional_res = self.validate( - &schema, - policies, - cedar_policy_validator::ValidationMode::default(), - ); - assert!( - definitional_res.parsing_succeeded(), - "Dafny json parsing failed for:\nPolicies:\n{}\nSchema:\n{:?}Errors:\n{:?}", - &policies, - schema, - definitional_res.parse_errors - ); - IntegrationTestValidationResult { - validation_passed: definitional_res.validation_passed(), - validation_errors_debug: format!("{:?}", definitional_res.validation_errors), - } - } -} diff --git a/cedar-drt/src/definitional_request_types.rs b/cedar-drt/src/definitional_request_types.rs new file mode 100644 index 000000000..42ca6847e --- /dev/null +++ b/cedar-drt/src/definitional_request_types.rs @@ -0,0 +1,78 @@ +/* + * Copyright 2022-2023 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + + +use crate::cedar_test_impl::*; +use cedar_policy::frontend::is_authorized::InterfaceResponse; +pub use cedar_policy::Response; +pub use cedar_policy_core::*; +pub use cedar_policy_validator::{ValidationMode, ValidationResult, ValidatorSchema}; +pub use entities::Entities; +use serde::{Deserialize, Serialize}; + +/// Times to (de)serialize JSON content sent to / received from the Dafny-Java +/// implementation. +pub const RUST_SERIALIZATION_MSG: &str = "rust_serialization (ns) : "; +pub const RUST_DESERIALIZATION_MSG: &str = "rust_deserialization (ns) : "; + +/// Times for cedar-policy authorization and validation. +pub const RUST_AUTH_MSG: &str = "rust_auth (ns) : "; +pub const RUST_VALIDATION_MSG: &str = "rust_validation (ns) : "; + + +#[derive(Debug, Serialize)] +pub struct RequestForDefEngine<'a> { + pub request: &'a ast::Request, + pub policies: &'a ast::PolicySet, + pub entities: &'a Entities, +} + +#[derive(Debug, Serialize, Deserialize)] +pub struct DefinitionalAuthResponse { + serialization_nanos: i64, + deserialization_nanos: i64, + auth_nanos: i64, + response: InterfaceResponse, +} + +#[derive(Debug, Serialize)] +struct EvalRequestForDefEngine<'a> { + request: &'a ast::Request, + entities: &'a Entities, + expr: &'a ast::Expr, + expected: Option<&'a ast::Expr>, +} + +#[derive(Debug, Serialize, Deserialize, Clone, Copy)] +#[repr(transparent)] +struct DefinitionalEvalResponse { + matches: bool, +} + +#[derive(Debug, Serialize)] +struct RequestForDefValidator<'a> { + schema: &'a ValidatorSchema, + policies: &'a ast::PolicySet, + mode: ValidationMode, +} + +#[derive(Debug, Deserialize)] +pub struct DefinitionalValResponse { + serialization_nanos: i64, + deserialization_nanos: i64, + validation_nanos: i64, + response: ValidationInterfaceResponse, +} diff --git a/cedar-drt/src/lean_impl.rs b/cedar-drt/src/lean_impl.rs index cf95a2b81..2792bde99 100644 --- a/cedar-drt/src/lean_impl.rs +++ b/cedar-drt/src/lean_impl.rs @@ -21,7 +21,6 @@ use core::panic; use std::{collections::HashSet, ffi::CString}; use crate::cedar_test_impl::*; -use crate::dafny_java_impl::RequestForDefEngine; use cedar_policy::frontend::is_authorized::InterfaceResponse; use cedar_policy::integration_testing::{CustomCedarImpl, IntegrationTestValidationResult}; pub use cedar_policy::Response; @@ -34,6 +33,8 @@ pub use lean_sys::lean_object; pub use lean_sys::string::lean_mk_string; use lean_sys::{lean_initialize_runtime_module, lean_io_mark_end_initialization, lean_io_mk_world}; +use crate::definitional_request_types::*; + /// Times for JSON (de)serialization, authorization, and validation as reported /// by the Lean implementation. pub const LEAN_SERIALIZATION_MSG: &str = "lean_serialization (ns) : "; @@ -44,16 +45,22 @@ pub const LEAN_VALIDATION_MSG: &str = "lean_validation (ns) : "; #[link(name = "Cedar")] #[link(name = "Lean")] #[link(name = "Std")] +#[link(name = "DiffTest")] extern "C" { fn isAuthorizedDRT(req: *mut lean_object) -> *mut lean_object; fn initialize_Cedar(builtin: i8, ob: *mut lean_object) -> *mut lean_object; } +#[derive(Debug)] +pub enum LeanDefEngineError { + +} + pub struct LeanDefinitionalEngine {} impl LeanDefinitionalEngine { - pub fn new() -> Self { - Self {} + pub fn new() -> Result { + Ok(Self {}) } fn serialize_request( diff --git a/cedar-drt/src/lib.rs b/cedar-drt/src/lib.rs index 986a31df5..d6527e0d4 100644 --- a/cedar-drt/src/lib.rs +++ b/cedar-drt/src/lib.rs @@ -16,11 +16,11 @@ // #![forbid(unsafe_code)] mod cedar_test_impl; -mod dafny_java_impl; +mod definitional_request_types; mod lean_impl; mod logger; +pub use definitional_request_types::*; pub use cedar_test_impl::*; -pub use dafny_java_impl::*; pub use lean_impl::*; pub use logger::*; diff --git a/cedar-drt/tests/integration_tests.rs b/cedar-drt/tests/integration_tests.rs index c7b5e2886..8fbd05a4e 100644 --- a/cedar-drt/tests/integration_tests.rs +++ b/cedar-drt/tests/integration_tests.rs @@ -68,16 +68,9 @@ fn run_integration_tests(custom_impl: &dyn CustomCedarImpl) { } } -#[test] -fn integration_tests_on_java_def_impl() { - let java_def_impl = - JavaDefinitionalEngine::new().expect("failed to create definitional engine"); - run_integration_tests(&java_def_impl) -} - #[test] fn integration_tests_on_lean_def_impl() { let lean_def_impl = - LeanDefinitionalEngine::new(); + LeanDefinitionalEngine::new().unwrap(); run_integration_tests(&lean_def_impl) } From 499a36605ea40814725b5ff2a4ada4b006a06529 Mon Sep 17 00:00:00 2001 From: Andrew Wells Date: Mon, 13 Nov 2023 11:29:30 -0800 Subject: [PATCH 04/57] don't build theorems for now --- cedar-lean/Cedar.lean | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/cedar-lean/Cedar.lean b/cedar-lean/Cedar.lean index f79829fb3..29ccba865 100644 --- a/cedar-lean/Cedar.lean +++ b/cedar-lean/Cedar.lean @@ -16,5 +16,5 @@ import Cedar.Data import Cedar.Spec -import Cedar.Thm -import Cedar.Validation \ No newline at end of file +-- import Cedar.Thm +import Cedar.Validation From 9abffa892a046dd5a86696a9498a97bd31844a72 Mon Sep 17 00:00:00 2001 From: Andrew Wells Date: Mon, 13 Nov 2023 14:50:28 -0800 Subject: [PATCH 05/57] fails on Lean side --- cedar-drt/Makefile | 2 +- cedar-drt/build.rs | 2 +- cedar-drt/src/definitional_request_types.rs | 2 -- cedar-drt/src/lean_impl.rs | 19 ++++++++++++++----- cedar-drt/src/lib.rs | 2 +- cedar-drt/tests/integration_tests.rs | 4 ++-- 6 files changed, 19 insertions(+), 12 deletions(-) diff --git a/cedar-drt/Makefile b/cedar-drt/Makefile index c9ee4d07b..1fc7e3b3d 100644 --- a/cedar-drt/Makefile +++ b/cedar-drt/Makefile @@ -11,7 +11,7 @@ test: all DYLD_LIBRARY_PATH=`lean --print-libdir` \ LD_LIBRARY_PATH=`lean --print-libdir` \ LEAN_LIB_DIR=`lean --print-libdir` \ - cargo test + cargo test --test integration_tests run: all DYLD_LIBRARY_PATH=`lean --print-libdir` \ diff --git a/cedar-drt/build.rs b/cedar-drt/build.rs index d80321f57..1d22876a7 100644 --- a/cedar-drt/build.rs +++ b/cedar-drt/build.rs @@ -8,4 +8,4 @@ fn main() { println!("cargo:rustc-link-search=native=../cedar-lean/lake-packages/Qq/build/lib"); println!("cargo:rustc-link-search=native=../cedar-lean/lake-packages/aesop/build/lib"); println!("cargo:rustc-link-search=native=../cedar-lean/lake-packages/proofwidgets/build/lib"); - } \ No newline at end of file +} diff --git a/cedar-drt/src/definitional_request_types.rs b/cedar-drt/src/definitional_request_types.rs index 42ca6847e..992823101 100644 --- a/cedar-drt/src/definitional_request_types.rs +++ b/cedar-drt/src/definitional_request_types.rs @@ -14,7 +14,6 @@ * limitations under the License. */ - use crate::cedar_test_impl::*; use cedar_policy::frontend::is_authorized::InterfaceResponse; pub use cedar_policy::Response; @@ -32,7 +31,6 @@ pub const RUST_DESERIALIZATION_MSG: &str = "rust_deserialization (ns) : "; pub const RUST_AUTH_MSG: &str = "rust_auth (ns) : "; pub const RUST_VALIDATION_MSG: &str = "rust_validation (ns) : "; - #[derive(Debug, Serialize)] pub struct RequestForDefEngine<'a> { pub request: &'a ast::Request, diff --git a/cedar-drt/src/lean_impl.rs b/cedar-drt/src/lean_impl.rs index 2792bde99..bd42d509b 100644 --- a/cedar-drt/src/lean_impl.rs +++ b/cedar-drt/src/lean_impl.rs @@ -23,6 +23,7 @@ use std::{collections::HashSet, ffi::CString}; use crate::cedar_test_impl::*; use cedar_policy::frontend::is_authorized::InterfaceResponse; use cedar_policy::integration_testing::{CustomCedarImpl, IntegrationTestValidationResult}; +use cedar_policy::Diagnostics; pub use cedar_policy::Response; use cedar_policy_core::ast::{Expr, Value}; pub use cedar_policy_core::*; @@ -52,9 +53,7 @@ extern "C" { } #[derive(Debug)] -pub enum LeanDefEngineError { - -} +pub enum LeanDefEngineError {} pub struct LeanDefinitionalEngine {} @@ -122,7 +121,7 @@ impl CedarTestImplementation for LeanDefinitionalEngine { _expr: &Expr, _expected: Option, ) -> bool { - panic!("Unimplemented: interpret"); + unimplemented!("Unimplemented: interpret"); } fn validate( @@ -131,7 +130,14 @@ impl CedarTestImplementation for LeanDefinitionalEngine { _policies: &ast::PolicySet, _mode: ValidationMode, ) -> ValidationInterfaceResponse { - panic!("Unimplemented: validate"); + println!("validating"); + let parse_errors = Vec::new(); + let validation_errors = Vec::new(); + ValidationInterfaceResponse { + parse_errors, + validation_errors, + } + // unimplemented!("Unimplemented: validate"); } } @@ -143,6 +149,9 @@ impl CustomCedarImpl for LeanDefinitionalEngine { policies: &ast::PolicySet, entities: &Entities, ) -> InterfaceResponse { + // println!("Performing is_authorized"); + // let decision = authorizer::Decision::Allow; + // InterfaceResponse::new(decision, HashSet::new(), HashSet::new()) self.is_authorized(request, policies, entities) } diff --git a/cedar-drt/src/lib.rs b/cedar-drt/src/lib.rs index d6527e0d4..11b5dabd7 100644 --- a/cedar-drt/src/lib.rs +++ b/cedar-drt/src/lib.rs @@ -20,7 +20,7 @@ mod definitional_request_types; mod lean_impl; mod logger; -pub use definitional_request_types::*; pub use cedar_test_impl::*; +pub use definitional_request_types::*; pub use lean_impl::*; pub use logger::*; diff --git a/cedar-drt/tests/integration_tests.rs b/cedar-drt/tests/integration_tests.rs index 8fbd05a4e..51f94e4d5 100644 --- a/cedar-drt/tests/integration_tests.rs +++ b/cedar-drt/tests/integration_tests.rs @@ -70,7 +70,7 @@ fn run_integration_tests(custom_impl: &dyn CustomCedarImpl) { #[test] fn integration_tests_on_lean_def_impl() { - let lean_def_impl = - LeanDefinitionalEngine::new().unwrap(); + let lean_def_impl = LeanDefinitionalEngine::new().unwrap(); + run_integration_tests(&lean_def_impl) } From a808fd4ed2e3081fe8b94b418111a3036bb3c1ab Mon Sep 17 00:00:00 2001 From: Andrew Wells Date: Tue, 14 Nov 2023 15:40:54 -0800 Subject: [PATCH 06/57] runs, no deserializer --- cedar-drt/src/lean_impl.rs | 24 +++++++++++------ cedar-drt/tests/integration_tests.rs | 40 ++++++++++++++-------------- 2 files changed, 36 insertions(+), 28 deletions(-) diff --git a/cedar-drt/src/lean_impl.rs b/cedar-drt/src/lean_impl.rs index bd42d509b..157db2b5b 100644 --- a/cedar-drt/src/lean_impl.rs +++ b/cedar-drt/src/lean_impl.rs @@ -43,23 +43,30 @@ pub const LEAN_DESERIALIZATION_MSG: &str = "lean_deserialization (ns) : "; pub const LEAN_AUTH_MSG: &str = "lean_auth (ns) : "; pub const LEAN_VALIDATION_MSG: &str = "lean_validation (ns) : "; -#[link(name = "Cedar")] -#[link(name = "Lean")] +#[link(name = "Cedar", kind = "static")] +// #[link(name = "Lean")] #[link(name = "Std")] -#[link(name = "DiffTest")] +#[link(name = "DiffTest", kind = "static")] +#[link(name = "leanshared", kind = "dylib")] +#[link(name = "Mathlib", kind = "static")] +#[link(name = "Qq", kind = "static")] +#[link(name = "ProofWidgets", kind = "static")] +#[link(name = "Aesop", kind = "static")] extern "C" { fn isAuthorizedDRT(req: *mut lean_object) -> *mut lean_object; - fn initialize_Cedar(builtin: i8, ob: *mut lean_object) -> *mut lean_object; + fn initialize_DiffTest_Main(builtin: i8, ob: *mut lean_object) -> *mut lean_object; } #[derive(Debug)] pub enum LeanDefEngineError {} -pub struct LeanDefinitionalEngine {} +pub struct LeanDefinitionalEngine { + initialized: bool, +} impl LeanDefinitionalEngine { pub fn new() -> Result { - Ok(Self {}) + Ok(Self { initialized: false }) } fn serialize_request( @@ -82,7 +89,7 @@ impl LeanDefinitionalEngine { fn deserialize_response(response: *mut lean_object) -> InterfaceResponse { println!("{:?}", response); - InterfaceResponse::new(authorizer::Decision::Deny, HashSet::new(), HashSet::new()) + InterfaceResponse::new(authorizer::Decision::Allow, HashSet::new(), HashSet::new()) } /// Ask the definitional engine whether `isAuthorized` for the given `request`, @@ -95,12 +102,13 @@ impl LeanDefinitionalEngine { ) -> InterfaceResponse { unsafe { lean_initialize_runtime_module() }; unsafe { lean_initialize() }; - unsafe { initialize_Cedar(1, lean_io_mk_world()) }; + unsafe { initialize_DiffTest_Main(1, lean_io_mk_world()) }; unsafe { lean_io_mark_end_initialization() }; let req = Self::serialize_request(request, policies, entities); let response = unsafe { isAuthorizedDRT(req) }; Self::deserialize_response(response) + // InterfaceResponse::new(authorizer::Decision::Allow, HashSet::new(), HashSet::new()) } } diff --git a/cedar-drt/tests/integration_tests.rs b/cedar-drt/tests/integration_tests.rs index 51f94e4d5..0161a081d 100644 --- a/cedar-drt/tests/integration_tests.rs +++ b/cedar-drt/tests/integration_tests.rs @@ -35,26 +35,26 @@ fn run_integration_tests(custom_impl: &dyn CustomCedarImpl) { // currently runs (last updated 2023-09-25). let test_jsons = vec![ "decimal/1.json", - "decimal/2.json", - "example_use_cases_doc/1a.json", - "example_use_cases_doc/2a.json", - "example_use_cases_doc/2b.json", - "example_use_cases_doc/2c.json", - "example_use_cases_doc/3a.json", - "example_use_cases_doc/3b.json", - "example_use_cases_doc/3c.json", - "example_use_cases_doc/4a.json", - "example_use_cases_doc/4d.json", - "example_use_cases_doc/4e.json", - "example_use_cases_doc/4f.json", - "example_use_cases_doc/5b.json", - "ip/1.json", - "ip/2.json", - "ip/3.json", - "multi/1.json", - "multi/2.json", - "multi/3.json", - "multi/4.json", + // "decimal/2.json", + // "example_use_cases_doc/1a.json", + // "example_use_cases_doc/2a.json", + // "example_use_cases_doc/2b.json", + // "example_use_cases_doc/2c.json", + // "example_use_cases_doc/3a.json", + // "example_use_cases_doc/3b.json", + // "example_use_cases_doc/3c.json", + // "example_use_cases_doc/4a.json", + // "example_use_cases_doc/4d.json", + // "example_use_cases_doc/4e.json", + // "example_use_cases_doc/4f.json", + // "example_use_cases_doc/5b.json", + // "ip/1.json", + // "ip/2.json", + // "ip/3.json", + // "multi/1.json", + // "multi/2.json", + // "multi/3.json", + // "multi/4.json", ] .into_iter() .map(|p| integration_tests_folder.join(p)); From 4dfce156102bd0b337d37a7e6042d0726ba459a1 Mon Sep 17 00:00:00 2001 From: Andrew Wells Date: Tue, 14 Nov 2023 15:51:46 -0800 Subject: [PATCH 07/57] deserialization code --- cedar-drt/src/lean_impl.rs | 33 +++++++++++++++++++-------------- 1 file changed, 19 insertions(+), 14 deletions(-) diff --git a/cedar-drt/src/lean_impl.rs b/cedar-drt/src/lean_impl.rs index 157db2b5b..c70b02540 100644 --- a/cedar-drt/src/lean_impl.rs +++ b/cedar-drt/src/lean_impl.rs @@ -88,8 +88,24 @@ impl LeanDefinitionalEngine { } fn deserialize_response(response: *mut lean_object) -> InterfaceResponse { - println!("{:?}", response); - InterfaceResponse::new(authorizer::Decision::Allow, HashSet::new(), HashSet::new()) + let resp: ResponseDef = + serde_json::from_str(response).expect("could not convert string to json"); + let dec: authorizer::Decision = if resp.decision == "allow" { + authorizer::Decision::Allow + } else if resp.decision == "deny" { + authorizer::Decision::Deny + } else { + panic!("unknown decision") + }; + + let reason = resp + .policies + .mk + .l + .into_iter() + .map(|x| cedar_policy::PolicyId::from_str(&x).expect("could not coerce policyId")) + .collect(); + Response::new(dec, reason, HashSet::new()) } /// Ask the definitional engine whether `isAuthorized` for the given `request`, @@ -108,7 +124,6 @@ impl LeanDefinitionalEngine { let req = Self::serialize_request(request, policies, entities); let response = unsafe { isAuthorizedDRT(req) }; Self::deserialize_response(response) - // InterfaceResponse::new(authorizer::Decision::Allow, HashSet::new(), HashSet::new()) } } @@ -138,14 +153,7 @@ impl CedarTestImplementation for LeanDefinitionalEngine { _policies: &ast::PolicySet, _mode: ValidationMode, ) -> ValidationInterfaceResponse { - println!("validating"); - let parse_errors = Vec::new(); - let validation_errors = Vec::new(); - ValidationInterfaceResponse { - parse_errors, - validation_errors, - } - // unimplemented!("Unimplemented: validate"); + unimplemented!("Unimplemented: validate"); } } @@ -157,9 +165,6 @@ impl CustomCedarImpl for LeanDefinitionalEngine { policies: &ast::PolicySet, entities: &Entities, ) -> InterfaceResponse { - // println!("Performing is_authorized"); - // let decision = authorizer::Decision::Allow; - // InterfaceResponse::new(decision, HashSet::new(), HashSet::new()) self.is_authorized(request, policies, entities) } From 100750f3df37fe40c0f063a5c977fa98187a847b Mon Sep 17 00:00:00 2001 From: Andrew Wells Date: Tue, 14 Nov 2023 16:16:39 -0800 Subject: [PATCH 08/57] lean fails to deserialize --- cedar-drt/src/lean_impl.rs | 70 +++++++++++++++++++++++++++----------- 1 file changed, 51 insertions(+), 19 deletions(-) diff --git a/cedar-drt/src/lean_impl.rs b/cedar-drt/src/lean_impl.rs index c70b02540..f2ec5c800 100644 --- a/cedar-drt/src/lean_impl.rs +++ b/cedar-drt/src/lean_impl.rs @@ -32,7 +32,13 @@ pub use entities::Entities; pub use lean_sys::init::lean_initialize; pub use lean_sys::lean_object; pub use lean_sys::string::lean_mk_string; -use lean_sys::{lean_initialize_runtime_module, lean_io_mark_end_initialization, lean_io_mk_world}; +use lean_sys::{ + lean_initialize_runtime_module, lean_io_mark_end_initialization, lean_io_mk_world, + lean_string_cstr, +}; +use serde::{Deserialize, Serialize}; +use std::ffi::CStr; +use std::str::FromStr; use crate::definitional_request_types::*; @@ -57,6 +63,22 @@ extern "C" { fn initialize_DiffTest_Main(builtin: i8, ob: *mut lean_object) -> *mut lean_object; } +#[derive(Serialize, Deserialize)] +struct ListDef { + l: Vec, +} + +#[derive(Serialize, Deserialize)] +struct SetDef { + mk: ListDef, +} + +#[derive(Serialize, Deserialize)] +struct ResponseDef { + policies: SetDef, + decision: String, +} + #[derive(Debug)] pub enum LeanDefEngineError {} @@ -64,6 +86,12 @@ pub struct LeanDefinitionalEngine { initialized: bool, } +fn lean_obj_to_string(o: *mut lean_object) -> String { + let lean_obj_p = unsafe { lean_string_cstr(o) }; + let lean_obj_cstr = unsafe { CStr::from_ptr(lean_obj_p as *const i8) }; + lean_obj_cstr.to_string_lossy().into_owned() //TODO: lossy +} + impl LeanDefinitionalEngine { pub fn new() -> Result { Ok(Self { initialized: false }) @@ -88,24 +116,28 @@ impl LeanDefinitionalEngine { } fn deserialize_response(response: *mut lean_object) -> InterfaceResponse { - let resp: ResponseDef = - serde_json::from_str(response).expect("could not convert string to json"); - let dec: authorizer::Decision = if resp.decision == "allow" { - authorizer::Decision::Allow - } else if resp.decision == "deny" { - authorizer::Decision::Deny - } else { - panic!("unknown decision") - }; - - let reason = resp - .policies - .mk - .l - .into_iter() - .map(|x| cedar_policy::PolicyId::from_str(&x).expect("could not coerce policyId")) - .collect(); - Response::new(dec, reason, HashSet::new()) + let response_string = lean_obj_to_string(response); + println!("Response string:"); + println!("{response_string:?}"); + // let resp: ResponseDef = + // serde_json::from_str(&response_string).expect("could not convert string to json"); + // let dec: authorizer::Decision = if resp.decision == "allow" { + // authorizer::Decision::Allow + // } else if resp.decision == "deny" { + // authorizer::Decision::Deny + // } else { + // panic!("unknown decision") + // }; + + // let reason = resp + // .policies + // .mk + // .l + // .into_iter() + // .map(|x| cedar_policy::PolicyId::from_str(&x).expect("could not coerce policyId")) + // .collect(); + // InterfaceResponse::new(dec, reason, HashSet::new()) + InterfaceResponse::new(authorizer::Decision::Allow, HashSet::new(), HashSet::new()) } /// Ask the definitional engine whether `isAuthorized` for the given `request`, From 89455b4373bd409b6447eab68ff25b80eb58689f Mon Sep 17 00:00:00 2001 From: Andrew Wells Date: Wed, 15 Nov 2023 08:42:13 -0800 Subject: [PATCH 09/57] make stand alone diff test --- cedar-lean/.gitignore | 1 + cedar-lean/DiffTestStandAlone/Main.lean | 54 + cedar-lean/diff_test_jsons/test.json | 1332 +++++++++++++++++++++++ cedar-lean/lakefile.lean | 3 + 4 files changed, 1390 insertions(+) create mode 100644 cedar-lean/DiffTestStandAlone/Main.lean create mode 100644 cedar-lean/diff_test_jsons/test.json diff --git a/cedar-lean/.gitignore b/cedar-lean/.gitignore index f1d686650..bd043b696 100644 --- a/cedar-lean/.gitignore +++ b/cedar-lean/.gitignore @@ -5,3 +5,4 @@ !lake-manifest.json *.olean +!/diff_test_jsons/*.json \ No newline at end of file diff --git a/cedar-lean/DiffTestStandAlone/Main.lean b/cedar-lean/DiffTestStandAlone/Main.lean new file mode 100644 index 000000000..82fab697e --- /dev/null +++ b/cedar-lean/DiffTestStandAlone/Main.lean @@ -0,0 +1,54 @@ +/- + Copyright 2022-2023 Amazon.com, Inc. or its affiliates. All Rights Reserved. + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + https://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +-/ + +import Lean.Data.Json.FromToJson + +import Cedar.Spec +import DiffTest.Parser + +/-! This file defines the public interfaces for the Lean implementation. + The input and output are stringified JSON objects. -/ + +open Cedar.Spec +open Cedar.Data +open DiffTest + +def fileStream (filename : System.FilePath) : IO (Option IO.FS.Stream) := do + let fileExists ← filename.pathExists + if not fileExists then + let stderr ← IO.getStderr + stderr.putStrLn s!"File not found: {filename}" + pure none + else + let handle ← IO.FS.Handle.mk filename IO.FS.Mode.read + pure (some (IO.FS.Stream.ofHandle handle)) + +def readFile (filename : String) : IO String := + IO.FS.readFile filename + + +def main (args : List String) : IO Unit := + match args.length with + | 1 => do + let filename := args.head! + let req ← readFile filename + let json := Lean.Json.parse req + let request := jsonToRequest json + let entities := jsonToEntities json + let policies := jsonToPolicies json + let json := Lean.toJson (isAuthorized request entities policies) + IO.println (toString json) + | _ => IO.println s!"Incorrect number of arguments" diff --git a/cedar-lean/diff_test_jsons/test.json b/cedar-lean/diff_test_jsons/test.json new file mode 100644 index 000000000..bbbba3a8f --- /dev/null +++ b/cedar-lean/diff_test_jsons/test.json @@ -0,0 +1,1332 @@ +{ + "request": { + "principal": { + "Concrete": { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + }, + "action": { + "Concrete": { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource": { + "Concrete": { + "ty": { + "Concrete": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + } + }, + "context": { + "expr_kind": { + "Record": { + "authenticated": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "confidence_score": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "decimal", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "0.8" + } + }, + "source_info": null, + "data": null + } + ] + } + }, + "source_info": null, + "data": null + }, + "source_ip": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "ip", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "123.123.123.123" + } + }, + "source_info": null, + "data": null + } + ] + } + }, + "source_info": null, + "data": null + } + } + }, + "source_info": null, + "data": null + } + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": { + "Eq": { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Concrete": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "greaterThan", + "path": [] + }, + "args": [ + { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 102, + "end": 109 + }, + "data": null + }, + "attr": "confidence_score" + } + }, + "source_info": { + "start": 102, + "end": 155 + }, + "data": null + }, + { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "decimal", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "0.75" + } + }, + "source_info": { + "start": 147, + "end": 153 + }, + "data": null + } + ] + } + }, + "source_info": { + "start": 139, + "end": 154 + }, + "data": null + } + ] + } + }, + "source_info": { + "start": 102, + "end": 155 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "entities": { + "entities": [ + [ + { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Photo", + "path": [] + } + }, + "eid": "vacation.jpg" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Photo", + "path": [] + } + }, + "eid": "vacation.jpg" + }, + "attrs": { + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Concrete": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + { + "ty": { + "Concrete": { + "id": "Album", + "path": [] + } + }, + "eid": "alice_vacation" + }, + { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + ] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Photo", + "path": [] + } + }, + "eid": "sales_projections.jpg" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Photo", + "path": [] + } + }, + "eid": "sales_projections.jpg" + }, + "attrs": { + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [ + { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "giuseppe" + } + } + }, + "source_info": null, + "data": null + } + ] + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + } + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + } + ] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Album", + "path": [] + } + }, + "eid": "device_prototypes" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Album", + "path": [] + } + }, + "eid": "device_prototypes" + }, + "attrs": { + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Photo", + "path": [] + } + }, + "eid": "alice_w2.jpg" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Photo", + "path": [] + } + }, + "eid": "alice_w2.jpg" + }, + "attrs": { + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + }, + { + "ty": { + "Concrete": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + } + ] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "ahmad" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "ahmad" + }, + "attrs": { + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "ahmad" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Concrete": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + } + ] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + "attrs": { + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 5 + } + }, + "source_info": null, + "data": null + }, + "department": { + "expr_kind": { + "Lit": { + "String": "HardwareEngineering" + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Concrete": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + }, + { + "ty": { + "Concrete": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + } + ] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "stacey" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "stacey" + }, + "attrs": { + "department": { + "expr_kind": { + "Lit": { + "String": "Sales" + } + }, + "source_info": null, + "data": null + }, + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 6 + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Concrete": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + } + ] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "ahmad" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "ahmad" + }, + "attrs": { + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 4 + } + }, + "source_info": null, + "data": null + }, + "department": { + "expr_kind": { + "Lit": { + "String": "HardwareEngineering" + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + "attrs": { + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Photo", + "path": [] + } + }, + "eid": "prototype_v0.jpg" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Photo", + "path": [] + } + }, + "eid": "prototype_v0.jpg" + }, + "attrs": { + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "ahmad" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Concrete": { + "id": "Album", + "path": [] + } + }, + "eid": "device_prototypes" + } + ] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "giuseppe" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "giuseppe" + }, + "attrs": { + "department": { + "expr_kind": { + "Lit": { + "String": "CustomerSupport" + } + }, + "source_info": null, + "data": null + }, + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 7 + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Concrete": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + } + ] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Album", + "path": [] + } + }, + "eid": "alice_vacation" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Album", + "path": [] + } + }, + "eid": "alice_vacation" + }, + "attrs": { + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Concrete": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + ] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + }, + "attrs": { + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Concrete": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + } + ] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + }, + "attrs": { + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "stacey" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ] + ] + } +} \ No newline at end of file diff --git a/cedar-lean/lakefile.lean b/cedar-lean/lakefile.lean index fcb7d6385..85f207acf 100644 --- a/cedar-lean/lakefile.lean +++ b/cedar-lean/lakefile.lean @@ -33,3 +33,6 @@ lean_lib DiffTest where lean_exe CedarUnitTests where root := `UnitTest.Main + +lean_exe DiffTestStandAlone where + root := `DiffTestStandAlone.Main From 64bca022cb37078114ff819d09bdff540714eaca Mon Sep 17 00:00:00 2001 From: Andrew Wells Date: Wed, 15 Nov 2023 08:59:59 -0800 Subject: [PATCH 10/57] smaller test --- cedar-lean/diff_test_jsons/test_small.json | 389 +++++++++++++++++++++ 1 file changed, 389 insertions(+) create mode 100644 cedar-lean/diff_test_jsons/test_small.json diff --git a/cedar-lean/diff_test_jsons/test_small.json b/cedar-lean/diff_test_jsons/test_small.json new file mode 100644 index 000000000..8edc22084 --- /dev/null +++ b/cedar-lean/diff_test_jsons/test_small.json @@ -0,0 +1,389 @@ +{ + "request": { + "principal": { + "Concrete": { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + }, + "action": { + "Concrete": { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource": { + "Concrete": { + "ty": { + "Concrete": { + "id": "Photo", + "path": [] + } + }, + "eid": "vacation.jpg" + } + }, + "context": { + "expr_kind": { + "Record": { + "authenticated": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": null, + "data": null + }, + "confidence_score": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "decimal", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "0.6" + } + }, + "source_info": null, + "data": null + } + ] + } + }, + "source_info": null, + "data": null + }, + "source_ip": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "ip", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "123.123.123.123" + } + }, + "source_info": null, + "data": null + } + ] + } + }, + "source_info": null, + "data": null + } + } + }, + "source_info": null, + "data": null + } + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + } + }, + "action_constraint": { + "Eq": { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Concrete": { + "id": "Photo", + "path": [] + } + }, + "eid": "vacation.jpg" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 56, + "end": 161 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "entities": { + "entities": [ + [ + { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Photo", + "path": [] + } + }, + "eid": "vacation.jpg" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Photo", + "path": [] + } + }, + "eid": "vacation.jpg" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "attrs": {}, + "ancestors": [] + } + ] + ] + } +} \ No newline at end of file From e0466debbcadbd30c556f6456e2a60dc71c80a81 Mon Sep 17 00:00:00 2001 From: Andrew Wells Date: Wed, 15 Nov 2023 11:16:46 -0800 Subject: [PATCH 11/57] checkpoint --- cedar-lean/Cedar/Spec/Request.lean | 2 +- cedar-lean/Cedar/Spec/Response.lean | 10 +- cedar-lean/DiffTest/Parser.lean | 2 +- cedar-lean/DiffTestStandAlone/Main.lean | 18 +- cedar-lean/diff_test_jsons/test_smaller.json | 189 +++++++++++++++++++ 5 files changed, 210 insertions(+), 11 deletions(-) create mode 100644 cedar-lean/diff_test_jsons/test_smaller.json diff --git a/cedar-lean/Cedar/Spec/Request.lean b/cedar-lean/Cedar/Spec/Request.lean index 06af6cb8a..3d4677f31 100644 --- a/cedar-lean/Cedar/Spec/Request.lean +++ b/cedar-lean/Cedar/Spec/Request.lean @@ -35,4 +35,4 @@ deriving instance Repr for Request deriving instance DecidableEq for Request deriving instance Inhabited for Request -end Cedar.Spec \ No newline at end of file +end Cedar.Spec diff --git a/cedar-lean/Cedar/Spec/Response.lean b/cedar-lean/Cedar/Spec/Response.lean index 1e38495e9..0a9dfee4b 100644 --- a/cedar-lean/Cedar/Spec/Response.lean +++ b/cedar-lean/Cedar/Spec/Response.lean @@ -29,19 +29,21 @@ open Cedar.Data inductive Decision where | allow | deny +deriving Repr, DecidableEq structure Response where decision : Decision policies : Set PolicyID +deriving Repr, DecidableEq ----- Derivations ----- -deriving instance Repr for Decision, Response +-- deriving instance Repr for Decision, Response -deriving instance DecidableEq for Decision -deriving instance DecidableEq for Response +-- deriving instance DecidableEq for Decision +-- deriving instance DecidableEq for Response deriving instance Lean.ToJson for Decision deriving instance Lean.ToJson for Response -end Cedar.Spec \ No newline at end of file +end Cedar.Spec diff --git a/cedar-lean/DiffTest/Parser.lean b/cedar-lean/DiffTest/Parser.lean index 5b78c7205..2c878f88f 100644 --- a/cedar-lean/DiffTest/Parser.lean +++ b/cedar-lean/DiffTest/Parser.lean @@ -323,7 +323,7 @@ def jsonToContext (json : Except String Lean.Json) : Map Attr Value := match jso let keys := List.map strNodeToString kvs.fst let vals := List.map (jsonToValue ∘ Except.ok) kvs.snd Map.mk (List.zip keys vals) - | _ => panic! "sorry" + | _ => Map.empty partial def jsonToRequest (json : Except String Lean.Json) : Request := match json.isOk with | false => panic! "sorry" diff --git a/cedar-lean/DiffTestStandAlone/Main.lean b/cedar-lean/DiffTestStandAlone/Main.lean index 82fab697e..70ec97124 100644 --- a/cedar-lean/DiffTestStandAlone/Main.lean +++ b/cedar-lean/DiffTestStandAlone/Main.lean @@ -19,6 +19,7 @@ import Lean.Data.Json.FromToJson import Cedar.Spec import DiffTest.Parser + /-! This file defines the public interfaces for the Lean implementation. The input and output are stringified JSON objects. -/ @@ -26,6 +27,7 @@ open Cedar.Spec open Cedar.Data open DiffTest + def fileStream (filename : System.FilePath) : IO (Option IO.FS.Stream) := do let fileExists ← filename.pathExists if not fileExists then @@ -39,7 +41,6 @@ def fileStream (filename : System.FilePath) : IO (Option IO.FS.Stream) := do def readFile (filename : String) : IO String := IO.FS.readFile filename - def main (args : List String) : IO Unit := match args.length with | 1 => do @@ -47,8 +48,15 @@ def main (args : List String) : IO Unit := let req ← readFile filename let json := Lean.Json.parse req let request := jsonToRequest json - let entities := jsonToEntities json - let policies := jsonToPolicies json - let json := Lean.toJson (isAuthorized request entities policies) - IO.println (toString json) + IO.println (repr request) + -- let entities := jsonToEntities json + -- IO.println (repr entities) + -- let policies := jsonToPolicies json + -- IO.println (repr policies) + + -- let response := isAuthorized request entities policies + -- IO.println "Response: " + -- IO.println (repr response) + -- let json := Lean.toJson response + -- IO.println (toString json) | _ => IO.println s!"Incorrect number of arguments" diff --git a/cedar-lean/diff_test_jsons/test_smaller.json b/cedar-lean/diff_test_jsons/test_smaller.json new file mode 100644 index 000000000..0d22edc62 --- /dev/null +++ b/cedar-lean/diff_test_jsons/test_smaller.json @@ -0,0 +1,189 @@ +{ + "request": { + "principal": { + "Concrete": { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + }, + "action": { + "Concrete": { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource": { + "Concrete": { + "ty": { + "Concrete": { + "id": "Photo", + "path": [] + } + }, + "eid": "vacation.jpg" + } + }, + "context": { + "expr_kind": { + "Record": {} + }, + "source_info": null, + "data": null + } + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + } + }, + "action_constraint": { + "Eq": { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Concrete": { + "id": "Photo", + "path": [] + } + }, + "eid": "vacation.jpg" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 56, + "end": 161 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "entities": { + "entities": [ + [ + { + "ty": { + "Concrete": { + "id": "Photo", + "path": [] + } + }, + "eid": "vacation.jpg" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Photo", + "path": [] + } + }, + "eid": "vacation.jpg" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "attrs": {}, + "ancestors": [] + } + ] + ] + } +} \ No newline at end of file From 7034a7b9ba14546493cd5b6d0830ed3486d9f649 Mon Sep 17 00:00:00 2001 From: Andrew Wells Date: Wed, 15 Nov 2023 14:07:11 -0800 Subject: [PATCH 12/57] checkpoint --- cedar-lean/DiffTestStandAlone/Main.lean | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/cedar-lean/DiffTestStandAlone/Main.lean b/cedar-lean/DiffTestStandAlone/Main.lean index 70ec97124..7155270bf 100644 --- a/cedar-lean/DiffTestStandAlone/Main.lean +++ b/cedar-lean/DiffTestStandAlone/Main.lean @@ -46,9 +46,10 @@ def main (args : List String) : IO Unit := | 1 => do let filename := args.head! let req ← readFile filename + IO.println (req) let json := Lean.Json.parse req - let request := jsonToRequest json - IO.println (repr request) + --let request := jsonToRequest json + --IO.println (repr request) -- let entities := jsonToEntities json -- IO.println (repr entities) -- let policies := jsonToPolicies json From e90ea11ab66ae3371bacb48dd24380223d1edc00 Mon Sep 17 00:00:00 2001 From: Andrew Wells Date: Wed, 15 Nov 2023 15:51:11 -0800 Subject: [PATCH 13/57] confusing issue --- cedar-lean/DiffTest/Parser.lean | 33 ++++++++++++++++++++----- cedar-lean/DiffTestStandAlone/Main.lean | 17 ++++++------- 2 files changed, 35 insertions(+), 15 deletions(-) diff --git a/cedar-lean/DiffTest/Parser.lean b/cedar-lean/DiffTest/Parser.lean index 2c878f88f..88b7e8998 100644 --- a/cedar-lean/DiffTest/Parser.lean +++ b/cedar-lean/DiffTest/Parser.lean @@ -325,6 +325,19 @@ def jsonToContext (json : Except String Lean.Json) : Map Attr Value := match jso Map.mk (List.zip keys vals) | _ => Map.empty +def myPrincipalEUID : EntityUID := + {ty := {id:= "User", path := []}, eid := "alice"} +def myActionEUID : EntityUID := + {ty := {id:= "Action", path := []}, eid := "view"} +def myResourceEUID : EntityUID := + {ty := {id:= "Photo", path := []}, eid := "vacation.jpg"} + +def myJsonRequest : Request := + {principal := myPrincipalEUID, action := myActionEUID, resource := myResourceEUID, context := Map.empty} + +def myStr : String := "{\"request\": {\"resource\": {\"Concrete\": {\"ty\": {\"Concrete\": {\"path\": [], \"id\": \"Photo\"}}, \"eid\": \"vacation.jpg\"}}, \"principal\": {\"Concrete\": {\"ty\": {\"Concrete\": {\"path\": [], \"id\": \"User\"}}, \"eid\": \"alice\"}}, \"context\": {\"source_info\": null, \"expr_kind\": {\"Record\": {}}, \"data\": null}, \"action\": {\"Concrete\": {\"ty\": {\"Concrete\": {\"path\": [], \"id\": \"Action\"}}, \"eid\": \"view\"}}}, \"policies\": {\"templates\": {\"policy0\": {\"resource_constraint\": {\"constraint\": {\"Eq\": {\"EUID\": {\"ty\": {\"Concrete\": {\"path\": [], \"id\": \"Photo\"}}, \"eid\": \"vacation.jpg\"}}}}, \"principal_constraint\": {\"constraint\": {\"Eq\": {\"EUID\": {\"ty\": {\"Concrete\": {\"path\": [], \"id\": \"User\"}}, \"eid\": \"alice\"}}}}, \"non_head_constraints\": {\"source_info\": {\"start\": 56, \"end\": 161}, \"expr_kind\": {\"Lit\": {\"Bool\": true}}, \"data\": null}, \"id\": \"policy0\", \"effect\": \"permit\", \"annotations\": {}, \"action_constraint\": {\"Eq\": {\"ty\": {\"Concrete\": {\"path\": [], \"id\": \"Action\"}}, \"eid\": \"view\"}}}}, \"links\": {\"policy0\": {\"values\": {}, \"template_id\": \"policy0\", \"link_id\": null}}}, \"entities\": {\"entities\": [[{\"ty\": {\"Concrete\": {\"path\": [], \"id\": \"Photo\"}}, \"eid\": \"vacation.jpg\"}, {\"uid\": {\"ty\": {\"Concrete\": {\"path\": [], \"id\": \"Photo\"}}, \"eid\": \"vacation.jpg\"}, \"attrs\": {}, \"ancestors\": []}], [{\"ty\": {\"Concrete\": {\"path\": [], \"id\": \"User\"}}, \"eid\": \"alice\"}, {\"uid\": {\"ty\": {\"Concrete\": {\"path\": [], \"id\": \"User\"}}, \"eid\": \"alice\"}, \"attrs\": {}, \"ancestors\": []}], [{\"ty\": {\"Concrete\": {\"path\": [], \"id\": \"Action\"}}, \"eid\": \"view\"}, {\"uid\": {\"ty\": {\"Concrete\": {\"path\": [], \"id\": \"Action\"}}, \"eid\": \"view\"}, \"attrs\": {}, \"ancestors\": []}]]}}" +def myJson := Lean.Json.parse myStr + partial def jsonToRequest (json : Except String Lean.Json) : Request := match json.isOk with | false => panic! "sorry" | true => @@ -334,12 +347,16 @@ partial def jsonToRequest (json : Except String Lean.Json) : Request := match js let action := jsonToEUID ((unwrapExcept (json.getObjVal? "action")).getObjVal? "Concrete") let resource := jsonToEUID ((unwrapExcept (json.getObjVal? "resource")).getObjVal? "Concrete") let context := (jsonToContext ∘ json.getObjVal?) "context" - { - principal := principal, - action := action, - resource := resource, - context := context - } + -- { + -- principal := principal, + -- action := action, + -- resource := resource, + -- context := context + -- } + myJsonRequest + +#eval jsonToRequest myJson +#eval myJsonRequest == jsonToRequest myJson def jsonToEntityData (json : Except String Lean.Json) : EntityData := match json.isOk with | false => panic! "sorry" @@ -442,6 +459,10 @@ def jsonToPolicy (json : Except String Lean.Json) : Policy := match json.isOk wi condition := condition } +-- def myPolicy : Policy := +-- {id := "policy0", effect := Effect.permit, principalScope := PrincipalScope.principalScope Scope.any, actionScope := ActionScope.actionScope Scope.any, resourceScope := ResourceScope.resourceScope Scope.any, condition := Expr.lit (Prim.bool true): Policy} + + -- for now, doesn't include policy templates. -- a static policy is just a policy template with no blanks. def jsonToPolicies (json : Except String Lean.Json) : Policies := match json.isOk with diff --git a/cedar-lean/DiffTestStandAlone/Main.lean b/cedar-lean/DiffTestStandAlone/Main.lean index 7155270bf..1ceae7819 100644 --- a/cedar-lean/DiffTestStandAlone/Main.lean +++ b/cedar-lean/DiffTestStandAlone/Main.lean @@ -46,18 +46,17 @@ def main (args : List String) : IO Unit := | 1 => do let filename := args.head! let req ← readFile filename - IO.println (req) let json := Lean.Json.parse req - --let request := jsonToRequest json - --IO.println (repr request) - -- let entities := jsonToEntities json + IO.println (toString json) + let request := jsonToRequest json + -- IO.println (repr request) + let entities := jsonToEntities json -- IO.println (repr entities) - -- let policies := jsonToPolicies json + let policies := jsonToPolicies json -- IO.println (repr policies) - - -- let response := isAuthorized request entities policies + let response := isAuthorized request entities policies -- IO.println "Response: " -- IO.println (repr response) - -- let json := Lean.toJson response - -- IO.println (toString json) + let json := Lean.toJson response + IO.println (toString json) | _ => IO.println s!"Incorrect number of arguments" From 5c120c0cec3910342624d2ea3889b98d24e4eeae Mon Sep 17 00:00:00 2001 From: Andrew Wells Date: Wed, 15 Nov 2023 16:35:36 -0800 Subject: [PATCH 14/57] fix jsonToContext --- cedar-lean/DiffTest/Parser.lean | 36 ++++++++++++++++----------------- 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/cedar-lean/DiffTest/Parser.lean b/cedar-lean/DiffTest/Parser.lean index 88b7e8998..ac0de711f 100644 --- a/cedar-lean/DiffTest/Parser.lean +++ b/cedar-lean/DiffTest/Parser.lean @@ -317,13 +317,13 @@ def jsonToContext (json : Except String Lean.Json) : Map Attr Value := match jso | true => let json := Option.get! json.toOption let pairs_arr := unwrapExcept ((unwrapExcept (json.getObjVal? "expr_kind")).getObjVal? "Record") - match unwrapExcept (pairs_arr.getObjVal? "pairs") with - | Lean.Json.arr pairs_json => - let kvs := arrayToKVPairList pairs_json - let keys := List.map strNodeToString kvs.fst - let vals := List.map (jsonToValue ∘ Except.ok) kvs.snd - Map.mk (List.zip keys vals) - | _ => Map.empty + match pairs_arr with + | Lean.Json.obj obj => + let pairs := (obj.fold (fun l s j => (s,j) :: l) []) + let keys := List.map Prod.fst pairs + let vals := List.map (jsonToValue ∘ Except.ok ∘ Prod.snd) pairs + Map.mk (List.zip keys vals) + | _ => panic! "uh oh" def myPrincipalEUID : EntityUID := {ty := {id:= "User", path := []}, eid := "alice"} @@ -346,17 +346,17 @@ partial def jsonToRequest (json : Except String Lean.Json) : Request := match js let principal := jsonToEUID ((unwrapExcept (json.getObjVal? "principal")).getObjVal? "Concrete") let action := jsonToEUID ((unwrapExcept (json.getObjVal? "action")).getObjVal? "Concrete") let resource := jsonToEUID ((unwrapExcept (json.getObjVal? "resource")).getObjVal? "Concrete") - let context := (jsonToContext ∘ json.getObjVal?) "context" - -- { - -- principal := principal, - -- action := action, - -- resource := resource, - -- context := context - -- } - myJsonRequest - -#eval jsonToRequest myJson -#eval myJsonRequest == jsonToRequest myJson + let context := jsonToContext (json.getObjVal? "context") + { + principal := principal, + action := action, + resource := resource, + context := context, + } + -- myJsonRequest + +-- #eval jsonToRequest myJson +-- #eval myJsonRequest == jsonToRequest myJson def jsonToEntityData (json : Except String Lean.Json) : EntityData := match json.isOk with | false => panic! "sorry" From 0ba105e81c3f15b0923b342106cab3dcbe819667 Mon Sep 17 00:00:00 2001 From: Andrew Wells Date: Wed, 15 Nov 2023 16:36:44 -0800 Subject: [PATCH 15/57] remove debugging code --- cedar-lean/DiffTest/Parser.lean | 17 ----------------- cedar-lean/DiffTestStandAlone/Main.lean | 6 ------ 2 files changed, 23 deletions(-) diff --git a/cedar-lean/DiffTest/Parser.lean b/cedar-lean/DiffTest/Parser.lean index ac0de711f..ba10a0706 100644 --- a/cedar-lean/DiffTest/Parser.lean +++ b/cedar-lean/DiffTest/Parser.lean @@ -325,19 +325,6 @@ def jsonToContext (json : Except String Lean.Json) : Map Attr Value := match jso Map.mk (List.zip keys vals) | _ => panic! "uh oh" -def myPrincipalEUID : EntityUID := - {ty := {id:= "User", path := []}, eid := "alice"} -def myActionEUID : EntityUID := - {ty := {id:= "Action", path := []}, eid := "view"} -def myResourceEUID : EntityUID := - {ty := {id:= "Photo", path := []}, eid := "vacation.jpg"} - -def myJsonRequest : Request := - {principal := myPrincipalEUID, action := myActionEUID, resource := myResourceEUID, context := Map.empty} - -def myStr : String := "{\"request\": {\"resource\": {\"Concrete\": {\"ty\": {\"Concrete\": {\"path\": [], \"id\": \"Photo\"}}, \"eid\": \"vacation.jpg\"}}, \"principal\": {\"Concrete\": {\"ty\": {\"Concrete\": {\"path\": [], \"id\": \"User\"}}, \"eid\": \"alice\"}}, \"context\": {\"source_info\": null, \"expr_kind\": {\"Record\": {}}, \"data\": null}, \"action\": {\"Concrete\": {\"ty\": {\"Concrete\": {\"path\": [], \"id\": \"Action\"}}, \"eid\": \"view\"}}}, \"policies\": {\"templates\": {\"policy0\": {\"resource_constraint\": {\"constraint\": {\"Eq\": {\"EUID\": {\"ty\": {\"Concrete\": {\"path\": [], \"id\": \"Photo\"}}, \"eid\": \"vacation.jpg\"}}}}, \"principal_constraint\": {\"constraint\": {\"Eq\": {\"EUID\": {\"ty\": {\"Concrete\": {\"path\": [], \"id\": \"User\"}}, \"eid\": \"alice\"}}}}, \"non_head_constraints\": {\"source_info\": {\"start\": 56, \"end\": 161}, \"expr_kind\": {\"Lit\": {\"Bool\": true}}, \"data\": null}, \"id\": \"policy0\", \"effect\": \"permit\", \"annotations\": {}, \"action_constraint\": {\"Eq\": {\"ty\": {\"Concrete\": {\"path\": [], \"id\": \"Action\"}}, \"eid\": \"view\"}}}}, \"links\": {\"policy0\": {\"values\": {}, \"template_id\": \"policy0\", \"link_id\": null}}}, \"entities\": {\"entities\": [[{\"ty\": {\"Concrete\": {\"path\": [], \"id\": \"Photo\"}}, \"eid\": \"vacation.jpg\"}, {\"uid\": {\"ty\": {\"Concrete\": {\"path\": [], \"id\": \"Photo\"}}, \"eid\": \"vacation.jpg\"}, \"attrs\": {}, \"ancestors\": []}], [{\"ty\": {\"Concrete\": {\"path\": [], \"id\": \"User\"}}, \"eid\": \"alice\"}, {\"uid\": {\"ty\": {\"Concrete\": {\"path\": [], \"id\": \"User\"}}, \"eid\": \"alice\"}, \"attrs\": {}, \"ancestors\": []}], [{\"ty\": {\"Concrete\": {\"path\": [], \"id\": \"Action\"}}, \"eid\": \"view\"}, {\"uid\": {\"ty\": {\"Concrete\": {\"path\": [], \"id\": \"Action\"}}, \"eid\": \"view\"}, \"attrs\": {}, \"ancestors\": []}]]}}" -def myJson := Lean.Json.parse myStr - partial def jsonToRequest (json : Except String Lean.Json) : Request := match json.isOk with | false => panic! "sorry" | true => @@ -353,10 +340,6 @@ partial def jsonToRequest (json : Except String Lean.Json) : Request := match js resource := resource, context := context, } - -- myJsonRequest - --- #eval jsonToRequest myJson --- #eval myJsonRequest == jsonToRequest myJson def jsonToEntityData (json : Except String Lean.Json) : EntityData := match json.isOk with | false => panic! "sorry" diff --git a/cedar-lean/DiffTestStandAlone/Main.lean b/cedar-lean/DiffTestStandAlone/Main.lean index 1ceae7819..0708c43b8 100644 --- a/cedar-lean/DiffTestStandAlone/Main.lean +++ b/cedar-lean/DiffTestStandAlone/Main.lean @@ -47,16 +47,10 @@ def main (args : List String) : IO Unit := let filename := args.head! let req ← readFile filename let json := Lean.Json.parse req - IO.println (toString json) let request := jsonToRequest json - -- IO.println (repr request) let entities := jsonToEntities json - -- IO.println (repr entities) let policies := jsonToPolicies json - -- IO.println (repr policies) let response := isAuthorized request entities policies - -- IO.println "Response: " - -- IO.println (repr response) let json := Lean.toJson response IO.println (toString json) | _ => IO.println s!"Incorrect number of arguments" From 39f373198238ada408b2acacc6e6949268255125 Mon Sep 17 00:00:00 2001 From: Andrew Wells Date: Wed, 15 Nov 2023 16:39:59 -0800 Subject: [PATCH 16/57] more cleanup --- cedar-lean/DiffTest/Parser.lean | 4 ---- 1 file changed, 4 deletions(-) diff --git a/cedar-lean/DiffTest/Parser.lean b/cedar-lean/DiffTest/Parser.lean index ba10a0706..0894487ad 100644 --- a/cedar-lean/DiffTest/Parser.lean +++ b/cedar-lean/DiffTest/Parser.lean @@ -442,10 +442,6 @@ def jsonToPolicy (json : Except String Lean.Json) : Policy := match json.isOk wi condition := condition } --- def myPolicy : Policy := --- {id := "policy0", effect := Effect.permit, principalScope := PrincipalScope.principalScope Scope.any, actionScope := ActionScope.actionScope Scope.any, resourceScope := ResourceScope.resourceScope Scope.any, condition := Expr.lit (Prim.bool true): Policy} - - -- for now, doesn't include policy templates. -- a static policy is just a policy template with no blanks. def jsonToPolicies (json : Except String Lean.Json) : Policies := match json.isOk with From cb5624f123b5f6a5c6ceb5236975644f10104b85 Mon Sep 17 00:00:00 2001 From: Andrew Wells Date: Wed, 15 Nov 2023 17:14:25 -0800 Subject: [PATCH 17/57] failing JSON for 5b --- cedar-lean/diff_test_jsons/5b.json | 1585 ++++++++++++++++++++++++++++ 1 file changed, 1585 insertions(+) create mode 100644 cedar-lean/diff_test_jsons/5b.json diff --git a/cedar-lean/diff_test_jsons/5b.json b/cedar-lean/diff_test_jsons/5b.json new file mode 100644 index 000000000..0e88d6ee6 --- /dev/null +++ b/cedar-lean/diff_test_jsons/5b.json @@ -0,0 +1,1585 @@ +{ + "request": { + "principal": { + "Concrete": { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "ahmad" + } + }, + "action": { + "Concrete": { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + } + }, + "resource": { + "Concrete": { + "ty": { + "Concrete": { + "id": "Album", + "path": [] + } + }, + "eid": "alice_vacation" + } + }, + "context": { + "expr_kind": { + "Record": { + "authenticated": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": null, + "data": null + }, + "photo": { + "expr_kind": { + "Record": { + "filesize_mb": { + "expr_kind": { + "Lit": { + "Long": 1 + } + }, + "source_info": null, + "data": null + }, + "filetype": { + "expr_kind": { + "Lit": { + "String": "PNG" + } + }, + "source_info": null, + "data": null + } + } + }, + "source_info": null, + "data": null + } + } + }, + "source_info": null, + "data": null + } + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": { + "Eq": { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + } + }, + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Or": { + "left": { + "expr_kind": { + "And": { + "left": { + "expr_kind": { + "BinaryApp": { + "op": "Contains", + "arg1": { + "expr_kind": { + "Set": [ + { + "expr_kind": { + "Lit": { + "String": "JPEG" + } + }, + "source_info": { + "start": 322, + "end": 328 + }, + "data": null + }, + { + "expr_kind": { + "Lit": { + "String": "PNG" + } + }, + "source_info": { + "start": 330, + "end": 335 + }, + "data": null + } + ] + }, + "source_info": { + "start": 321, + "end": 336 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 346, + "end": 353 + }, + "data": null + }, + "attr": "photo" + } + }, + "source_info": { + "start": 346, + "end": 368 + }, + "data": null + }, + "attr": "filetype" + } + }, + "source_info": { + "start": 346, + "end": 368 + }, + "data": null + } + } + }, + "source_info": { + "start": 321, + "end": 369 + }, + "data": null + }, + "right": { + "expr_kind": { + "BinaryApp": { + "op": "LessEq", + "arg1": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 376, + "end": 383 + }, + "data": null + }, + "attr": "photo" + } + }, + "source_info": { + "start": 376, + "end": 401 + }, + "data": null + }, + "attr": "filesize_mb" + } + }, + "source_info": { + "start": 376, + "end": 401 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "Lit": { + "Long": 1 + } + }, + "source_info": { + "start": 405, + "end": 406 + }, + "data": null + } + } + }, + "source_info": { + "start": 376, + "end": 406 + }, + "data": null + } + } + }, + "source_info": { + "start": 321, + "end": 406 + }, + "data": null + }, + "right": { + "expr_kind": { + "And": { + "left": { + "expr_kind": { + "And": { + "left": { + "expr_kind": { + "BinaryApp": { + "op": "Eq", + "arg1": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 414, + "end": 421 + }, + "data": null + }, + "attr": "photo" + } + }, + "source_info": { + "start": 414, + "end": 436 + }, + "data": null + }, + "attr": "filetype" + } + }, + "source_info": { + "start": 414, + "end": 436 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "Lit": { + "String": "RAW" + } + }, + "source_info": { + "start": 440, + "end": 445 + }, + "data": null + } + } + }, + "source_info": { + "start": 414, + "end": 445 + }, + "data": null + }, + "right": { + "expr_kind": { + "BinaryApp": { + "op": "LessEq", + "arg1": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 452, + "end": 459 + }, + "data": null + }, + "attr": "photo" + } + }, + "source_info": { + "start": 452, + "end": 477 + }, + "data": null + }, + "attr": "filesize_mb" + } + }, + "source_info": { + "start": 452, + "end": 477 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "Lit": { + "Long": 100 + } + }, + "source_info": { + "start": 481, + "end": 484 + }, + "data": null + } + } + }, + "source_info": { + "start": 452, + "end": 484 + }, + "data": null + } + } + }, + "source_info": { + "start": 414, + "end": 523 + }, + "data": null + }, + "right": { + "expr_kind": { + "BinaryApp": { + "op": "In", + "arg1": { + "expr_kind": { + "Var": "principal" + }, + "source_info": { + "start": 491, + "end": 500 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Concrete": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + } + } + }, + "source_info": { + "start": 504, + "end": 523 + }, + "data": null + } + } + }, + "source_info": { + "start": 491, + "end": 523 + }, + "data": null + } + } + }, + "source_info": { + "start": 414, + "end": 523 + }, + "data": null + } + } + }, + "source_info": { + "start": 320, + "end": 524 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "entities": { + "entities": [ + [ + { + "ty": { + "Concrete": { + "id": "Album", + "path": [] + } + }, + "eid": "device_prototypes" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Album", + "path": [] + } + }, + "eid": "device_prototypes" + }, + "attrs": { + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Photo", + "path": [] + } + }, + "eid": "prototype_v0.jpg" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Photo", + "path": [] + } + }, + "eid": "prototype_v0.jpg" + }, + "attrs": { + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "ahmad" + } + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Concrete": { + "id": "Album", + "path": [] + } + }, + "eid": "device_prototypes" + } + ] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "giuseppe" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "giuseppe" + }, + "attrs": { + "department": { + "expr_kind": { + "Lit": { + "String": "CustomerSupport" + } + }, + "source_info": null, + "data": null + }, + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 7 + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Concrete": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + } + ] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "ahmad" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "ahmad" + }, + "attrs": { + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "ahmad" + } + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Concrete": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + } + ] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "ahmad" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "ahmad" + }, + "attrs": { + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 4 + } + }, + "source_info": null, + "data": null + }, + "department": { + "expr_kind": { + "Lit": { + "String": "HardwareEngineering" + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + }, + "attrs": { + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Concrete": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + } + ] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "stacey" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "stacey" + }, + "attrs": { + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 6 + } + }, + "source_info": null, + "data": null + }, + "department": { + "expr_kind": { + "Lit": { + "String": "Sales" + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Concrete": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + } + ] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + "attrs": { + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + "attrs": { + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 5 + } + }, + "source_info": null, + "data": null + }, + "department": { + "expr_kind": { + "Lit": { + "String": "HardwareEngineering" + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Concrete": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + }, + { + "ty": { + "Concrete": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + } + ] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Photo", + "path": [] + } + }, + "eid": "sales_projections.jpg" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Photo", + "path": [] + } + }, + "eid": "sales_projections.jpg" + }, + "attrs": { + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [ + { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "giuseppe" + } + } + }, + "source_info": null, + "data": null + } + ] + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + } + ] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Photo", + "path": [] + } + }, + "eid": "alice_w2.jpg" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Photo", + "path": [] + } + }, + "eid": "alice_w2.jpg" + }, + "attrs": { + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + }, + { + "ty": { + "Concrete": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + } + ] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Album", + "path": [] + } + }, + "eid": "alice_vacation" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Album", + "path": [] + } + }, + "eid": "alice_vacation" + }, + "attrs": { + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + }, + { + "ty": { + "Concrete": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + } + ] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Photo", + "path": [] + } + }, + "eid": "vacation.jpg" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Photo", + "path": [] + } + }, + "eid": "vacation.jpg" + }, + "attrs": { + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Concrete": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + { + "ty": { + "Concrete": { + "id": "Album", + "path": [] + } + }, + "eid": "alice_vacation" + }, + { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + ] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + }, + "attrs": { + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "stacey" + } + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "attrs": {}, + "ancestors": [] + } + ] + ] + } +} \ No newline at end of file From ed8dfd853e798866d37b2510b4e5885863d0baba Mon Sep 17 00:00:00 2001 From: Andrew Wells Date: Thu, 16 Nov 2023 10:11:13 -0800 Subject: [PATCH 18/57] works on 5b.json standalone --- cedar-lean/DiffTest/Parser.lean | 28 +++++++++++----------------- 1 file changed, 11 insertions(+), 17 deletions(-) diff --git a/cedar-lean/DiffTest/Parser.lean b/cedar-lean/DiffTest/Parser.lean index 0894487ad..c788ed5e0 100644 --- a/cedar-lean/DiffTest/Parser.lean +++ b/cedar-lean/DiffTest/Parser.lean @@ -126,7 +126,7 @@ List.unzip (List.map (fun x => match x with -- "GetAttr" : {"expr": Expr, "attr": String} -- "HasAttr" : {"expr": Expr, "arg": String} -- "Set" : {[Expr]} --- "Record" : {"pairs": ["id": Expr]} +-- "Record" : {"id1": Expr, "id2": Expr, ...} -- } /- @@ -247,20 +247,14 @@ partial def jsonToExpr (json : Except String Lean.Json) : Expr := match json.isO | _,_ => panic! "sorry" | false => match (json.getObjVal? "Record").isOk with | true => - let e := (unwrapExcept (json.getObjVal? "Record")).getObjVal? "pairs" - match e.isOk with - | true => - let e := (unwrapExcept e).getArr? - match e.isOk with - | true => - let e := Option.get! e.toOption - let kv := arrayToKVPairList e - let v_exprs := List.map jsonToExpr (List.map Except.ok kv.snd) - let k_strs := List.map strNodeToString kv.fst - let er : Expr := .record (List.zip k_strs v_exprs) - er - | false => panic! "sorry" - | false => panic! "sorry" + let attrs := unwrapExcept (json.getObjVal? "Record") + match attrs with + | Lean.Json.obj obj => + let pairs := (obj.fold (fun l s j => (s,j) :: l) []) + let keys := List.map Prod.fst pairs + let vals := List.map (jsonToExpr ∘ Except.ok ∘ Prod.snd) pairs + Expr.record (List.zip keys vals) + | _ => panic! "Invalid record shape" | false => match (json.getObjVal? "Set").isOk with | true => let e := (unwrapExcept (json.getObjVal? "Set")).getArr? @@ -321,7 +315,7 @@ def jsonToContext (json : Except String Lean.Json) : Map Attr Value := match jso | Lean.Json.obj obj => let pairs := (obj.fold (fun l s j => (s,j) :: l) []) let keys := List.map Prod.fst pairs - let vals := List.map (jsonToValue ∘ Except.ok ∘ Prod.snd) pairs + let vals := List.map (exprToValue ∘ jsonToExpr ∘ Except.ok ∘ Prod.snd) pairs Map.mk (List.zip keys vals) | _ => panic! "uh oh" @@ -333,7 +327,7 @@ partial def jsonToRequest (json : Except String Lean.Json) : Request := match js let principal := jsonToEUID ((unwrapExcept (json.getObjVal? "principal")).getObjVal? "Concrete") let action := jsonToEUID ((unwrapExcept (json.getObjVal? "action")).getObjVal? "Concrete") let resource := jsonToEUID ((unwrapExcept (json.getObjVal? "resource")).getObjVal? "Concrete") - let context := jsonToContext (json.getObjVal? "context") + let context := (jsonToContext ∘ json.getObjVal?) "context" { principal := principal, action := action, From 4b8f1e37a25c948cfd2600b39785f3e194eb704b Mon Sep 17 00:00:00 2001 From: Andrew Wells Date: Thu, 16 Nov 2023 10:13:21 -0800 Subject: [PATCH 19/57] README instructions --- cedar-lean/README.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/cedar-lean/README.md b/cedar-lean/README.md index c8199a606..425da8868 100644 --- a/cedar-lean/README.md +++ b/cedar-lean/README.md @@ -24,6 +24,11 @@ To run the unit tests: $ lake exe CedarUnitTests ``` +To run integration test JSON file: +```shell +lake exe DiffTestStandAlone diff_test_jsons/5b.json +``` + ## Updating the Lean toolchain Cedar depends on [`mathlib4`](https://github.com/leanprover-community/mathlib4), and it is configured to use the same version of Lean as `mathlib4`. @@ -36,6 +41,14 @@ $ lake update $ lake exe cache get ``` +## Linking with Rust + +To link with Rust, compile as static libraries: + +```shell +lake build DiffTest:static Std:static Aesop:static ProofWidgets:static Qq:static Mathlib:static Cedar:static +``` + ## Contributing To [contribute](../CONTRIBUTING.md) Lean code or proofs, follow these [style guidelines](GUIDE.md). From 311cc804325d1e3830857e81c8e10a168becc997 Mon Sep 17 00:00:00 2001 From: Andrew Wells Date: Thu, 16 Nov 2023 10:26:16 -0800 Subject: [PATCH 20/57] changes for Rust --- cedar-drt/src/lean_impl.rs | 58 ++++++++++++++-------------- cedar-drt/tests/integration_tests.rs | 6 ++- 2 files changed, 34 insertions(+), 30 deletions(-) diff --git a/cedar-drt/src/lean_impl.rs b/cedar-drt/src/lean_impl.rs index f2ec5c800..8db584405 100644 --- a/cedar-drt/src/lean_impl.rs +++ b/cedar-drt/src/lean_impl.rs @@ -17,8 +17,11 @@ //! Implementation of the [`CedarTestImplementation`] trait for the Cedar Lean //! implementation. +//NOTE: We use the env var RUST_LEAN_INTERFACE_INIT to save the fact that +//we've already initialized + use core::panic; -use std::{collections::HashSet, ffi::CString}; +use std::{collections::HashSet, env, ffi::CString}; use crate::cedar_test_impl::*; use cedar_policy::frontend::is_authorized::InterfaceResponse; @@ -51,7 +54,7 @@ pub const LEAN_VALIDATION_MSG: &str = "lean_validation (ns) : "; #[link(name = "Cedar", kind = "static")] // #[link(name = "Lean")] -#[link(name = "Std")] +#[link(name = "Std", kind = "static")] #[link(name = "DiffTest", kind = "static")] #[link(name = "leanshared", kind = "dylib")] #[link(name = "Mathlib", kind = "static")] @@ -109,7 +112,6 @@ impl LeanDefinitionalEngine { }) .expect("Failed to serialize request, policies, or entities"); eprintln!("{request}"); - println!("{:?}", request.clone().as_ptr()); let cstring = CString::new(request).expect("CString::new failed"); let s = unsafe { lean_mk_string(cstring.as_ptr() as *const u8) }; return s; @@ -117,27 +119,24 @@ impl LeanDefinitionalEngine { fn deserialize_response(response: *mut lean_object) -> InterfaceResponse { let response_string = lean_obj_to_string(response); - println!("Response string:"); - println!("{response_string:?}"); - // let resp: ResponseDef = - // serde_json::from_str(&response_string).expect("could not convert string to json"); - // let dec: authorizer::Decision = if resp.decision == "allow" { - // authorizer::Decision::Allow - // } else if resp.decision == "deny" { - // authorizer::Decision::Deny - // } else { - // panic!("unknown decision") - // }; - - // let reason = resp - // .policies - // .mk - // .l - // .into_iter() - // .map(|x| cedar_policy::PolicyId::from_str(&x).expect("could not coerce policyId")) - // .collect(); - // InterfaceResponse::new(dec, reason, HashSet::new()) - InterfaceResponse::new(authorizer::Decision::Allow, HashSet::new(), HashSet::new()) + let resp: ResponseDef = + serde_json::from_str(&response_string).expect("could not convert string to json"); + let dec: authorizer::Decision = if resp.decision == "allow" { + authorizer::Decision::Allow + } else if resp.decision == "deny" { + authorizer::Decision::Deny + } else { + panic!("unknown decision") + }; + + let reason = resp + .policies + .mk + .l + .into_iter() + .map(|x| cedar_policy::PolicyId::from_str(&x).expect("could not coerce policyId")) + .collect(); + InterfaceResponse::new(dec, reason, HashSet::new()) } /// Ask the definitional engine whether `isAuthorized` for the given `request`, @@ -148,10 +147,13 @@ impl LeanDefinitionalEngine { policies: &ast::PolicySet, entities: &Entities, ) -> InterfaceResponse { - unsafe { lean_initialize_runtime_module() }; - unsafe { lean_initialize() }; - unsafe { initialize_DiffTest_Main(1, lean_io_mk_world()) }; - unsafe { lean_io_mark_end_initialization() }; + if env::var("RUST_LEAN_INTERFACE_INIT").is_err() { + unsafe { lean_initialize_runtime_module() }; + unsafe { lean_initialize() }; + unsafe { initialize_DiffTest_Main(1, lean_io_mk_world()) }; + unsafe { lean_io_mark_end_initialization() }; + env::set_var("RUST_LEAN_INTERFACE_INIT", "1"); + } let req = Self::serialize_request(request, policies, entities); let response = unsafe { isAuthorizedDRT(req) }; diff --git a/cedar-drt/tests/integration_tests.rs b/cedar-drt/tests/integration_tests.rs index 0161a081d..941af2ca0 100644 --- a/cedar-drt/tests/integration_tests.rs +++ b/cedar-drt/tests/integration_tests.rs @@ -34,8 +34,10 @@ fn run_integration_tests(custom_impl: &dyn CustomCedarImpl) { // Hard-code the list of tests that the cedar-policy package // currently runs (last updated 2023-09-25). let test_jsons = vec![ - "decimal/1.json", + // "decimal/1.json", // "decimal/2.json", + // "example_use_cases_doc/simple.json", + // // "example_use_cases_doc/1a.json", // "example_use_cases_doc/2a.json", // "example_use_cases_doc/2b.json", @@ -47,7 +49,7 @@ fn run_integration_tests(custom_impl: &dyn CustomCedarImpl) { // "example_use_cases_doc/4d.json", // "example_use_cases_doc/4e.json", // "example_use_cases_doc/4f.json", - // "example_use_cases_doc/5b.json", + "example_use_cases_doc/5b.json", // "ip/1.json", // "ip/2.json", // "ip/3.json", From de88f0d1cc5b2324f34eabbc5acc13bc51e9d57d Mon Sep 17 00:00:00 2001 From: Andrew Wells Date: Thu, 16 Nov 2023 16:24:08 -0800 Subject: [PATCH 21/57] run Rust integration tests --- cedar-drt/tests/integration_tests.rs | 42 +++++++++++++--------------- 1 file changed, 20 insertions(+), 22 deletions(-) diff --git a/cedar-drt/tests/integration_tests.rs b/cedar-drt/tests/integration_tests.rs index 941af2ca0..51f94e4d5 100644 --- a/cedar-drt/tests/integration_tests.rs +++ b/cedar-drt/tests/integration_tests.rs @@ -34,29 +34,27 @@ fn run_integration_tests(custom_impl: &dyn CustomCedarImpl) { // Hard-code the list of tests that the cedar-policy package // currently runs (last updated 2023-09-25). let test_jsons = vec![ - // "decimal/1.json", - // "decimal/2.json", - // "example_use_cases_doc/simple.json", - // - // "example_use_cases_doc/1a.json", - // "example_use_cases_doc/2a.json", - // "example_use_cases_doc/2b.json", - // "example_use_cases_doc/2c.json", - // "example_use_cases_doc/3a.json", - // "example_use_cases_doc/3b.json", - // "example_use_cases_doc/3c.json", - // "example_use_cases_doc/4a.json", - // "example_use_cases_doc/4d.json", - // "example_use_cases_doc/4e.json", - // "example_use_cases_doc/4f.json", + "decimal/1.json", + "decimal/2.json", + "example_use_cases_doc/1a.json", + "example_use_cases_doc/2a.json", + "example_use_cases_doc/2b.json", + "example_use_cases_doc/2c.json", + "example_use_cases_doc/3a.json", + "example_use_cases_doc/3b.json", + "example_use_cases_doc/3c.json", + "example_use_cases_doc/4a.json", + "example_use_cases_doc/4d.json", + "example_use_cases_doc/4e.json", + "example_use_cases_doc/4f.json", "example_use_cases_doc/5b.json", - // "ip/1.json", - // "ip/2.json", - // "ip/3.json", - // "multi/1.json", - // "multi/2.json", - // "multi/3.json", - // "multi/4.json", + "ip/1.json", + "ip/2.json", + "ip/3.json", + "multi/1.json", + "multi/2.json", + "multi/3.json", + "multi/4.json", ] .into_iter() .map(|p| integration_tests_folder.join(p)); From 134d7837bfa4d2f3b0fa2dc8abce1d6a57c14616 Mon Sep 17 00:00:00 2001 From: Kesha Hietala Date: Tue, 14 Nov 2023 12:21:05 -0500 Subject: [PATCH 22/57] added back dafny/java code; added test case to DiffTest/Main.lean --- cedar-drt/Cargo.toml | 1 + cedar-drt/Makefile | 10 +- cedar-drt/fuzz/build.rs | 6 +- .../fuzz/fuzz_targets/abac-type-directed.rs | 8 +- cedar-drt/fuzz/fuzz_targets/abac.rs | 6 +- .../fuzz/fuzz_targets/eval-type-directed.rs | 6 +- .../fuzz/fuzz_targets/rbac-authorizer.rs | 6 +- cedar-drt/fuzz/fuzz_targets/rbac.rs | 6 +- .../strict-validation-drt-type-directed.rs | 6 +- .../validation-drt-type-directed.rs | 6 +- cedar-drt/fuzz/fuzz_targets/validation-drt.rs | 6 +- cedar-drt/fuzz/src/lib.rs | 8 +- cedar-drt/src/dafny_java_impl.rs | 415 ++++++++++ cedar-drt/src/definitional_request_types.rs | 47 +- cedar-drt/src/lean_impl.rs | 8 +- cedar-drt/src/lib.rs | 2 + cedar-drt/tests/integration_tests.rs | 10 +- cedar-lean/Cedar.lean | 4 +- cedar-lean/DiffTest/Main.lean | 7 + cedar-lean/DiffTest/example.json | 717 ++++++++++++++++++ 20 files changed, 1213 insertions(+), 72 deletions(-) create mode 100644 cedar-drt/src/dafny_java_impl.rs create mode 100644 cedar-lean/DiffTest/example.json diff --git a/cedar-drt/Cargo.toml b/cedar-drt/Cargo.toml index 7e898042b..df26838be 100644 --- a/cedar-drt/Cargo.toml +++ b/cedar-drt/Cargo.toml @@ -12,6 +12,7 @@ cedar-policy = { path = "../cedar/cedar-policy", version = "3.*", features = ["i cedar-policy-core = { path = "../cedar/cedar-policy-core", version = "3.*", features = ["arbitrary"] } cedar-policy-validator = { path = "../cedar/cedar-policy-validator", version = "3.*", features = ["arbitrary"] } cedar-policy-formatter = { path = "../cedar/cedar-policy-formatter", version = "3.*" } +jni = { version = "0.19.0", features = ["invocation"] } lean-sys = { version = "0.0.5", features = ["small_allocator"], default-features = false } serde = { version = "1.0", features = ["derive"] } serde_json = "1.0" diff --git a/cedar-drt/Makefile b/cedar-drt/Makefile index 1fc7e3b3d..a96a17f8c 100644 --- a/cedar-drt/Makefile +++ b/cedar-drt/Makefile @@ -1,20 +1,20 @@ .PHONY: all run test all: - cd ../cedar-lean && lake build Cedar DiffTest Std:static + cd ../cedar-lean && lake build Cedar DiffTest Std:static Mathlib:static Qq:static Aesop:static ProofWidgets:static LEAN_LIB_DIR=`lean --print-libdir` \ cargo build; LEAN_LIB_DIR=`lean --print-libdir` \ cd fuzz && LEAN_LIB_DIR=`lean --print-libdir` cargo build test: all - DYLD_LIBRARY_PATH=`lean --print-libdir` \ - LD_LIBRARY_PATH=`lean --print-libdir` \ + DYLD_LIBRARY_PATH=`lean --print-libdir`:${DYLD_LIBRARY_PATH} \ + LD_LIBRARY_PATH=`lean --print-libdir`:${LD_LIBRARY_PATH} \ LEAN_LIB_DIR=`lean --print-libdir` \ cargo test --test integration_tests run: all - DYLD_LIBRARY_PATH=`lean --print-libdir` \ - LD_LIBRARY_PATH=`lean --print-libdir` \ + DYLD_LIBRARY_PATH=`lean --print-libdir`:${DYLD_LIBRARY_PATH} \ + LD_LIBRARY_PATH=`lean --print-libdir`:${LD_LIBRARY_PATH} \ LEAN_LIB_DIR=`lean --print-libdir` \ cargo fuzz run -s none $(target) \ No newline at end of file diff --git a/cedar-drt/fuzz/build.rs b/cedar-drt/fuzz/build.rs index ae39e53da..70b318cad 100644 --- a/cedar-drt/fuzz/build.rs +++ b/cedar-drt/fuzz/build.rs @@ -7,5 +7,7 @@ fn main() { println!("cargo:rustc-link-search=native=../../cedar-lean/lake-packages/mathlib/build/lib"); println!("cargo:rustc-link-search=native=../../cedar-lean/lake-packages/Qq/build/lib"); println!("cargo:rustc-link-search=native=../../cedar-lean/lake-packages/aesop/build/lib"); - println!("cargo:rustc-link-search=native=../../cedar-lean/lake-packages/proofwidgets/build/lib"); - } \ No newline at end of file + println!( + "cargo:rustc-link-search=native=../../cedar-lean/lake-packages/proofwidgets/build/lib" + ); +} diff --git a/cedar-drt/fuzz/fuzz_targets/abac-type-directed.rs b/cedar-drt/fuzz/fuzz_targets/abac-type-directed.rs index 63aa7750f..b79ee61d4 100644 --- a/cedar-drt/fuzz/fuzz_targets/abac-type-directed.rs +++ b/cedar-drt/fuzz/fuzz_targets/abac-type-directed.rs @@ -143,8 +143,8 @@ fuzz_target!(|input: FuzzTargetInput| { initialize_log(); let mut policyset = ast::PolicySet::new(); policyset.add_static(input.policy.into()).unwrap(); - let lean_def_engine = - LeanDefinitionalEngine::new().expect("failed to create definitional engine"); + let java_def_engine = + JavaDefinitionalEngine::new().expect("failed to create definitional engine"); debug!("Schema: {}\n", input.schema.schemafile_string()); debug!("Policies: {policyset}\n"); debug!("Entities: {}\n", input.entities); @@ -157,14 +157,14 @@ fuzz_target!(|input: FuzzTargetInput| { for request in input.requests.into_iter().map(Into::into) { debug!("Request : {request}"); let (rust_res, total_dur) = time_function(|| { - run_auth_test(&lean_def_engine, &request, &policyset, &original_entities) + run_auth_test(&java_def_engine, &request, &policyset, &original_entities) }); if let Some(ref entities) = cached_entities { match entities { Ok(entities) => { let (cached_rust_res, _total_dur) = time_function(|| { - run_auth_test(&lean_def_engine, &request, &policyset, entities) + run_auth_test(&java_def_engine, &request, &policyset, entities) }); assert_eq!(rust_res, cached_rust_res); } diff --git a/cedar-drt/fuzz/fuzz_targets/abac.rs b/cedar-drt/fuzz/fuzz_targets/abac.rs index 8c37e009d..20d61c15f 100644 --- a/cedar-drt/fuzz/fuzz_targets/abac.rs +++ b/cedar-drt/fuzz/fuzz_targets/abac.rs @@ -123,8 +123,8 @@ fuzz_target!(|input: FuzzTargetInput| { policyset.add_static(input.policy.into()).unwrap(); debug!("Policies: {policyset}"); debug!("Entities: {entities}"); - let lean_def_engine = - LeanDefinitionalEngine::new().expect("failed to create definitional engine"); + let java_def_engine = + JavaDefinitionalEngine::new().expect("failed to create definitional engine"); let requests = input .requests .into_iter() @@ -134,7 +134,7 @@ fuzz_target!(|input: FuzzTargetInput| { for request in &requests { debug!("Request: {request}"); let (ans, total_dur) = - time_function(|| run_auth_test(&lean_def_engine, request, &policyset, &entities)); + time_function(|| run_auth_test(&java_def_engine, request, &policyset, &entities)); info!("{}{}", TOTAL_MSG, total_dur.as_nanos()); responses.push(ans); } diff --git a/cedar-drt/fuzz/fuzz_targets/eval-type-directed.rs b/cedar-drt/fuzz/fuzz_targets/eval-type-directed.rs index afdc25d27..e08308bc4 100644 --- a/cedar-drt/fuzz/fuzz_targets/eval-type-directed.rs +++ b/cedar-drt/fuzz/fuzz_targets/eval-type-directed.rs @@ -135,13 +135,13 @@ fn drop_some_entities(entities: Entities, u: &mut Unstructured<'_>) -> arbitrary // The main fuzz target. This is for type-directed fuzzing of expression evaluation fuzz_target!(|input: FuzzTargetInput| { initialize_log(); - let lean_def_engine = - LeanDefinitionalEngine::new().expect("failed to create definitional engine"); + let java_def_engine = + JavaDefinitionalEngine::new().expect("failed to create definitional engine"); debug!("Schema: {}\n", input.schema.schemafile_string()); debug!("expr: {}\n", input.expression); debug!("Entities: {}\n", input.entities); run_eval_test( - &lean_def_engine, + &java_def_engine, &input.request.into(), &input.expression, &input.entities, diff --git a/cedar-drt/fuzz/fuzz_targets/rbac-authorizer.rs b/cedar-drt/fuzz/fuzz_targets/rbac-authorizer.rs index d1e053b76..16df75f65 100644 --- a/cedar-drt/fuzz/fuzz_targets/rbac-authorizer.rs +++ b/cedar-drt/fuzz/fuzz_targets/rbac-authorizer.rs @@ -111,9 +111,9 @@ fuzz_target!(|input: AuthorizerInputAbstractEvaluator| { // Check agreement with definitional engine. Note that run_auth_test returns // the result of the call to is_authorized. - let lean_def_engine = - LeanDefinitionalEngine::new().expect("failed to create definitional engine"); - let res = run_auth_test(&lean_def_engine, &request, &policyset, &entities); + let java_def_engine = + JavaDefinitionalEngine::new().expect("failed to create definitional engine"); + let res = run_auth_test(&java_def_engine, &request, &policyset, &entities); // Check the following property: there should be an error reported iff we // had either PermitError or ForbidError diff --git a/cedar-drt/fuzz/fuzz_targets/rbac.rs b/cedar-drt/fuzz/fuzz_targets/rbac.rs index b7f8ebc2c..7f541a201 100644 --- a/cedar-drt/fuzz/fuzz_targets/rbac.rs +++ b/cedar-drt/fuzz/fuzz_targets/rbac.rs @@ -198,12 +198,12 @@ fuzz_target!(|input: FuzzTargetInput| { } }; } - let lean_def_engine = - LeanDefinitionalEngine::new().expect("failed to create definitional engine"); + let java_def_engine = + JavaDefinitionalEngine::new().expect("failed to create definitional engine"); for rbac_request in input.requests.into_iter() { let request = ast::Request::from(rbac_request); let (_, dur) = - time_function(|| run_auth_test(&lean_def_engine, &request, &policyset, &entities)); + time_function(|| run_auth_test(&java_def_engine, &request, &policyset, &entities)); info!("{}{}", TOTAL_MSG, dur.as_nanos()); } } diff --git a/cedar-drt/fuzz/fuzz_targets/strict-validation-drt-type-directed.rs b/cedar-drt/fuzz/fuzz_targets/strict-validation-drt-type-directed.rs index b2c3bc642..199623e0c 100644 --- a/cedar-drt/fuzz/fuzz_targets/strict-validation-drt-type-directed.rs +++ b/cedar-drt/fuzz/fuzz_targets/strict-validation-drt-type-directed.rs @@ -79,10 +79,10 @@ fuzz_target!(|input: FuzzTargetInput| { debug!("Policies: {policyset}"); // run the policy through both validators and compare the result - let lean_def_engine = - LeanDefinitionalEngine::new().expect("failed to create definitional engine"); + let java_def_engine = + JavaDefinitionalEngine::new().expect("failed to create definitional engine"); let (_, total_dur) = time_function(|| { - run_val_test(&lean_def_engine, schema, &policyset, ValidationMode::Strict) + run_val_test(&java_def_engine, schema, &policyset, ValidationMode::Strict) }); info!("{}{}", TOTAL_MSG, total_dur.as_nanos()); } diff --git a/cedar-drt/fuzz/fuzz_targets/validation-drt-type-directed.rs b/cedar-drt/fuzz/fuzz_targets/validation-drt-type-directed.rs index e0a92fd87..2d8dd71db 100644 --- a/cedar-drt/fuzz/fuzz_targets/validation-drt-type-directed.rs +++ b/cedar-drt/fuzz/fuzz_targets/validation-drt-type-directed.rs @@ -79,11 +79,11 @@ fuzz_target!(|input: FuzzTargetInput| { debug!("Policies: {policyset}"); // run the policy through both validators and compare the result - let lean_def_engine = - LeanDefinitionalEngine::new().expect("failed to create definitional engine"); + let java_def_engine = + JavaDefinitionalEngine::new().expect("failed to create definitional engine"); let (_, total_dur) = time_function(|| { run_val_test( - &lean_def_engine, + &java_def_engine, schema, &policyset, ValidationMode::Permissive, diff --git a/cedar-drt/fuzz/fuzz_targets/validation-drt.rs b/cedar-drt/fuzz/fuzz_targets/validation-drt.rs index 9a8e95bf3..2e9598f2f 100644 --- a/cedar-drt/fuzz/fuzz_targets/validation-drt.rs +++ b/cedar-drt/fuzz/fuzz_targets/validation-drt.rs @@ -79,11 +79,11 @@ fuzz_target!(|input: FuzzTargetInput| { debug!("Policies: {policyset}"); // run the policy through both validators and compare the result - let lean_def_engine = - LeanDefinitionalEngine::new().expect("failed to create definitional engine"); + let java_def_engine = + JavaDefinitionalEngine::new().expect("failed to create definitional engine"); let (_, total_dur) = time_function(|| { run_val_test( - &lean_def_engine, + &java_def_engine, schema, &policyset, ValidationMode::Permissive, diff --git a/cedar-drt/fuzz/src/lib.rs b/cedar-drt/fuzz/src/lib.rs index 1451eb574..de14cf70e 100644 --- a/cedar-drt/fuzz/src/lib.rs +++ b/cedar-drt/fuzz/src/lib.rs @@ -176,13 +176,13 @@ pub fn run_val_test( #[test] fn test_run_auth_test() { - use cedar_drt::LeanDefinitionalEngine; + use cedar_drt::JavaDefinitionalEngine; use cedar_policy_core::ast::{Entity, EntityUID, RestrictedExpr}; use cedar_policy_core::entities::{NoEntitiesSchema, TCComputation}; use smol_str::SmolStr; - let lean_def_engine = - LeanDefinitionalEngine::new().expect("failed to create definitional engine"); + let java_def_engine = + JavaDefinitionalEngine::new().expect("failed to create definitional engine"); let principal = ast::EntityUIDEntry::Concrete(std::sync::Arc::new( EntityUID::with_eid_and_type("User", "alice").unwrap(), )); @@ -246,5 +246,5 @@ fn test_run_auth_test() { Extensions::all_available(), ) .unwrap(); - run_auth_test(&lean_def_engine, &query, &policies, &entities); + run_auth_test(&java_def_engine, &query, &policies, &entities); } diff --git a/cedar-drt/src/dafny_java_impl.rs b/cedar-drt/src/dafny_java_impl.rs new file mode 100644 index 000000000..70b77dfa1 --- /dev/null +++ b/cedar-drt/src/dafny_java_impl.rs @@ -0,0 +1,415 @@ +/* + * Copyright 2022-2023 Amazon.com, Inc. or its affiliates. All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +//! Implementation of the [`CedarTestImplementation`] trait for the Cedar Java +//! implementation extracted from the Dafny specification. + +use crate::cedar_test_impl::*; +use crate::definitional_request_types::*; +use crate::logger::*; +use cedar_policy::frontend::is_authorized::InterfaceResponse; +use cedar_policy::integration_testing::{CustomCedarImpl, IntegrationTestValidationResult}; +pub use cedar_policy::Response; +use cedar_policy_core::ast::{Expr, Value}; +pub use cedar_policy_core::*; +pub use cedar_policy_validator::{ValidationMode, ValidationResult, ValidatorSchema}; +pub use entities::Entities; +use jni::objects::{JObject, JString, JValue}; +use jni::{JNIVersion, JavaVM}; +use lazy_static::lazy_static; +use log::info; + +/// Times to (de)serialize JSON content sent to / received from the Dafny-Java +/// implementation. +pub const RUST_SERIALIZATION_MSG: &str = "rust_serialization (ns) : "; +pub const RUST_DESERIALIZATION_MSG: &str = "rust_deserialization (ns) : "; + +/// Times for cedar-policy authorization and validation. +pub const RUST_AUTH_MSG: &str = "rust_auth (ns) : "; +pub const RUST_VALIDATION_MSG: &str = "rust_validation (ns) : "; + +/// Times for JSON (de)serialization, authorization, and validation as reported +/// by the Dafny-Java implementation. +pub const JAVA_SERIALIZATION_MSG: &str = "java_serialization (ns) : "; +pub const JAVA_DESERIALIZATION_MSG: &str = "java_deserialization (ns) : "; +pub const JAVA_AUTH_MSG: &str = "java_auth (ns) : "; +pub const JAVA_VALIDATION_MSG: &str = "java_validation (ns) : "; + +lazy_static! { + /// The JVM instance + static ref JVM: JavaVM = { + let classpath_opt = match std::env::var("CLASSPATH") { + Ok(val) => format!("-Djava.class.path={val}"), + Err(std::env::VarError::NotPresent) => String::new(), + Err(std::env::VarError::NotUnicode(_)) => panic!("classpath not unicode"), + }; + let jvm_args = jni::InitArgsBuilder::new() + .version(JNIVersion::V8) + .option("-Xcheck:jni") + //.option("-verbose:class") + .option(&classpath_opt) + .build() + .expect("failed to create JVM args"); + JavaVM::new(jvm_args).expect("failed to create JVM instance") + }; +} + +/// The lifetime parameter 'j is the lifetime of the JVM instance +pub struct JavaDefinitionalEngine<'j> { + /// Thread attached to the JVM + thread: jni::AttachGuard<'j>, + /// Definitional authorizer instance + def_authorizer: JObject<'j>, + /// Definitional validator instance + def_validator: JObject<'j>, +} + +impl<'j> JavaDefinitionalEngine<'j> { + /// Create a new `JavaDefinitionalEngine` instance. + /// + /// This is a relatively expensive operation, so avoid calling it frequently. + pub fn new() -> Result { + let thread = JVM + .attach_current_thread() + .map_err(|e| format!("failed to attach current thread: {e}"))?; + let def_authorizer_class = thread + .find_class("com/CedarDefinitionalImplementation/DefinitionalEngine") + .map_err(|e| format!("failed to find class: {e}"))?; + let def_authorizer = thread + .new_object(def_authorizer_class, "()V", &[]) + .map_err(|e| format!("failed to construct DefinitionalEngine instance: {e}"))?; + let def_validator_class = thread + .find_class("com/CedarDefinitionalImplementation/DefinitionalValidator") + .map_err(|e| format!("failed to find class: {e}"))?; + let def_validator = thread + .new_object(def_validator_class, "()V", &[]) + .map_err(|e| format!("failed to construct DefinitionalValidator instance: {e}"))?; + Ok(Self { + thread, + def_authorizer, + def_validator, + }) + } + + fn serialize_eval_request( + &self, + request: &ast::Request, + entities: &Entities, + expr: &Expr, + expected: Option<&Expr>, + ) -> JString { + let request: String = serde_json::to_string(&EvalRequestForDefEngine { + request, + entities, + expr, + expected, + }) + .expect("Failed to serialize request"); + self.thread + .new_string(request) + .expect("failed to create Java object for eval request string") + } + + fn deserialize_eval_response(&self, response: JValue) -> bool { + let jstr = response + .l() + .unwrap_or_else(|_| { + panic!( + "expected eval_str to return an Object (String), but it returned {:?}", + response + ) + }) + .into(); + let response: String = self + .thread + .get_string(jstr) + .expect("Failed to get JavaStr") + .into(); + self.thread + .delete_local_ref(*jstr) + .expect("Deletion failed"); + let r: DefinitionalEvalResponse = serde_json::from_str(&response).unwrap_or_else(|_| { + panic!( + "JSON response received from the definitional engine was malformed: \n{response}" + ) + }); + r.matches + } + + pub fn eval( + &self, + request: &ast::Request, + entities: &Entities, + expr: &Expr, + expected: Option, + ) -> bool { + let expected_as_expr = expected.map(|v| v.into()); + let jstr = self.serialize_eval_request(request, entities, expr, expected_as_expr.as_ref()); + let response = self.thread.call_method( + self.def_authorizer, + "eval_str", + "(Ljava/lang/String;)Ljava/lang/String;", + &[jstr.into()], + ); + match response { + Ok(v) => self.deserialize_eval_response(v), + Err(e) => { + self.thread + .exception_describe() + .expect("Failed to print exception information"); + panic!("JVM Exception Occurred!: {:?}", e); + } + } + } + + fn serialize_auth_request( + &self, + request: &ast::Request, + policies: &ast::PolicySet, + entities: &Entities, + ) -> JString { + let request: String = serde_json::to_string(&RequestForDefEngine { + request, + policies, + entities, + }) + .expect("Failed to serialize request, policies, or entities"); + self.thread + .new_string(request) + .expect("failed to create Java object for authorization request string") + } + + fn deserialize_auth_response(&self, response: JValue) -> InterfaceResponse { + let jresponse: JString = response + .l() + .unwrap_or_else(|_| { + panic!( + "expected isAuthorized_str to return an Object (String), but it returned {:?}", + response + ) + }) + .into(); + let response: String = self + .thread + .get_string(jresponse) + .expect("failed to get JavaStr") + .into(); + self.thread + .delete_local_ref(*jresponse) + .expect("Deletion failed"); + let d_response: DefinitionalAuthResponse = serde_json::from_str(&response).unwrap_or_else(|_| { + panic!( + "JSON response received from the definitional engine was the wrong format:\n{response}", + ) + }); + + info!( + "{}{}", + JAVA_SERIALIZATION_MSG, d_response.serialization_nanos + ); + info!( + "{}{}", + JAVA_DESERIALIZATION_MSG, d_response.deserialization_nanos + ); + info!("{}{}", JAVA_AUTH_MSG, d_response.auth_nanos); + + d_response.response + } + + /// Ask the definitional engine whether `isAuthorized` for the given `request`, + /// `policies`, and `entities` + pub fn is_authorized( + &self, + request: &ast::Request, + policies: &ast::PolicySet, + entities: &Entities, + ) -> InterfaceResponse { + let (jstring, dur) = + time_function(|| self.serialize_auth_request(request, policies, entities)); + info!("{}{}", RUST_SERIALIZATION_MSG, dur.as_nanos()); + let response = self.thread.call_method( + self.def_authorizer, + "isAuthorized_str", + // https://stackoverflow.com/questions/8066253/compute-a-java-functions-signature + "(Ljava/lang/String;)Ljava/lang/String;", + &[jstring.into()], + ); + if response.is_err() { + self.thread + .exception_describe() + .expect("Failed to print exception information"); + panic!("JVM Exception Occurred!"); + } + let response: JValue = response.expect("failed to call Java isAuthorized_str"); + let (response, dur) = time_function(|| self.deserialize_auth_response(response)); + info!("{}{}", RUST_DESERIALIZATION_MSG, dur.as_nanos()); + self.thread + .delete_local_ref(*jstring) + .expect("Deletion failed"); + response + } + + fn serialize_val_request( + &self, + schema: &ValidatorSchema, + policies: &ast::PolicySet, + mode: ValidationMode, + ) -> JString { + let request: String = serde_json::to_string(&RequestForDefValidator { + schema, + policies, + mode, + }) + .expect("Failed to serialize schema or policies"); + self.thread + .new_string(request) + .expect("failed to create Java object for validation request string") + } + + fn deserialize_val_response(&self, response: JValue) -> ValidationInterfaceResponse { + let jresponse: JString = response + .l() + .unwrap_or_else(|_| { + panic!( + "expected validate_str to return an Object (String), but it returned {:?}", + response + ) + }) + .into(); + let response: String = self + .thread + .get_string(jresponse) + .expect("failed to get JavaStr") + .into(); + self.thread + .delete_local_ref(*jresponse) + .expect("Deletion failed"); + let d_response: DefinitionalValResponse = + serde_json::from_str(&response).unwrap_or_else(|_| { + panic!( + "JSON response received from the definitional validator was the wrong format:\n{response}", + ) + }); + + info!( + "{}{}", + JAVA_SERIALIZATION_MSG, d_response.serialization_nanos + ); + info!( + "{}{}", + JAVA_DESERIALIZATION_MSG, d_response.deserialization_nanos + ); + info!("{}{}", JAVA_VALIDATION_MSG, d_response.validation_nanos); + + d_response.response + } + + /// Use the definitional validator to validate the given `policies` given a `schema` + pub fn validate( + &self, + schema: &ValidatorSchema, + policies: &ast::PolicySet, + mode: ValidationMode, + ) -> ValidationInterfaceResponse { + let (jstring, dur) = time_function(|| self.serialize_val_request(schema, policies, mode)); + info!("{}{}", RUST_SERIALIZATION_MSG, dur.as_nanos()); + let response = self.thread.call_method( + self.def_validator, + "validate_str", + // https://stackoverflow.com/questions/8066253/compute-a-java-functions-signature + "(Ljava/lang/String;)Ljava/lang/String;", + &[jstring.into()], + ); + if response.is_err() { + self.thread + .exception_describe() + .expect("Failed to print exception information"); + panic!("JVM Exception Occurred!"); + } + let response: JValue = response.expect("failed to call Java validate_str"); + let (response, dur) = time_function(|| self.deserialize_val_response(response)); + info!("{}{}", RUST_DESERIALIZATION_MSG, dur.as_nanos()); + self.thread + .delete_local_ref(*jstring) + .expect("Deletion failed"); + response + } +} + +impl<'j> CedarTestImplementation for JavaDefinitionalEngine<'j> { + fn is_authorized( + &self, + request: &ast::Request, + policies: &ast::PolicySet, + entities: &Entities, + ) -> InterfaceResponse { + self.is_authorized(request, policies, entities) + } + + fn interpret( + &self, + request: &ast::Request, + entities: &Entities, + expr: &Expr, + expected: Option, + ) -> bool { + self.eval(request, entities, expr, expected) + } + + fn validate( + &self, + schema: &cedar_policy_validator::ValidatorSchema, + policies: &ast::PolicySet, + mode: ValidationMode, + ) -> ValidationInterfaceResponse { + self.validate(schema, policies, mode) + } +} + +/// Implementation of the trait used for integration testing. +impl<'j> CustomCedarImpl for JavaDefinitionalEngine<'j> { + fn is_authorized( + &self, + request: &ast::Request, + policies: &ast::PolicySet, + entities: &Entities, + ) -> InterfaceResponse { + self.is_authorized(request, policies, entities) + } + + fn validate( + &self, + schema: cedar_policy_validator::ValidatorSchema, + policies: &ast::PolicySet, + ) -> cedar_policy::integration_testing::IntegrationTestValidationResult { + let definitional_res = self.validate( + &schema, + policies, + cedar_policy_validator::ValidationMode::default(), + ); + assert!( + definitional_res.parsing_succeeded(), + "Dafny json parsing failed for:\nPolicies:\n{}\nSchema:\n{:?}Errors:\n{:?}", + &policies, + schema, + definitional_res.parse_errors + ); + IntegrationTestValidationResult { + validation_passed: definitional_res.validation_passed(), + validation_errors_debug: format!("{:?}", definitional_res.validation_errors), + } + } +} diff --git a/cedar-drt/src/definitional_request_types.rs b/cedar-drt/src/definitional_request_types.rs index 992823101..7d96880e0 100644 --- a/cedar-drt/src/definitional_request_types.rs +++ b/cedar-drt/src/definitional_request_types.rs @@ -22,15 +22,6 @@ pub use cedar_policy_validator::{ValidationMode, ValidationResult, ValidatorSche pub use entities::Entities; use serde::{Deserialize, Serialize}; -/// Times to (de)serialize JSON content sent to / received from the Dafny-Java -/// implementation. -pub const RUST_SERIALIZATION_MSG: &str = "rust_serialization (ns) : "; -pub const RUST_DESERIALIZATION_MSG: &str = "rust_deserialization (ns) : "; - -/// Times for cedar-policy authorization and validation. -pub const RUST_AUTH_MSG: &str = "rust_auth (ns) : "; -pub const RUST_VALIDATION_MSG: &str = "rust_validation (ns) : "; - #[derive(Debug, Serialize)] pub struct RequestForDefEngine<'a> { pub request: &'a ast::Request, @@ -40,37 +31,37 @@ pub struct RequestForDefEngine<'a> { #[derive(Debug, Serialize, Deserialize)] pub struct DefinitionalAuthResponse { - serialization_nanos: i64, - deserialization_nanos: i64, - auth_nanos: i64, - response: InterfaceResponse, + pub serialization_nanos: i64, + pub deserialization_nanos: i64, + pub auth_nanos: i64, + pub response: InterfaceResponse, } #[derive(Debug, Serialize)] -struct EvalRequestForDefEngine<'a> { - request: &'a ast::Request, - entities: &'a Entities, - expr: &'a ast::Expr, - expected: Option<&'a ast::Expr>, +pub struct EvalRequestForDefEngine<'a> { + pub request: &'a ast::Request, + pub entities: &'a Entities, + pub expr: &'a ast::Expr, + pub expected: Option<&'a ast::Expr>, } #[derive(Debug, Serialize, Deserialize, Clone, Copy)] #[repr(transparent)] -struct DefinitionalEvalResponse { - matches: bool, +pub struct DefinitionalEvalResponse { + pub matches: bool, } #[derive(Debug, Serialize)] -struct RequestForDefValidator<'a> { - schema: &'a ValidatorSchema, - policies: &'a ast::PolicySet, - mode: ValidationMode, +pub struct RequestForDefValidator<'a> { + pub schema: &'a ValidatorSchema, + pub policies: &'a ast::PolicySet, + pub mode: ValidationMode, } #[derive(Debug, Deserialize)] pub struct DefinitionalValResponse { - serialization_nanos: i64, - deserialization_nanos: i64, - validation_nanos: i64, - response: ValidationInterfaceResponse, + pub serialization_nanos: i64, + pub deserialization_nanos: i64, + pub validation_nanos: i64, + pub response: ValidationInterfaceResponse, } diff --git a/cedar-drt/src/lean_impl.rs b/cedar-drt/src/lean_impl.rs index 8db584405..837d520e6 100644 --- a/cedar-drt/src/lean_impl.rs +++ b/cedar-drt/src/lean_impl.rs @@ -24,6 +24,7 @@ use core::panic; use std::{collections::HashSet, env, ffi::CString}; use crate::cedar_test_impl::*; +use crate::definitional_request_types::*; use cedar_policy::frontend::is_authorized::InterfaceResponse; use cedar_policy::integration_testing::{CustomCedarImpl, IntegrationTestValidationResult}; use cedar_policy::Diagnostics; @@ -43,8 +44,6 @@ use serde::{Deserialize, Serialize}; use std::ffi::CStr; use std::str::FromStr; -use crate::definitional_request_types::*; - /// Times for JSON (de)serialization, authorization, and validation as reported /// by the Lean implementation. pub const LEAN_SERIALIZATION_MSG: &str = "lean_serialization (ns) : "; @@ -52,8 +51,8 @@ pub const LEAN_DESERIALIZATION_MSG: &str = "lean_deserialization (ns) : "; pub const LEAN_AUTH_MSG: &str = "lean_auth (ns) : "; pub const LEAN_VALIDATION_MSG: &str = "lean_validation (ns) : "; + #[link(name = "Cedar", kind = "static")] -// #[link(name = "Lean")] #[link(name = "Std", kind = "static")] #[link(name = "DiffTest", kind = "static")] #[link(name = "leanshared", kind = "dylib")] @@ -168,6 +167,7 @@ impl CedarTestImplementation for LeanDefinitionalEngine { policies: &ast::PolicySet, entities: &Entities, ) -> InterfaceResponse { + println!("Running is_authorized"); self.is_authorized(request, policies, entities) } @@ -207,6 +207,6 @@ impl CustomCedarImpl for LeanDefinitionalEngine { _schema: cedar_policy_validator::ValidatorSchema, _policies: &ast::PolicySet, ) -> IntegrationTestValidationResult { - panic!("Unimplemented: validate (test)"); + unimplemented!("Unimplemented: validate"); } } diff --git a/cedar-drt/src/lib.rs b/cedar-drt/src/lib.rs index 11b5dabd7..3b521b1c2 100644 --- a/cedar-drt/src/lib.rs +++ b/cedar-drt/src/lib.rs @@ -16,11 +16,13 @@ // #![forbid(unsafe_code)] mod cedar_test_impl; +mod dafny_java_impl; mod definitional_request_types; mod lean_impl; mod logger; pub use cedar_test_impl::*; +pub use dafny_java_impl::*; pub use definitional_request_types::*; pub use lean_impl::*; pub use logger::*; diff --git a/cedar-drt/tests/integration_tests.rs b/cedar-drt/tests/integration_tests.rs index 51f94e4d5..1aaca60c9 100644 --- a/cedar-drt/tests/integration_tests.rs +++ b/cedar-drt/tests/integration_tests.rs @@ -69,8 +69,14 @@ fn run_integration_tests(custom_impl: &dyn CustomCedarImpl) { } #[test] -fn integration_tests_on_lean_def_impl() { - let lean_def_impl = LeanDefinitionalEngine::new().unwrap(); +fn integration_tests_on_java_def_impl() { + let java_def_impl = + JavaDefinitionalEngine::new().expect("failed to create definitional engine"); + run_integration_tests(&java_def_impl) +} +#[test] +fn integration_tests_on_lean_def_impl() { + let lean_def_impl = LeanDefinitionalEngine::new(); run_integration_tests(&lean_def_impl) } diff --git a/cedar-lean/Cedar.lean b/cedar-lean/Cedar.lean index 29ccba865..f79829fb3 100644 --- a/cedar-lean/Cedar.lean +++ b/cedar-lean/Cedar.lean @@ -16,5 +16,5 @@ import Cedar.Data import Cedar.Spec --- import Cedar.Thm -import Cedar.Validation +import Cedar.Thm +import Cedar.Validation \ No newline at end of file diff --git a/cedar-lean/DiffTest/Main.lean b/cedar-lean/DiffTest/Main.lean index fb68fce6e..c16f9a8d3 100644 --- a/cedar-lean/DiffTest/Main.lean +++ b/cedar-lean/DiffTest/Main.lean @@ -35,4 +35,11 @@ open Cedar.Data let json := Lean.toJson (isAuthorized request entities policies) toString json +def test : IO Unit := do + let input ← IO.FS.readFile "DiffTest/example.json" + IO.println (isAuthorizedDRT input) + +-- result should be "allow" due to policy0 +#eval test + end DiffTest diff --git a/cedar-lean/DiffTest/example.json b/cedar-lean/DiffTest/example.json new file mode 100644 index 000000000..c27df389b --- /dev/null +++ b/cedar-lean/DiffTest/example.json @@ -0,0 +1,717 @@ +{ + "request": { + "principal": { + "Concrete": { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + }, + "action": { + "Concrete": { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource": { + "Concrete": { + "ty": { + "Concrete": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + } + }, + "context": { + "expr_kind": { + "Record": { + "authenticated": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": null, + "data": null + }, + "confidence_score": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "decimal", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "0.6" + } + }, + "source_info": null, + "data": null + } + ] + } + }, + "source_info": null, + "data": null + }, + "source_ip": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "ip", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "123.123.123.123" + } + }, + "source_info": null, + "data": null + } + ] + } + }, + "source_info": null, + "data": null + } + } + }, + "source_info": null, + "data": null + } + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + } + }, + "action_constraint": { + "Eq": { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Concrete": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 56, + "end": 168 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "entities": { + "entities": [ + [ + { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Concrete": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + } + ] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Administrator", + "path": [] + } + }, + "eid": "ahmad" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Administrator", + "path": [] + } + }, + "eid": "ahmad" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Photo", + "path": [] + } + }, + "eid": "selfie.jpg" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Photo", + "path": [] + } + }, + "eid": "selfie.jpg" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + } + ] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "bob" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "bob" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Video", + "path": [] + } + }, + "eid": "surf.mp4" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Video", + "path": [] + } + }, + "eid": "surf.mp4" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + }, + { + "ty": { + "Concrete": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + } + ] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Photo", + "path": [] + } + }, + "eid": "passportscan.jpg" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Photo", + "path": [] + } + }, + "eid": "passportscan.jpg" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + }, + { + "ty": { + "Concrete": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + } + ] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "tim" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "User", + "path": [] + } + }, + "eid": "tim" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Concrete": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + } + ] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "uid": { + "ty": { + "Concrete": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "attrs": {}, + "ancestors": [] + } + ] + ] + } +} \ No newline at end of file From c92b8e0a378c53dd0739a333502ccefb91fe1195 Mon Sep 17 00:00:00 2001 From: Kesha Hietala Date: Fri, 17 Nov 2023 14:49:51 -0500 Subject: [PATCH 23/57] refactoring in parser --- cedar-lean/Cedar/Spec/Expr.lean | 3 + cedar-lean/Cedar/Spec/Ext.lean | 3 +- cedar-lean/Cedar/Spec/Ext/Decimal.lean | 5 +- cedar-lean/Cedar/Spec/Ext/IPAddr.lean | 1 + cedar-lean/Cedar/Spec/ExtFun.lean | 3 +- cedar-lean/DiffTest.lean | 1 + cedar-lean/DiffTest/Main.lean | 14 +- cedar-lean/DiffTest/Parser.lean | 674 ++++++++++-------------- cedar-lean/DiffTest/Util.lean | 114 ++++ cedar-lean/DiffTestStandAlone/Main.lean | 15 +- 10 files changed, 412 insertions(+), 421 deletions(-) create mode 100644 cedar-lean/DiffTest/Util.lean diff --git a/cedar-lean/Cedar/Spec/Expr.lean b/cedar-lean/Cedar/Spec/Expr.lean index 5a04a2634..578d35488 100644 --- a/cedar-lean/Cedar/Spec/Expr.lean +++ b/cedar-lean/Cedar/Spec/Expr.lean @@ -71,6 +71,9 @@ deriving instance Repr for UnaryOp deriving instance Repr for BinaryOp deriving instance Repr for Expr +deriving instance Inhabited for Var +deriving instance Inhabited for UnaryOp +deriving instance Inhabited for BinaryOp deriving instance Inhabited for Expr deriving instance DecidableEq for Var diff --git a/cedar-lean/Cedar/Spec/Ext.lean b/cedar-lean/Cedar/Spec/Ext.lean index 108249b7d..33805f861 100644 --- a/cedar-lean/Cedar/Spec/Ext.lean +++ b/cedar-lean/Cedar/Spec/Ext.lean @@ -40,6 +40,7 @@ def Ext.lt : Ext → Ext → Bool ----- Derivations ----- deriving instance Repr for Ext +deriving instance Inhabited for Ext deriving instance DecidableEq for Ext instance : LT Ext where @@ -54,4 +55,4 @@ instance : Coe Decimal Ext where instance : Coe IPAddr Ext where coe a := .ipaddr a -end Cedar.Spec \ No newline at end of file +end Cedar.Spec diff --git a/cedar-lean/Cedar/Spec/Ext/Decimal.lean b/cedar-lean/Cedar/Spec/Ext/Decimal.lean index a29d6d7a5..1e9162d6f 100644 --- a/cedar-lean/Cedar/Spec/Ext/Decimal.lean +++ b/cedar-lean/Cedar/Spec/Ext/Decimal.lean @@ -65,6 +65,9 @@ def le (d₁ d₂ : Decimal) : Bool := d₁.1 ≤ d₂.1 ----- Derivations ----- +instance : Inhabited Decimal where + default := Subtype.mk 0 (by simp) + instance : LT Decimal where lt := fun d₁ d₂ => Decimal.lt d₁ d₂ @@ -79,4 +82,4 @@ if h : Decimal.le d₁ d₂ then isTrue h else isFalse h end Decimal -end Cedar.Spec.Ext \ No newline at end of file +end Cedar.Spec.Ext diff --git a/cedar-lean/Cedar/Spec/Ext/IPAddr.lean b/cedar-lean/Cedar/Spec/Ext/IPAddr.lean index 61e18fcbf..50d4fbb89 100644 --- a/cedar-lean/Cedar/Spec/Ext/IPAddr.lean +++ b/cedar-lean/Cedar/Spec/Ext/IPAddr.lean @@ -257,6 +257,7 @@ def IPNet.lt : IPNet → IPNet → Bool ----- IPNet deriviations ----- deriving instance Repr for IPNet +deriving instance Inhabited for IPNet deriving instance DecidableEq for IPNet instance : LT IPNet where diff --git a/cedar-lean/Cedar/Spec/ExtFun.lean b/cedar-lean/Cedar/Spec/ExtFun.lean index 2ecef1a08..2e0861176 100644 --- a/cedar-lean/Cedar/Spec/ExtFun.lean +++ b/cedar-lean/Cedar/Spec/ExtFun.lean @@ -65,6 +65,7 @@ def call : ExtFun → List Value → Result Value ----- Derivations ----- deriving instance Repr for ExtFun +deriving instance Inhabited for ExtFun deriving instance DecidableEq for ExtFun -end Cedar.Spec \ No newline at end of file +end Cedar.Spec diff --git a/cedar-lean/DiffTest.lean b/cedar-lean/DiffTest.lean index a8b78e532..fd3499c17 100644 --- a/cedar-lean/DiffTest.lean +++ b/cedar-lean/DiffTest.lean @@ -16,3 +16,4 @@ import DiffTest.Main import DiffTest.Parser +import DiffTest.Util diff --git a/cedar-lean/DiffTest/Main.lean b/cedar-lean/DiffTest/Main.lean index fb68fce6e..32c1e6f13 100644 --- a/cedar-lean/DiffTest/Main.lean +++ b/cedar-lean/DiffTest/Main.lean @@ -17,6 +17,7 @@ import Lean.Data.Json.FromToJson import Cedar.Spec +import DiffTest.Util import DiffTest.Parser /-! This file defines the public interfaces for the Lean implementation. @@ -29,10 +30,13 @@ open Cedar.Data @[export isAuthorizedDRT] def isAuthorizedDRT (req : String) : String := let json := Lean.Json.parse req - let request := jsonToRequest json - let entities := jsonToEntities json - let policies := jsonToPolicies json - let json := Lean.toJson (isAuthorized request entities policies) - toString json + match json with + | .error e => panic! s!"isAuthorizedDRT: failed to parse input: {e}" + | .ok json => + let request := jsonToRequest (getJsonField json "request") + let entities := jsonToEntities (getJsonField json "entities") + let policies := jsonToPolicies (getJsonField json "policies") + let response := isAuthorized request entities policies + toString (Lean.toJson response) end DiffTest diff --git a/cedar-lean/DiffTest/Parser.lean b/cedar-lean/DiffTest/Parser.lean index c788ed5e0..bdbe4a475 100644 --- a/cedar-lean/DiffTest/Parser.lean +++ b/cedar-lean/DiffTest/Parser.lean @@ -24,428 +24,288 @@ import Cedar.Data import Cedar.Spec import Cedar.Spec.Ext +import DiffTest.Util + namespace DiffTest open Cedar.Spec open Cedar.Data open Cedar.Spec.Ext -def unwrapExcept (e: Except String Lean.Json) : Lean.Json := match e.isOk with - | true => Option.get! e.toOption - | false => panic! "unwrapExcept: is not ok" - -def strNodeToString (node : Lean.Json) : String := match node with - | Lean.Json.str s => s - | _ => panic! "strNodeToString" - -def jsonToEUID (json : Except String Lean.Json) : EntityUID := match json.isOk with - | false => panic! "sorry" - | true => - let json := Option.get! json.toOption - let eid := (match unwrapExcept (json.getObjVal? "eid") with - | Lean.Json.str str => str - | _ => panic! json.pretty) - match json.getObjVal? "ty" with - | .error _ => { - ty := { - id := "Unspecified", - path := [] - }, - eid := eid - } - | .ok (Lean.Json.str str) => { - ty := { - id := str, - path := [] - }, - eid := eid - } - | .ok _ => - let ty := (unwrapExcept (json.getObjVal? "ty")).getObjVal? "Concrete" - let ty := Option.get! ty.toOption - match (unwrapExcept (ty.getObjVal? "id")), (unwrapExcept (ty.getObjVal? "path")) with - | Lean.Json.str id, Lean.Json.arr path_json => - let path := List.map strNodeToString path_json.toList - { - ty := { - id := id, - path := path - }, - eid := eid - } - | _,_ => panic! "sorry" - -def litHelper (json : Except String Lean.Json) : Expr := match json.isOk with - | false => panic! "litHelper: is not ok" - | true => let json := Option.get! json.toOption - match json with - | Lean.Json.bool b => .lit (.bool b) - | Lean.Json.num n => match n.exponent with - | 0 => .lit (.int (Int64.mk! n.mantissa)) - | _ => panic! "litHelper: num has exponent: " ++ json.pretty - | Lean.Json.str s => .lit (.string s) - | _ => panic! "litHelper: not known format for json: " ++ json.pretty - -def handleLit (json : Except String Lean.Json) : Expr := match json.isOk with - | false => panic! "handleLit: not ok json" - | true => let json := Option.get! json.toOption - match (json.getObjVal? "Bool").isOk with - | true => litHelper (json.getObjVal? "Bool") - | false => match (json.getObjVal? "Long").isOk with - | true => litHelper (json.getObjVal? "Long") - | false => match (json.getObjVal? "String").isOk with - | true => litHelper (json.getObjVal? "String") - | false => match (json.getObjVal? "EntityUID").isOk with - | true => .lit (.entityUID (jsonToEUID (json.getObjVal? "EntityUID"))) - | false => panic! "handleLit: not known format" ++ json.pretty - -def handleWildcardObj (json : Lean.Json) : PatElem := match json with -| Lean.Json.str "Wildcard" => .star -| Lean.Json.obj _ => match (json.getObjVal? "Char") with - | .ok (Lean.Json.num n) => match n.exponent with - | 0 => .justChar (Char.ofNat (n.mantissa.toNat)) - | _ => panic! "handleWildcardObj: non zero exponent: " ++ json.pretty - | _ => panic! "handleWildcardObj: something unknown in wildcard: " ++ json.pretty -| _ => panic! "handleWildcardObj: " ++ json.pretty - -def arrayToKVPairList (json : Array Lean.Json) : Prod (List Lean.Json) (List Lean.Json) := -List.unzip (List.map (fun x => match x with - | Lean.Json.arr kv => (kv[0]!, kv[1]!) - | _ => panic! "arrayToKVPairList: " ++ x.pretty) json.toList) - --- Need to convert JSON structure to Expr structure. We expect JSON to have format: --- --- "Expr": { --- "Lit" : { "Bool" | "Long" | "String" | "EntityUID" : blah} --- "Var" : { "Principal" | "Action" | "Resource" | "Context" } --- "If" : {"test_expr": Expr, "then_expr": Expr, "else_expr": Expr} --- "And" : {"left": Expr, "right": Expr} --- "Or" : {"left": Expr, "right": Expr} --- "UnaryApp" : {"op": UnaryOp, "arg": Expr} --- "BinaryApp" : {"op": UnaryOp, "arg1": Expr, "arg2": Expr} --- "GetAttr" : {"expr": Expr, "attr": String} --- "HasAttr" : {"expr": Expr, "arg": String} --- "Set" : {[Expr]} --- "Record" : {"id1": Expr, "id2": Expr, ...} --- } +def jsonToName (json : Lean.Json) : Name := + let id := jsonToString (getJsonField json "id") + let path_json := jsonToArray (getJsonField json "path") + let path := List.map jsonToString path_json.toList + { + id := id, + path := path + } + +def jsonToEntityType (json : Lean.Json) : EntityType := + jsonToName (getJsonField json "Concrete") + +def jsonToEuid (json : Lean.Json) : EntityUID := + let eid := jsonToString (getJsonField json "eid") + let ty := jsonToEntityType (getJsonField json "ty") + { + ty := ty, + eid := eid + } + +def jsonToPrim (json : Lean.Json) : Prim := + let (tag, body) := unpackJsonSum json + match tag with + | "Bool" => .bool (jsonToBool body) + | "Long" => .int (jsonToInt64 body) + | "String" => .string (jsonToString body) + | "EntityUID" => .entityUID (jsonToEuid body) + | tag => panic! s!"jsonToPrim: unknown tag {tag}" + +def jsonToVar (json : Lean.Json) : Var := + let var := jsonToString json + match var with + | "principal" => .principal + | "action" => .action + | "resource" => .resource + | "context" => .context + | _ => panic! s!"jsonToVar: unknown variable {var}" + +def jsonToUnaryOp (json : Lean.Json) : UnaryOp := + let op := jsonToString json + match op with + | "Not" => .not + | "Neg" => .neg + | op => panic! s!"jsonToUnaryOp: unknown operator {op}" + +def jsonToPatElem (json : Lean.Json) : PatElem := + let (tag, body) := unpackJsonSum json + match tag with + | "Wildcard" => .star + | "Char" => .justChar (jsonToChar body) + | tag => panic! s!"jsonToPatElem: unsupported tag {tag}" + +def jsonToPattern (json : Lean.Json) : Pattern := + let elems := jsonToArray json + List.map jsonToPatElem elems.toList + +def jsonToBinaryOp (json : Lean.Json) : BinaryOp := + let op := jsonToString json + match op with + | "Eq" => .eq + | "In" => .mem + | "Less" => .less + | "LessEq" => .lessEq + | "Add" => .add + | "Sub" => .sub + | "Contains" => .contains + | "ContainsAll" => .containsAll + | "ContainsAny" => .containsAny + | op => panic! s!"jsonToBinaryOp: unknown operator {op}" + +def jsonToExtFun (json : Lean.Json) : ExtFun := + let xfn := jsonToName json + match xfn.id with + | "decimal" => .decimal + | "lessThan" => .lessThan + | "lessThanOrEqual" => .lessThanOrEqual + | "greaterThan" => .greaterThan + | "greaterThanOrEqual" => .greaterThanOrEqual + | "ip" => .ip + | "isIpv4" => .isIpv4 + | "isIpv6" => .isIpv6 + | "isLoopback" => .isLoopback + | "isMulticast" => .isMulticast + | "isInRange" => .isInRange + | xfn => panic! s!"jsonToExtFun: unknown extension function {xfn}" /- -defined as partial to avoid writing the proof of termination, which isn't really required -as we don't need to prove correctness of the parser -- no proofs involve the parser, and -we can be confident it terminates :) +Defined as partial to avoid writing the proof of termination, which isn't required +since we don't prove correctness of the parser. -/ -partial def jsonToExpr (json : Except String Lean.Json) : Expr := match json.isOk with - | false => panic! "sorry" - | true => - let json := Option.get! json.toOption - let json := unwrapExcept (json.getObjVal? "expr_kind") - match json with - | Lean.Json.null => panic! "sorry" - | Lean.Json.bool b => .lit (.bool b) - | Lean.Json.num n => match n.exponent with - | 0 => .lit (.int (Int64.mk! n.mantissa)) - | _ => panic! "sorry" - | Lean.Json.str s => .lit (.string s) - | Lean.Json.arr _ => panic! "sorry" - | _ => - match (json.getObjVal? "Lit").isOk with - | true => handleLit (json.getObjVal? "Lit") - | false => match (json.getObjVal? "Var").isOk with - | true => - let v := unwrapExcept (json.getObjVal? "Var") - match v with - | Lean.Json.str s => match s with - | "principal" => .var .principal - | "action" => .var .action - | "resource" => .var .resource - | "context" => .var .context - | _ => panic! "unknown string in var" - | _ => panic! "var not string" - | false => match (json.getObjVal? "And").isOk with - | true => - let lhs := (unwrapExcept (json.getObjVal? "And")).getObjVal? "left" - let rhs := (unwrapExcept (json.getObjVal? "And")).getObjVal? "right" - .and (jsonToExpr lhs) (jsonToExpr rhs) - | false => match (json.getObjVal? "Or").isOk with - | true => - let lhs := (unwrapExcept (json.getObjVal? "Or")).getObjVal? "left" - let rhs := (unwrapExcept (json.getObjVal? "Or")).getObjVal? "right" - .or (jsonToExpr lhs) (jsonToExpr rhs) - | false => match (json.getObjVal? "If").isOk with - | true => - let g := (unwrapExcept (json.getObjVal? "If")).getObjVal? "test_expr" - let t := (unwrapExcept (json.getObjVal? "If")).getObjVal? "then_expr" - let e := (unwrapExcept (json.getObjVal? "If")).getObjVal? "else_expr" - .ite (jsonToExpr g) (jsonToExpr t) (jsonToExpr e) - | false => match (json.getObjVal? "UnaryApp").isOk with - | true => - let json := unwrapExcept (json.getObjVal? "UnaryApp") - match (json.getObjVal? "op").isOk, (json.getObjVal? "arg").isOk with - | true, true => - let objVal := Option.get! (json.getObjVal? "op").toOption - let arg := json.getObjVal? "arg" - match objVal with - | Lean.Json.str s => match s with - | "Not" => .unaryApp .not (jsonToExpr arg) - | "Neg" => .unaryApp .neg (jsonToExpr arg) - | _ => panic! "unknown unary op" - | _ => panic! "incorrect op for unary app" - | _ , _ => panic! "unary app does not have right fields: " ++ json.pretty - | false => match (json.getObjVal? "MulByConst").isOk with - | true => - let json := Option.get! (json.getObjVal? "MulByConst").toOption - let arg := json.getObjVal? "arg" - let constJson := unwrapExcept (json.getObjVal? "constant") - match constJson with - | Lean.Json.num n => match n.exponent with - | 0 => .unaryApp (.mulBy (Int64.mk! n.mantissa)) (jsonToExpr arg) - | _ => panic! "sorry" - | _ => panic! "constant for mul by is not a numebr" - | false => match (json.getObjVal? "Like").isOk with - | true => - let json := Option.get! (json.getObjVal? "Like").toOption - let expr := jsonToExpr (json.getObjVal? "expr") - match (json.getObjVal? "pattern") with - | .ok (Lean.Json.arr arr) => .unaryApp (.like (List.map handleWildcardObj arr.toList)) expr - | _ => panic! "not an array in Like" - | false => match (json.getObjVal? "BinaryApp").isOk with - | true => - let json := unwrapExcept (json.getObjVal? "BinaryApp") - let op := unwrapExcept (json.getObjVal? "op") - let arg1 := jsonToExpr (json.getObjVal? "arg1") - let arg2 := jsonToExpr (json.getObjVal? "arg2") - match op with - | Lean.Json.str s => match s with - | "Eq" => .binaryApp .eq arg1 arg2 - | "In" => .binaryApp .mem arg1 arg2 - | "Less" => .binaryApp .less arg1 arg2 - | "LessEq" => .binaryApp .lessEq arg1 arg2 - | "Add" => .binaryApp .add arg1 arg2 - | "Sub" => .binaryApp .sub arg1 arg2 - | "Contains" => .binaryApp .contains arg1 arg2 - | "ContainsAll" => .binaryApp .containsAll arg1 arg2 - | "ContainsAny" => .binaryApp .containsAny arg1 arg2 - | _ => panic! "unknown op for binary app" - | _ => panic "op for binary app is not a string" - | false => match (json.getObjVal? "GetAttr").isOk with - | true => - let e := (unwrapExcept (json.getObjVal? "GetAttr")).getObjVal? "expr" - let wrapped_attr := (unwrapExcept (json.getObjVal? "GetAttr")).getObjVal? "attr" - match e.isOk, wrapped_attr.isOk with - | true,true => match unwrapExcept wrapped_attr with - | Lean.Json.str s => .getAttr (jsonToExpr e) s - | _ => panic! "sorry" - | _,_ => panic! "sorry" - | false => match (json.getObjVal? "HasAttr").isOk with - | true => - let e := (unwrapExcept (json.getObjVal? "HasAttr")).getObjVal? "expr" - let wrapped_attr := (unwrapExcept (json.getObjVal? "HasAttr")).getObjVal? "attr" - match e.isOk, wrapped_attr.isOk with - | true,true => match unwrapExcept wrapped_attr with - | Lean.Json.str s => .hasAttr (jsonToExpr e) s - | _ => panic! "sorry" - | _,_ => panic! "sorry" - | false => match (json.getObjVal? "Record").isOk with - | true => - let attrs := unwrapExcept (json.getObjVal? "Record") - match attrs with - | Lean.Json.obj obj => - let pairs := (obj.fold (fun l s j => (s,j) :: l) []) - let keys := List.map Prod.fst pairs - let vals := List.map (jsonToExpr ∘ Except.ok ∘ Prod.snd) pairs - Expr.record (List.zip keys vals) - | _ => panic! "Invalid record shape" - | false => match (json.getObjVal? "Set").isOk with - | true => - let e := (unwrapExcept (json.getObjVal? "Set")).getArr? - match e.isOk with - | true => - let e := Option.get! e.toOption - let es := List.map jsonToExpr (List.map Except.ok e.toList) - let exs : Expr := .set es - exs - | false => panic! "sorry" - | false => match (json.getObjVal? "ExtensionFunctionApp").isOk with - | true => - let e := (unwrapExcept (json.getObjVal? "ExtensionFunctionApp")) - let args := Option.get! ((unwrapExcept (e.getObjVal? "args")).getArr?).toOption - let args := List.map (jsonToExpr ∘ Except.ok) args.toList - let fn_name := (unwrapExcept ((unwrapExcept (e.getObjVal? "fn_name")).getObjVal? "id")).getStr? - match fn_name with - | .ok "decimal" => .call .decimal args - | .ok "lessThan" => .call .lessThan args - | .ok "lessThanOrEqual" => .call .lessThanOrEqual args - | .ok "greaterThan" => .call .greaterThan args - | .ok "greaterThanOrEqual" => .call .greaterThanOrEqual args - | .ok "ip" => .call .ip args - | .ok "isIpv4" => .call .isIpv4 args - | .ok "isIpv6" => .call .isIpv6 args - | .ok "isLoopback" => .call .isLoopback args - | .ok "isMulticast" => .call .isMulticast args - | .ok "isInRange" => .call .isInRange args - | .ok name => panic! "unknown extension function: "++name - | .error e => panic! "extension fn name error: "++e - | false => panic! json.pretty - -partial def exprToValue (expr : Expr) : Value := match expr with +partial def jsonToExpr (json : Lean.Json) : Expr := + let json := getJsonField json "expr_kind" + let (tag, body) := unpackJsonSum json + match tag with + | "Lit" => .lit (jsonToPrim body) + | "Var" => + let var := jsonToString body + .var (jsonToVar var) + | "And" => + let lhs := getJsonField body "left" + let rhs := getJsonField body "right" + .and (jsonToExpr lhs) (jsonToExpr rhs) + | "Or" => + let lhs := getJsonField body "left" + let rhs := getJsonField body "right" + .or (jsonToExpr lhs) (jsonToExpr rhs) + | "If" => + let i := getJsonField body "test_expr" + let t := getJsonField body "then_expr" + let e := getJsonField body "else_expr" + .ite (jsonToExpr i) (jsonToExpr t) (jsonToExpr e) + | "UnaryApp" => + let op := getJsonField body "op" + let arg := getJsonField body "arg" + .unaryApp (jsonToUnaryOp op) (jsonToExpr arg) + | "MulByConst" => + let c := getJsonField body "constant" + let expr := getJsonField body "expr" + .unaryApp (.mulBy (jsonToInt64 c)) (jsonToExpr expr) + | "Like" => + let pat := getJsonField body "pattern" + let expr := getJsonField body "expr" + .unaryApp (.like (jsonToPattern pat)) (jsonToExpr expr) + | "Is" => + let ety := getJsonField body "entity_type" + let expr := getJsonField body "expr" + .unaryApp (.is (jsonToName ety)) (jsonToExpr expr) + | "BinaryApp" => + let op := getJsonField body "op" + let arg1 := getJsonField body "arg1" + let arg2 := getJsonField body "arg2" + .binaryApp (jsonToBinaryOp op) (jsonToExpr arg1) (jsonToExpr arg2) + | "GetAttr" => + let e := getJsonField body "expr" + let attr := getJsonField body "attr" + .getAttr (jsonToExpr e) (jsonToString attr) + | "HasAttr" => + let e := getJsonField body "expr" + let attr := getJsonField body "attr" + .hasAttr (jsonToExpr e) (jsonToString attr) + | "Record" => + let kvs := jsonObjToKVList body + .record (List.map (λ (k,v) => (k,jsonToExpr v)) kvs) + | "Set" => + let arr := jsonToArray body + .set (List.map jsonToExpr arr.toList) + | "ExtensionFunctionApp" => + let args := jsonToArray (getJsonField body "args") + let fn := getJsonField body "fn_name" + .call (jsonToExtFun fn) (List.map jsonToExpr args.toList) + | tag => panic! s!"jsonToExpr: unknown tag {tag}" + +def extExprToValue (xfn : ExtFun) (args : List Expr) : Value := + match xfn, args with + | .decimal, [.lit (.string s)] => match Decimal.decimal s with + | .some v => .ext (.decimal v) + | .none => panic! s!"exprToValue: failed to parse decimal {s}" + | .ip, [.lit (.string s)] => match IPAddr.ip s with + | .some v => .ext (.ipaddr v) + | .none => panic! s!"exprToValue: failed to parse ip {s}" + | _,_ => panic! "exprToValue: unexpected extension value\n" ++ toString (repr (Expr.call xfn args)) + +/- +Convert an expression to a value. This function is used to parse values +that were serialized as expressions in the JSON, so it fails if the +conversion is non-trivial. +-/ +partial def exprToValue : Expr → Value | Expr.lit p => Value.prim p - | Expr.record r => Value.record (Map.mk (List.map (λ (a,ex) => (a , exprToValue ex)) r)) + | Expr.record r => Value.record (Map.mk (List.map (λ (k,v) => (k,exprToValue v)) r)) | Expr.set s => Value.set (Set.mk (List.map exprToValue s)) - | Expr.call ty arg => match ty, arg with - | .decimal, [.lit (.string s)] => match Decimal.decimal s with - | .some v => .ext (.decimal v) - | .none => panic! "could not parse decimal" - | .ip, [.lit (.string s)] => match IPAddr.ip s with - | .some v => .ext (.ipaddr v) - | .none => panic! "could not parse ip" - | _,_ => panic! "unexpected extension function in exprToValue" - | _ => panic! toString (repr expr) - -def jsonToValue (json : Except String Lean.Json) : Value := match json.isOk with - | false => panic! "sorry" - | true => - (exprToValue ∘ jsonToExpr) json - -def jsonToContext (json : Except String Lean.Json) : Map Attr Value := match json.isOk with - | false => panic! "sorry" - | true => - let json := Option.get! json.toOption - let pairs_arr := unwrapExcept ((unwrapExcept (json.getObjVal? "expr_kind")).getObjVal? "Record") - match pairs_arr with - | Lean.Json.obj obj => - let pairs := (obj.fold (fun l s j => (s,j) :: l) []) - let keys := List.map Prod.fst pairs - let vals := List.map (exprToValue ∘ jsonToExpr ∘ Except.ok ∘ Prod.snd) pairs - Map.mk (List.zip keys vals) - | _ => panic! "uh oh" - -partial def jsonToRequest (json : Except String Lean.Json) : Request := match json.isOk with - | false => panic! "sorry" - | true => - let json := Option.get! json.toOption - let json := unwrapExcept (json.getObjVal? "request") - let principal := jsonToEUID ((unwrapExcept (json.getObjVal? "principal")).getObjVal? "Concrete") - let action := jsonToEUID ((unwrapExcept (json.getObjVal? "action")).getObjVal? "Concrete") - let resource := jsonToEUID ((unwrapExcept (json.getObjVal? "resource")).getObjVal? "Concrete") - let context := (jsonToContext ∘ json.getObjVal?) "context" - { - principal := principal, - action := action, - resource := resource, - context := context, - } - -def jsonToEntityData (json : Except String Lean.Json) : EntityData := match json.isOk with -| false => panic! "sorry" -| true => - let json := Option.get! json.toOption - let ancestors_json := unwrapExcept (json.getObjVal? "ancestors") - let ancestors := match ancestors_json with - | Lean.Json.arr arr => Set.mk (List.map (jsonToEUID ∘ Except.ok) arr.toList) - | _ => Set.empty - let attrs_json := unwrapExcept (json.getObjVal? "attrs") - let attrs := match attrs_json with - | Lean.Json.obj obj => - let pairs := (obj.fold (fun l s j => (s,j) :: l) []) - let keys := List.map Prod.fst pairs - let vals := List.map (exprToValue ∘ jsonToExpr ∘ Except.ok ∘ Prod.snd) pairs - Map.mk (List.zip keys vals) - | _ => panic! "uh oh" + | Expr.call xfn args => extExprToValue xfn args + | expr => panic! "exprToValue: invalid input expression\n" ++ toString (repr expr) + +def jsonToValue : Lean.Json → Value := exprToValue ∘ jsonToExpr + +def jsonToContext (json : Lean.Json) : Map Attr Value := + let value := jsonToValue json + match value with + | .record kvs => kvs + | _ => panic! "jsonToContext: context must be a record\n" ++ toString (repr value) + +/- +The "Concrete" in this function refers to "concrete" vs. "unknown" entities. +We only need to support the "Concrete" case here because the Lean does not +support partial evaluation. +-/ +partial def jsonToRequest (json : Lean.Json) : Request := + let principal := getJsonField (getJsonField json "principal") "Concrete" + let action := getJsonField (getJsonField json "action") "Concrete" + let resource := getJsonField (getJsonField json "resource") "Concrete" + let context := getJsonField json "context" + { + principal := jsonToEuid principal, + action := jsonToEuid action, + resource := jsonToEuid resource, + context := jsonToContext context, + } + +def jsonToEntityData (json : Lean.Json) : EntityData := + let ancestorsArr := jsonToArray (getJsonField json "ancestors") + let ancestors := Set.mk (List.map jsonToEuid ancestorsArr.toList) + let attrsKvs := jsonObjToKVList (getJsonField json "attrs") + let attrs := Map.mk (List.map (λ (k,v) => (k,jsonToValue v)) attrsKvs) { ancestors := ancestors, attrs := attrs } -def jsonToEntities (json : Except String Lean.Json) : Entities := match json.isOk with -| false => panic! "sorry" -| true => - let json := Option.get! json.toOption - let json := unwrapExcept (json.getObjVal? "entities") - let entities := unwrapExcept (json.getObjVal? "entities") - match entities with - | Lean.Json.arr arr => - let vs := (arrayToKVPairList arr).snd - let entityid := List.map (fun x => jsonToEUID (x.getObjVal? "uid")) vs - let entitydata := List.map (jsonToEntityData ∘ Except.ok) vs - Map.mk (List.zip entityid entitydata) - | _ => panic! "sorry" - -def strToScopeAny (str : String) : Scope := match str with -| "Any" => .any -| _ => panic! "sorry" - -def jsonToArgedScopePR (json : Lean.Json) (isEq : Bool) (isActionScope : Bool) : Scope := - let euidJson := if isActionScope then json else unwrapExcept (json.getObjVal? "EUID") - let euid := jsonToEUID (Except.ok euidJson) - if isEq then .eq euid else .mem euid - -def jsonToActionInAnyListEUID (json : Lean.Json) : List EntityUID := match json.getArr? with -| .ok arr => List.map (jsonToEUID ∘ Except.ok) arr.toList -| .error _ => panic! "sorry" - -def jsonToPolicy (json : Except String Lean.Json) : Policy := match json.isOk with - | false => panic! "sorry" - | true => - let json := Option.get! json.toOption - let idJson := unwrapExcept (json.getObjVal? "id") - let id := match idJson.getStr? with - | .ok str => str - | _ => panic! "sorry" - let effectJson := unwrapExcept (json.getObjVal? "effect") - let effect := match effectJson.getStr? with - | .ok str => match str with - | "permit" => Effect.permit - | "forbid" => Effect.forbid - | _ => panic! "sorry" - | .error _ => panic! "sorry" - let principalConstraintWrapped := unwrapExcept (json.getObjVal? "principal_constraint") - let principalConstraintJson := unwrapExcept (principalConstraintWrapped.getObjVal? "constraint") - let principalConstraint := match principalConstraintJson.getStr? with - | .ok str => .principalScope (strToScopeAny str) - | .error _ => match principalConstraintJson.getObjVal? "Eq" with - | .ok eqObj => .principalScope (jsonToArgedScopePR eqObj true false) - | .error _ => match principalConstraintJson.getObjVal? "In" with - | .ok inObj => .principalScope (jsonToArgedScopePR inObj false false) - | _ => panic! "sorry" - let actionConstraintJson := unwrapExcept (json.getObjVal? "action_constraint") - let actionConstraint := match actionConstraintJson.getStr? with - | .ok str => .actionScope (strToScopeAny str) - | .error _ => match actionConstraintJson.getObjVal? "Eq" with - | .ok eqObj => .actionScope (jsonToArgedScopePR eqObj true true) - | .error _ => match actionConstraintJson.getObjVal? "In" with - | .ok inObj => match inObj.getArr? with - | .ok _ => .actionInAny (jsonToActionInAnyListEUID inObj) - | .error _ => .actionScope (jsonToArgedScopePR inObj false true) - | _ => panic! "sorry" - let resourceConstraintWrapped := unwrapExcept (json.getObjVal? "resource_constraint") - let resourceConstraintJson := unwrapExcept (resourceConstraintWrapped.getObjVal? "constraint") - let resourceConstraint := match resourceConstraintJson.getStr? with - | .ok str => .resourceScope (strToScopeAny str) - | .error _ => match resourceConstraintJson.getObjVal? "Eq" with - | .ok eqObj => .resourceScope (jsonToArgedScopePR eqObj true false) - | .error _ => match resourceConstraintJson.getObjVal? "In" with - | .ok inObj => .resourceScope (jsonToArgedScopePR inObj false false) - | _ => panic! "sorry" - let condition := jsonToExpr (json.getObjVal? "non_head_constraints") - { - id := id - effect := effect, - principalScope := principalConstraint, - resourceScope := resourceConstraint, - actionScope := actionConstraint, - condition := condition - } - --- for now, doesn't include policy templates. --- a static policy is just a policy template with no blanks. -def jsonToPolicies (json : Except String Lean.Json) : Policies := match json.isOk with - | false => panic! "sorry" - | true => - let json := Option.get! json.toOption - let json := unwrapExcept (json.getObjVal? "policies") - let templates := unwrapExcept (json.getObjVal? "templates") - match templates.getObj? with - | .ok obj => List.map (jsonToPolicy ∘ Except.ok ∘ Prod.snd) (obj.fold (fun l s j => (s,j) :: l) []) - | _ => panic! "sorry" +def jsonToEntities (json : Lean.Json) : Entities := + let entities := getJsonField json "entities" + let kvs := jsonArrayToKVList entities + Map.mk (List.map (λ (k,v) => (jsonToEuid k, jsonToEntityData v)) kvs) + +def jsonToEffect (json : Lean.Json) : Effect := + let eff := jsonToString json + match eff with + | "permit" => .permit + | "forbid" => .forbid + | eff => panic! s!"jsonToEffect: unknown effect {eff}" + +/- +Slots not currently supported, but will be added in the future. +-/ +def jsonToEuidOrSlot (json : Lean.Json) : EntityUID := + let (tag, body) := unpackJsonSum json + match tag with + | "EUID" => jsonToEuid body + | tag => panic! s!"jsonToEuidOrSlot: unknown tag {tag}" + +def jsonToScope (json : Lean.Json) : Scope := + let (tag, body) := unpackJsonSum json + match tag with + | "Any" => .any + | "In" => .mem (jsonToEuidOrSlot body) + | "Eq" => .eq (jsonToEuidOrSlot body) + | "Is" => .is (jsonToName body) + | "IsIn" => + let (ety,e) := jsonToTuple body + .isMem (jsonToName ety) (jsonToEuidOrSlot e) + | tag => panic! s!"jsonToScope: unknown tag {tag}" + +def jsonToActionScope (json : Lean.Json) : ActionScope := + let (tag, body) := unpackJsonSum json + match tag with + | "Any" => .actionScope .any + | "In" => + let arr := jsonToArray body + .actionInAny (List.map jsonToEuid arr.toList) + | "Eq" => .actionScope (.eq (jsonToEuid body)) + | tag => panic! s!"jsonToActionScope: unknown tag {tag}" + +def jsonToPolicy (json : Lean.Json) : Policy := + let id := jsonToString (getJsonField json "id") + let effect := jsonToEffect (getJsonField json "effect") + let principalConstraint := getJsonField (getJsonField json "principal_constraint") "constraint" + let actionConstraint := getJsonField json "action_constraint" + let resourceConstraint := getJsonField (getJsonField json "resource_constraint") "constraint" + let condition := jsonToExpr (getJsonField json "non_head_constraints") + { + id := id + effect := effect, + principalScope := .principalScope (jsonToScope principalConstraint), + resourceScope := .resourceScope (jsonToScope resourceConstraint), + actionScope := jsonToActionScope actionConstraint, + condition := condition + } + +/- +For now, doesn't support policy templates. +A static policy is just a policy template with no blanks. +-/ +def jsonToPolicies (json : Lean.Json) : Policies := + let templates_kvs := jsonObjToKVList (getJsonField json "templates") + List.map (λ (_,v) => jsonToPolicy v) templates_kvs end DiffTest diff --git a/cedar-lean/DiffTest/Util.lean b/cedar-lean/DiffTest/Util.lean new file mode 100644 index 000000000..f3caf4659 --- /dev/null +++ b/cedar-lean/DiffTest/Util.lean @@ -0,0 +1,114 @@ +/- + Copyright 2022-2023 Amazon.com, Inc. or its affiliates. All Rights Reserved. + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + https://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +-/ + +import Lean.Data.Json.Parser +import Lean.Data.Json.Basic +import Lean.Data.Json.FromToJson +import Lean.Data.AssocList +import Lean.Data.RBMap + +import Cedar.Data + +/-! Utilities for parsing the JSON representation of serialized Rust datatypes. -/ + +namespace DiffTest + +open Cedar.Data +open Lean + +def getJsonField (json : Json) (field : String) : Json := + match json.getObjVal? field with + | .ok v => v + | .error e => panic! s!"getJsonField {field}: {e}\n" ++ json.pretty + +def jsonToString (json : Json) : String := + match json.getStr? with + | .ok s => s + | .error e => panic! s!"jsonToString: {e}\n" ++ json.pretty + +def jsonToArray (json : Json) : Array Json := + match json.getArr? with + | .ok a => a + | .error e => panic! s!"jsonToArray: {e}\n" ++ json.pretty + +def jsonToTuple (json : Json) : (Json × Json) := + let kv := jsonToArray json + if kv.size == 2 then (kv[0]!, kv[1]!) + else panic! "jsonToTuple: expected exactly two elements\n" ++ json.pretty + +def jsonArrayToKVList (json : Json) : List (Json × Json) := + let arr := jsonToArray json + List.map jsonToTuple arr.toList + +def arrayToKVPairList (json : Array Lean.Json) : Prod (List Lean.Json) (List Lean.Json) := +List.unzip (List.map (λ x => match x with + | Lean.Json.arr kv => (kv[0]!, kv[1]!) + | _ => panic! "arrayToKVPairList: " ++ x.pretty) json.toList) + + +def jsonObjToKVList (json : Json) : List (String × Json) := + match json.getObj? with + | .ok kvs => kvs.fold (λ acc k v => (k,v) :: acc) [] + | .error e => panic! s!"jsonToKVList: {e}\n" ++ json.pretty + +def jsonToBool (json : Json) : Bool := + match json.getBool? with + | .ok b => b + | .error e => panic! s!"jsonToBool: {e}\n" ++ json.pretty + +def jsonToNum (json : Json) : JsonNumber := + match json.getNum? with + | .ok n => n + | .error e => panic! s!"jsonToNum: {e}\n" ++ json.pretty + +def jsonToInt64 (json : Json) : Int64 := + let num := jsonToNum json + match num.exponent with + | 0 => Int64.mk! num.mantissa + | n => panic! s!"jsonToInt64: number has exponent {n}" + +def jsonToChar (json : Json) : Char := + let num := jsonToNum json + match num.exponent with + | 0 => + let nat := num.mantissa.toNat + if nat.isValidChar + then Char.ofNat nat + else panic! s!"jsonToChar: cannot convert to character {nat}" + | n => panic! s!"jsonToChar: cannot convert to character {n}" + +def getSingleElement (kvs : RBNode String (λ _ => Json)) : String × Json := + kvs.fold (init := ("",Json.null)) (λ _ k v => (k,v)) + +/- +Unpack the default Serde serialization of a Rust "enum" value into a tuple: +(variant tag, body). + +If the Rust enum constructor has no fields, Serde just outputs the tag as a +string. If the constructor has at least one field, Serde generates a JSON +object with a single field, named after the tag, whose value is a JSON +object containing the original fields. unpackJsonSum accepts both formats, +and in the first case, it returns jsonEmptyObject as the body for +consistency. +-/ +def unpackJsonSum (json : Json) : String × Json := match json with + | .str tag => (tag, .obj ∅) + | .obj kvs => + if kvs.size == 1 then getSingleElement kvs + else panic! "unpackJsonSum: expected exactly one key, got either zero or multiple\n" ++ json.pretty + | _ => panic! "unpackJsonSum: expected an object or a string\n" ++ json.pretty + +end DiffTest diff --git a/cedar-lean/DiffTestStandAlone/Main.lean b/cedar-lean/DiffTestStandAlone/Main.lean index 0708c43b8..eff4a6454 100644 --- a/cedar-lean/DiffTestStandAlone/Main.lean +++ b/cedar-lean/DiffTestStandAlone/Main.lean @@ -47,10 +47,13 @@ def main (args : List String) : IO Unit := let filename := args.head! let req ← readFile filename let json := Lean.Json.parse req - let request := jsonToRequest json - let entities := jsonToEntities json - let policies := jsonToPolicies json - let response := isAuthorized request entities policies - let json := Lean.toJson response - IO.println (toString json) + match json with + | .error e => panic! s!"isAuthorizedDRT: failed to parse input: {e}" + | .ok json => + let request := jsonToRequest (getJsonField json "request") + let entities := jsonToEntities (getJsonField json "entities") + let policies := jsonToPolicies (getJsonField json "policies") + let response := isAuthorized request entities policies + let json := Lean.toJson response + IO.println (toString json) | _ => IO.println s!"Incorrect number of arguments" From e959dd23bd1a05373f84bfab45e6822c4bdabb6c Mon Sep 17 00:00:00 2001 From: Kesha Hietala Date: Fri, 17 Nov 2023 20:33:53 +0000 Subject: [PATCH 24/57] edits --- cedar-drt/Makefile | 17 +++----- cedar-drt/src/lean_impl.rs | 58 ++++++++++++++-------------- cedar-drt/tests/integration_tests.rs | 40 +++++++++---------- cedar-lean/DiffTest/Parser.lean | 2 +- 4 files changed, 56 insertions(+), 61 deletions(-) diff --git a/cedar-drt/Makefile b/cedar-drt/Makefile index 1fc7e3b3d..a3928c73b 100644 --- a/cedar-drt/Makefile +++ b/cedar-drt/Makefile @@ -1,20 +1,13 @@ .PHONY: all run test all: - cd ../cedar-lean && lake build Cedar DiffTest Std:static - LEAN_LIB_DIR=`lean --print-libdir` \ - cargo build; + cd ../cedar-lean && lake build DiffTest:static Std:static Aesop:static ProofWidgets:static Qq:static Mathlib:static Cedar:static LEAN_LIB_DIR=`lean --print-libdir` \ + cargo build cd fuzz && LEAN_LIB_DIR=`lean --print-libdir` cargo build test: all - DYLD_LIBRARY_PATH=`lean --print-libdir` \ - LD_LIBRARY_PATH=`lean --print-libdir` \ - LEAN_LIB_DIR=`lean --print-libdir` \ - cargo test --test integration_tests - -run: all - DYLD_LIBRARY_PATH=`lean --print-libdir` \ - LD_LIBRARY_PATH=`lean --print-libdir` \ + DYLD_LIBRARY_PATH=`lean --print-libdir`:${DYLD_LIBRARY_PATH} \ + LD_LIBRARY_PATH=`lean --print-libdir`:${LD_LIBRARY_PATH} \ LEAN_LIB_DIR=`lean --print-libdir` \ - cargo fuzz run -s none $(target) \ No newline at end of file + cargo test \ No newline at end of file diff --git a/cedar-drt/src/lean_impl.rs b/cedar-drt/src/lean_impl.rs index f2ec5c800..8db584405 100644 --- a/cedar-drt/src/lean_impl.rs +++ b/cedar-drt/src/lean_impl.rs @@ -17,8 +17,11 @@ //! Implementation of the [`CedarTestImplementation`] trait for the Cedar Lean //! implementation. +//NOTE: We use the env var RUST_LEAN_INTERFACE_INIT to save the fact that +//we've already initialized + use core::panic; -use std::{collections::HashSet, ffi::CString}; +use std::{collections::HashSet, env, ffi::CString}; use crate::cedar_test_impl::*; use cedar_policy::frontend::is_authorized::InterfaceResponse; @@ -51,7 +54,7 @@ pub const LEAN_VALIDATION_MSG: &str = "lean_validation (ns) : "; #[link(name = "Cedar", kind = "static")] // #[link(name = "Lean")] -#[link(name = "Std")] +#[link(name = "Std", kind = "static")] #[link(name = "DiffTest", kind = "static")] #[link(name = "leanshared", kind = "dylib")] #[link(name = "Mathlib", kind = "static")] @@ -109,7 +112,6 @@ impl LeanDefinitionalEngine { }) .expect("Failed to serialize request, policies, or entities"); eprintln!("{request}"); - println!("{:?}", request.clone().as_ptr()); let cstring = CString::new(request).expect("CString::new failed"); let s = unsafe { lean_mk_string(cstring.as_ptr() as *const u8) }; return s; @@ -117,27 +119,24 @@ impl LeanDefinitionalEngine { fn deserialize_response(response: *mut lean_object) -> InterfaceResponse { let response_string = lean_obj_to_string(response); - println!("Response string:"); - println!("{response_string:?}"); - // let resp: ResponseDef = - // serde_json::from_str(&response_string).expect("could not convert string to json"); - // let dec: authorizer::Decision = if resp.decision == "allow" { - // authorizer::Decision::Allow - // } else if resp.decision == "deny" { - // authorizer::Decision::Deny - // } else { - // panic!("unknown decision") - // }; - - // let reason = resp - // .policies - // .mk - // .l - // .into_iter() - // .map(|x| cedar_policy::PolicyId::from_str(&x).expect("could not coerce policyId")) - // .collect(); - // InterfaceResponse::new(dec, reason, HashSet::new()) - InterfaceResponse::new(authorizer::Decision::Allow, HashSet::new(), HashSet::new()) + let resp: ResponseDef = + serde_json::from_str(&response_string).expect("could not convert string to json"); + let dec: authorizer::Decision = if resp.decision == "allow" { + authorizer::Decision::Allow + } else if resp.decision == "deny" { + authorizer::Decision::Deny + } else { + panic!("unknown decision") + }; + + let reason = resp + .policies + .mk + .l + .into_iter() + .map(|x| cedar_policy::PolicyId::from_str(&x).expect("could not coerce policyId")) + .collect(); + InterfaceResponse::new(dec, reason, HashSet::new()) } /// Ask the definitional engine whether `isAuthorized` for the given `request`, @@ -148,10 +147,13 @@ impl LeanDefinitionalEngine { policies: &ast::PolicySet, entities: &Entities, ) -> InterfaceResponse { - unsafe { lean_initialize_runtime_module() }; - unsafe { lean_initialize() }; - unsafe { initialize_DiffTest_Main(1, lean_io_mk_world()) }; - unsafe { lean_io_mark_end_initialization() }; + if env::var("RUST_LEAN_INTERFACE_INIT").is_err() { + unsafe { lean_initialize_runtime_module() }; + unsafe { lean_initialize() }; + unsafe { initialize_DiffTest_Main(1, lean_io_mk_world()) }; + unsafe { lean_io_mark_end_initialization() }; + env::set_var("RUST_LEAN_INTERFACE_INIT", "1"); + } let req = Self::serialize_request(request, policies, entities); let response = unsafe { isAuthorizedDRT(req) }; diff --git a/cedar-drt/tests/integration_tests.rs b/cedar-drt/tests/integration_tests.rs index 0161a081d..51f94e4d5 100644 --- a/cedar-drt/tests/integration_tests.rs +++ b/cedar-drt/tests/integration_tests.rs @@ -35,26 +35,26 @@ fn run_integration_tests(custom_impl: &dyn CustomCedarImpl) { // currently runs (last updated 2023-09-25). let test_jsons = vec![ "decimal/1.json", - // "decimal/2.json", - // "example_use_cases_doc/1a.json", - // "example_use_cases_doc/2a.json", - // "example_use_cases_doc/2b.json", - // "example_use_cases_doc/2c.json", - // "example_use_cases_doc/3a.json", - // "example_use_cases_doc/3b.json", - // "example_use_cases_doc/3c.json", - // "example_use_cases_doc/4a.json", - // "example_use_cases_doc/4d.json", - // "example_use_cases_doc/4e.json", - // "example_use_cases_doc/4f.json", - // "example_use_cases_doc/5b.json", - // "ip/1.json", - // "ip/2.json", - // "ip/3.json", - // "multi/1.json", - // "multi/2.json", - // "multi/3.json", - // "multi/4.json", + "decimal/2.json", + "example_use_cases_doc/1a.json", + "example_use_cases_doc/2a.json", + "example_use_cases_doc/2b.json", + "example_use_cases_doc/2c.json", + "example_use_cases_doc/3a.json", + "example_use_cases_doc/3b.json", + "example_use_cases_doc/3c.json", + "example_use_cases_doc/4a.json", + "example_use_cases_doc/4d.json", + "example_use_cases_doc/4e.json", + "example_use_cases_doc/4f.json", + "example_use_cases_doc/5b.json", + "ip/1.json", + "ip/2.json", + "ip/3.json", + "multi/1.json", + "multi/2.json", + "multi/3.json", + "multi/4.json", ] .into_iter() .map(|p| integration_tests_folder.join(p)); diff --git a/cedar-lean/DiffTest/Parser.lean b/cedar-lean/DiffTest/Parser.lean index bdbe4a475..9ceb1ed57 100644 --- a/cedar-lean/DiffTest/Parser.lean +++ b/cedar-lean/DiffTest/Parser.lean @@ -228,7 +228,7 @@ partial def jsonToRequest (json : Lean.Json) : Request := principal := jsonToEuid principal, action := jsonToEuid action, resource := jsonToEuid resource, - context := jsonToContext context, + context := jsonToContext context } def jsonToEntityData (json : Lean.Json) : EntityData := From b4e0a8f17a9032525bc92f4c4c3bddeead95bcd1 Mon Sep 17 00:00:00 2001 From: Andrew Wells Date: Fri, 17 Nov 2023 23:30:32 +0000 Subject: [PATCH 25/57] Dafny and Lean integration tests run --- cedar-drt/Makefile | 4 ++-- cedar-drt/README.md | 16 +++++++++++++++- cedar-drt/set_env_vars.sh | 2 ++ cedar-drt/src/lean_impl.rs | 18 ++++++++---------- cedar-drt/tests/integration_tests.rs | 19 ++++++++++--------- 5 files changed, 37 insertions(+), 22 deletions(-) diff --git a/cedar-drt/Makefile b/cedar-drt/Makefile index a96a17f8c..7a5e91e2f 100644 --- a/cedar-drt/Makefile +++ b/cedar-drt/Makefile @@ -1,7 +1,7 @@ .PHONY: all run test all: - cd ../cedar-lean && lake build Cedar DiffTest Std:static Mathlib:static Qq:static Aesop:static ProofWidgets:static + cd ../cedar-lean && lake build Cedar:static DiffTest:static Std:static Mathlib:static Qq:static Aesop:static ProofWidgets:static LEAN_LIB_DIR=`lean --print-libdir` \ cargo build; LEAN_LIB_DIR=`lean --print-libdir` \ @@ -11,7 +11,7 @@ test: all DYLD_LIBRARY_PATH=`lean --print-libdir`:${DYLD_LIBRARY_PATH} \ LD_LIBRARY_PATH=`lean --print-libdir`:${LD_LIBRARY_PATH} \ LEAN_LIB_DIR=`lean --print-libdir` \ - cargo test --test integration_tests + cargo test run: all DYLD_LIBRARY_PATH=`lean --print-libdir`:${DYLD_LIBRARY_PATH} \ diff --git a/cedar-drt/README.md b/cedar-drt/README.md index adfb1b57c..588696405 100644 --- a/cedar-drt/README.md +++ b/cedar-drt/README.md @@ -26,5 +26,19 @@ The table below lists all available fuzz targets, including which component of t ## Logging -If the fuzz targets are compiled with the `log` features, then they will log their entire corpus to the file pointed at in the `LOGFILE` environment variable. +If the fuzz targets are compiled with the `log` features, then they will log their entire corpus to the file pointed at in the `LOGFILE` environment variable. The sampling rate can be controlled by the `RATE` environment variable, which defaults to 100% if not set. + + +## Linking Issues (Lean) +If you get weird linking issues make sure: +- `LD_PRELOAD` is set to the same lean version mathlib is using +- You built all the lean code with static linking. +- You cargo clean and rebuild (sometimes seemed necessary?) + +If you get SIG intercept issues make sure: +- You initialize Lean before you start the JVM +- You have Lean and the JVM in the same thread + +If you get errors for initializing Lean more than once make sure: +- You only initialize Lean once. \ No newline at end of file diff --git a/cedar-drt/set_env_vars.sh b/cedar-drt/set_env_vars.sh index 0a6f5effb..c44ee1792 100644 --- a/cedar-drt/set_env_vars.sh +++ b/cedar-drt/set_env_vars.sh @@ -26,3 +26,5 @@ unset -f add_lib_to_path if [ -f "$(pwd)/../cedar-dafny-java-wrapper/build/libs/cedar-dafny-java-wrapper.jar" ]; then export CLASSPATH="$(< ../cedar-dafny-java-wrapper/build/runtimeClasspath.txt):$(pwd)/../cedar-dafny-java-wrapper/build/libs/cedar-dafny-java-wrapper.jar" fi + +export CEDAR_INTEGRATION_TESTS_PATH="$(pwd)/../cedar/cedar-integration-tests" \ No newline at end of file diff --git a/cedar-drt/src/lean_impl.rs b/cedar-drt/src/lean_impl.rs index 837d520e6..06d84c29e 100644 --- a/cedar-drt/src/lean_impl.rs +++ b/cedar-drt/src/lean_impl.rs @@ -51,7 +51,6 @@ pub const LEAN_DESERIALIZATION_MSG: &str = "lean_deserialization (ns) : "; pub const LEAN_AUTH_MSG: &str = "lean_auth (ns) : "; pub const LEAN_VALIDATION_MSG: &str = "lean_validation (ns) : "; - #[link(name = "Cedar", kind = "static")] #[link(name = "Std", kind = "static")] #[link(name = "DiffTest", kind = "static")] @@ -96,7 +95,14 @@ fn lean_obj_to_string(o: *mut lean_object) -> String { impl LeanDefinitionalEngine { pub fn new() -> Result { - Ok(Self { initialized: false }) + if env::var("RUST_LEAN_INTERFACE_INIT").is_err() { + unsafe { lean_initialize_runtime_module() }; + unsafe { lean_initialize() }; + unsafe { initialize_DiffTest_Main(1, lean_io_mk_world()) }; + unsafe { lean_io_mark_end_initialization() }; + env::set_var("RUST_LEAN_INTERFACE_INIT", "1"); + } + Ok(Self { initialized: true }) } fn serialize_request( @@ -146,14 +152,6 @@ impl LeanDefinitionalEngine { policies: &ast::PolicySet, entities: &Entities, ) -> InterfaceResponse { - if env::var("RUST_LEAN_INTERFACE_INIT").is_err() { - unsafe { lean_initialize_runtime_module() }; - unsafe { lean_initialize() }; - unsafe { initialize_DiffTest_Main(1, lean_io_mk_world()) }; - unsafe { lean_io_mark_end_initialization() }; - env::set_var("RUST_LEAN_INTERFACE_INIT", "1"); - } - let req = Self::serialize_request(request, policies, entities); let response = unsafe { isAuthorizedDRT(req) }; Self::deserialize_response(response) diff --git a/cedar-drt/tests/integration_tests.rs b/cedar-drt/tests/integration_tests.rs index 1aaca60c9..b8f2d9dc8 100644 --- a/cedar-drt/tests/integration_tests.rs +++ b/cedar-drt/tests/integration_tests.rs @@ -69,14 +69,15 @@ fn run_integration_tests(custom_impl: &dyn CustomCedarImpl) { } #[test] -fn integration_tests_on_java_def_impl() { - let java_def_impl = - JavaDefinitionalEngine::new().expect("failed to create definitional engine"); - run_integration_tests(&java_def_impl) -} +fn integration_tests_on_java_and_lean_def_impl() { + //WARNING: We need to create lean def engine first so the JVM signal handlers are aware of it. + //If this needs to change at some point in the future, you'll need to add libjsig.so to LD_PRELOAD + //WARNING: Different tests run in new threads by default, so don't separate these. + let lean_def_impl = + LeanDefinitionalEngine::new().expect("failed to create Lean definitional engine"); + run_integration_tests(&lean_def_impl); -#[test] -fn integration_tests_on_lean_def_impl() { - let lean_def_impl = LeanDefinitionalEngine::new(); - run_integration_tests(&lean_def_impl) + let java_def_impl = + JavaDefinitionalEngine::new().expect("failed to create Dafny definitional engine"); + run_integration_tests(&java_def_impl); } From 762058034561c77e2c2d6d64e918952867400f60 Mon Sep 17 00:00:00 2001 From: Kesha Hietala Date: Mon, 20 Nov 2023 14:59:45 -0500 Subject: [PATCH 26/57] adding more progress --- cedar | 2 +- cedar-drt/src/definitional_request_types.rs | 8 +- cedar-drt/src/lean_impl.rs | 103 ++++++++--- cedar-lean/Cedar/Data/Map.lean | 8 +- cedar-lean/Cedar/Data/Set.lean | 2 +- cedar-lean/Cedar/Spec/Value.lean | 2 + cedar-lean/Cedar/Thm/Lemmas/Typechecker.lean | 10 +- cedar-lean/Cedar/Thm/Soundness.lean | 2 +- cedar-lean/Cedar/Validation/Types.lean | 35 +++- cedar-lean/Cedar/Validation/Validator.lean | 13 +- cedar-lean/DiffTest/Main.lean | 13 +- cedar-lean/DiffTest/Parser.lean | 172 +++++++++++++++++-- cedar-lean/DiffTest/Util.lean | 6 - cedar-lean/DiffTestStandAlone/Main.lean | 13 +- 14 files changed, 321 insertions(+), 68 deletions(-) diff --git a/cedar b/cedar index 389d488c6..35b7f79fb 160000 --- a/cedar +++ b/cedar @@ -1 +1 @@ -Subproject commit 389d488c612daca726199b3fba864b3ed7364a17 +Subproject commit 35b7f79fb92219dfc68dd24dbc265441102b694a diff --git a/cedar-drt/src/definitional_request_types.rs b/cedar-drt/src/definitional_request_types.rs index 992823101..37d8bab1b 100644 --- a/cedar-drt/src/definitional_request_types.rs +++ b/cedar-drt/src/definitional_request_types.rs @@ -61,10 +61,10 @@ struct DefinitionalEvalResponse { } #[derive(Debug, Serialize)] -struct RequestForDefValidator<'a> { - schema: &'a ValidatorSchema, - policies: &'a ast::PolicySet, - mode: ValidationMode, +pub struct RequestForDefValidator<'a> { + pub schema: &'a ValidatorSchema, + pub policies: &'a ast::PolicySet, + pub mode: ValidationMode, } #[derive(Debug, Deserialize)] diff --git a/cedar-drt/src/lean_impl.rs b/cedar-drt/src/lean_impl.rs index 8db584405..b219711e7 100644 --- a/cedar-drt/src/lean_impl.rs +++ b/cedar-drt/src/lean_impl.rs @@ -45,13 +45,6 @@ use std::str::FromStr; use crate::definitional_request_types::*; -/// Times for JSON (de)serialization, authorization, and validation as reported -/// by the Lean implementation. -pub const LEAN_SERIALIZATION_MSG: &str = "lean_serialization (ns) : "; -pub const LEAN_DESERIALIZATION_MSG: &str = "lean_deserialization (ns) : "; -pub const LEAN_AUTH_MSG: &str = "lean_auth (ns) : "; -pub const LEAN_VALIDATION_MSG: &str = "lean_validation (ns) : "; - #[link(name = "Cedar", kind = "static")] // #[link(name = "Lean")] #[link(name = "Std", kind = "static")] @@ -63,6 +56,7 @@ pub const LEAN_VALIDATION_MSG: &str = "lean_validation (ns) : "; #[link(name = "Aesop", kind = "static")] extern "C" { fn isAuthorizedDRT(req: *mut lean_object) -> *mut lean_object; + fn validateDRT(req: *mut lean_object) -> *mut lean_object; fn initialize_DiffTest_Main(builtin: i8, ob: *mut lean_object) -> *mut lean_object; } @@ -82,6 +76,11 @@ struct ResponseDef { decision: String, } +#[derive(Serialize, Deserialize)] +struct ValResponseDef { + errors: SetDef, +} + #[derive(Debug)] pub enum LeanDefEngineError {} @@ -100,7 +99,17 @@ impl LeanDefinitionalEngine { Ok(Self { initialized: false }) } - fn serialize_request( + fn initialize() { + if env::var("RUST_LEAN_INTERFACE_INIT").is_err() { + unsafe { lean_initialize_runtime_module() }; + unsafe { lean_initialize() }; + unsafe { initialize_DiffTest_Main(1, lean_io_mk_world()) }; + unsafe { lean_io_mark_end_initialization() }; + env::set_var("RUST_LEAN_INTERFACE_INIT", "1"); + } + } + + fn serialize_authorization_request( request: &ast::Request, policies: &ast::PolicySet, entities: &Entities, @@ -111,13 +120,12 @@ impl LeanDefinitionalEngine { entities, }) .expect("Failed to serialize request, policies, or entities"); - eprintln!("{request}"); let cstring = CString::new(request).expect("CString::new failed"); let s = unsafe { lean_mk_string(cstring.as_ptr() as *const u8) }; return s; } - fn deserialize_response(response: *mut lean_object) -> InterfaceResponse { + fn deserialize_authorization_response(response: *mut lean_object) -> InterfaceResponse { let response_string = lean_obj_to_string(response); let resp: ResponseDef = serde_json::from_str(&response_string).expect("could not convert string to json"); @@ -147,17 +155,50 @@ impl LeanDefinitionalEngine { policies: &ast::PolicySet, entities: &Entities, ) -> InterfaceResponse { - if env::var("RUST_LEAN_INTERFACE_INIT").is_err() { - unsafe { lean_initialize_runtime_module() }; - unsafe { lean_initialize() }; - unsafe { initialize_DiffTest_Main(1, lean_io_mk_world()) }; - unsafe { lean_io_mark_end_initialization() }; - env::set_var("RUST_LEAN_INTERFACE_INIT", "1"); + Self::initialize(); + let req = Self::serialize_authorization_request(request, policies, entities); + let response = unsafe { isAuthorizedDRT(req) }; + Self::deserialize_authorization_response(response) + } + + fn serialize_validation_request( + schema: &ValidatorSchema, + policies: &ast::PolicySet, + ) -> *mut lean_object { + let request: String = serde_json::to_string(&RequestForDefValidator { + schema, + policies, + mode: cedar_policy_validator::ValidationMode::default(), // == Strict + }) + .expect("Failed to serialize schema or policies"); + println!("{request}"); + assert!(false); + let cstring = CString::new(request).expect("CString::new failed"); + let s = unsafe { lean_mk_string(cstring.as_ptr() as *const u8) }; + return s; + } + + fn deserialize_validation_response(response: *mut lean_object) -> ValidationInterfaceResponse { + let response_string = lean_obj_to_string(response); + let resp: ValResponseDef = + serde_json::from_str(&response_string).expect("could not convert string to json"); + let errors = resp.errors.mk.l.into_iter().collect(); + ValidationInterfaceResponse { + validation_errors: errors, + parse_errors: Vec::new(), } + } - let req = Self::serialize_request(request, policies, entities); - let response = unsafe { isAuthorizedDRT(req) }; - Self::deserialize_response(response) + /// Use the definitional validator to validate the given `policies` given a `schema` + pub fn validate( + &self, + schema: &ValidatorSchema, + policies: &ast::PolicySet, + ) -> ValidationInterfaceResponse { + Self::initialize(); + let req = Self::serialize_validation_request(schema, policies); + let response = unsafe { validateDRT(req) }; + Self::deserialize_validation_response(response) } } @@ -183,11 +224,12 @@ impl CedarTestImplementation for LeanDefinitionalEngine { fn validate( &self, - _schema: &cedar_policy_validator::ValidatorSchema, - _policies: &ast::PolicySet, + schema: &cedar_policy_validator::ValidatorSchema, + policies: &ast::PolicySet, _mode: ValidationMode, ) -> ValidationInterfaceResponse { - unimplemented!("Unimplemented: validate"); + // Note: only strict mode is supported in Lean + self.validate(schema, policies) } } @@ -204,9 +246,20 @@ impl CustomCedarImpl for LeanDefinitionalEngine { fn validate( &self, - _schema: cedar_policy_validator::ValidatorSchema, - _policies: &ast::PolicySet, + schema: cedar_policy_validator::ValidatorSchema, + policies: &ast::PolicySet, ) -> IntegrationTestValidationResult { - panic!("Unimplemented: validate (test)"); + let result = self.validate(&schema, policies); + assert!( + result.parsing_succeeded(), + "Lean json parsing failed for:\nPolicies:\n{}\nSchema:\n{:?}Errors:\n{:?}", + &policies, + schema, + result.parse_errors + ); + IntegrationTestValidationResult { + validation_passed: result.validation_passed(), + validation_errors_debug: format!("{:?}", result.validation_errors), + } } } diff --git a/cedar-lean/Cedar/Data/Map.lean b/cedar-lean/Cedar/Data/Map.lean index 1fb915cd9..f0107eae9 100644 --- a/cedar-lean/Cedar/Data/Map.lean +++ b/cedar-lean/Cedar/Data/Map.lean @@ -75,6 +75,12 @@ def findOrErr {α β ε} [BEq α] (m : Map α β) (k : α) (err: ε) : Except ε | some v => ok v | _ => error err +/-- Returns the binding for `k` in `m`, or panics if none is found. -/ +def find! {α β} [Repr α] [BEq α] [Inhabited β] (m : Map α β) (k : α) : β := + match m.find? k with + | some v => v + | _ => panic! s!"find!: key {repr k} not found" + /-- Filters `m` using `f`. -/ def filter {α β} (f : α → β → Bool) (m : Map α β) : Map α β := Map.mk (m.kvs.filter (fun ⟨k, v⟩ => f k v)) @@ -111,4 +117,4 @@ theorem in_list_in_map {α : Type u} (k : α) (v : β) (m : Map α β) : end Map -end Cedar.Data \ No newline at end of file +end Cedar.Data diff --git a/cedar-lean/Cedar/Data/Set.lean b/cedar-lean/Cedar/Data/Set.lean index e81e35bce..dfe339569 100644 --- a/cedar-lean/Cedar/Data/Set.lean +++ b/cedar-lean/Cedar/Data/Set.lean @@ -157,4 +157,4 @@ theorem make_eq_if_eqv [LT α] [DecidableLT α] [StrictLT α] (xs ys : List α) end Set -end Cedar.Data \ No newline at end of file +end Cedar.Data diff --git a/cedar-lean/Cedar/Spec/Value.lean b/cedar-lean/Cedar/Spec/Value.lean index a08f4ddfd..a265f49f1 100644 --- a/cedar-lean/Cedar/Spec/Value.lean +++ b/cedar-lean/Cedar/Spec/Value.lean @@ -151,6 +151,8 @@ deriving instance Inhabited for Prim deriving instance BEq for Except +deriving instance Lean.ToJson for Name + mutual def decValue (a b : Value) : Decidable (a = b) := by diff --git a/cedar-lean/Cedar/Thm/Lemmas/Typechecker.lean b/cedar-lean/Cedar/Thm/Lemmas/Typechecker.lean index 09b3bb5c5..dadf965d1 100644 --- a/cedar-lean/Cedar/Thm/Lemmas/Typechecker.lean +++ b/cedar-lean/Cedar/Thm/Lemmas/Typechecker.lean @@ -84,9 +84,9 @@ For every entity in the store, -/ def InstanceOfEntityTypeStore (entities : Entities) (ets: EntityTypeStore) : Prop := ∀ uid data, entities.find? uid = some data → - ∃ attrTys ancestorTys, ets.find? uid.ty = some (attrTys, ancestorTys) ∧ - InstanceOfType data.attrs (.record attrTys) ∧ - ∀ ancestor, ancestor ∈ data.ancestors → ancestor.ty ∈ ancestorTys + ∃ entry, ets.find? uid.ty = some entry ∧ + InstanceOfType data.attrs (.record entry.attrs) ∧ + ∀ ancestor, ancestor ∈ data.ancestors → ancestor.ty ∈ entry.ancestors /-- For every action in the entity store, the action's ancestors are consistent @@ -94,8 +94,8 @@ with the ancestor information in the action store. -/ def InstanceOfActionStore (entities : Entities) (as: ActionStore) : Prop := ∀ uid data, entities.find? uid = some data → as.contains uid → - ∃ ancestors, as.find? uid = some ancestors → - ∀ ancestor, ancestor ∈ data.ancestors → ancestor ∈ ancestors + ∃ entry, as.find? uid = some entry → + ∀ ancestor, ancestor ∈ data.ancestors → ancestor ∈ entry.ancestors def RequestAndEntitiesMatchEnvironment (env : Environment) (request : Request) (entities : Entities) : Prop := InstanceOfRequestType request env.reqty ∧ diff --git a/cedar-lean/Cedar/Thm/Soundness.lean b/cedar-lean/Cedar/Thm/Soundness.lean index f9eb51cd7..0a682edf4 100644 --- a/cedar-lean/Cedar/Thm/Soundness.lean +++ b/cedar-lean/Cedar/Thm/Soundness.lean @@ -89,7 +89,7 @@ def RequestMatchesSchema (schema : Schema) (request : Request) : Prop := def RequestAndEntitiesMatchSchema (schema : Schema) (request : Request) (entities : Entities) : Prop := RequestMatchesSchema schema request ∧ InstanceOfEntityTypeStore entities schema.ets ∧ - InstanceOfActionStore entities (schema.acts.mapOnValues (fun entry => entry.descendants)) + InstanceOfActionStore entities (schema.acts.mapOnValues (fun entry => { ancestors := entry.ancestors })) /-- Top-level soundness theorem: If validation succeeds, then for any request diff --git a/cedar-lean/Cedar/Validation/Types.lean b/cedar-lean/Cedar/Validation/Types.lean index 01e4c98e5..31510a172 100644 --- a/cedar-lean/Cedar/Validation/Types.lean +++ b/cedar-lean/Cedar/Validation/Types.lean @@ -74,22 +74,29 @@ inductive TypeError where | emptySetErr | incompatibleSetTypes (ty : List CedarType) -abbrev EntityTypeStore := Map EntityType (RecordType × (Cedar.Data.Set EntityType)) +structure EntityTypeStoreEntry where + ancestors : Cedar.Data.Set EntityType + attrs : RecordType + +abbrev EntityTypeStore := Map EntityType EntityTypeStoreEntry def EntityTypeStore.contains (ets : EntityTypeStore) (ety : EntityType) : Bool := (ets.find? ety).isSome def EntityTypeStore.attrs? (ets : EntityTypeStore) (ety : EntityType) : Option RecordType := - (ets.find? ety).map Prod.fst + (ets.find? ety).map EntityTypeStoreEntry.attrs def EntityTypeStore.descendentOf (ets : EntityTypeStore) (ety₁ ety₂ : EntityType) : Bool := if ety₁ = ety₂ then true else match ets.find? ety₁ with - | .some (_, ancs) => ancs.contains ety₂ + | .some entry => entry.ancestors.contains ety₂ | .none => false -abbrev ActionStore := Map EntityUID (Cedar.Data.Set EntityUID) +structure ActionStoreEntry where + ancestors : Cedar.Data.Set EntityUID + +abbrev ActionStore := Map EntityUID ActionStoreEntry def ActionStore.contains (as : ActionStore) (uid : EntityUID) : Bool := (as.find? uid).isSome @@ -98,7 +105,7 @@ def ActionStore.descendentOf (as : ActionStore) (uid₁ uid₂ : EntityUID) : B if uid₁ == uid₂ then true else match as.find? uid₁ with - | .some ancs => ancs.contains uid₂ + | .some entry => entry.ancestors.contains uid₂ | .none => false ----- Derivations ----- @@ -180,6 +187,24 @@ instance : DecidableEq CedarType := decCedarType deriving instance DecidableEq for Qualified deriving instance DecidableEq for TypeError +deriving instance Inhabited for Qualified +deriving instance Inhabited for ExtType deriving instance Inhabited for CedarType +/- +Lossy serialization of errors to Json. This serialization provides some extra +information to DRT without having to derive `Lean.ToJson` for `Expr` and `CedarType`. +-/ +def typeErrorToJson : TypeError → Lean.Json + | .lubErr _ _ => "lubErr" + | .unexpectedType _ => "unexpectedType" + | .attrNotFound _ _ => "attrNotFound" + | .unknownEntity _ => "unknownEntity" + | .extensionErr _ => "extensionErr" + | .emptySetErr => "emptySetErr" + | .incompatibleSetTypes _ => "incompatibleSetTypes" + +instance : Lean.ToJson TypeError where + toJson := typeErrorToJson + end Cedar.Validation diff --git a/cedar-lean/Cedar/Validation/Validator.lean b/cedar-lean/Cedar/Validation/Validator.lean index b274b7915..93e5b7aa6 100644 --- a/cedar-lean/Cedar/Validation/Validator.lean +++ b/cedar-lean/Cedar/Validation/Validator.lean @@ -28,7 +28,7 @@ open Cedar.Data structure SchemaActionEntry where appliesToPricipal : Set EntityType appliesToResource : Set EntityType - descendants : Set EntityUID + ancestors : Set EntityUID context : RecordType abbrev SchemaActionStore := Map EntityUID SchemaActionEntry @@ -59,7 +59,7 @@ def Schema.toEnvironments (schema : Schema) : List Environment := schema.acts.toList.foldl (fun acc (action,entry) => entry.toRequestTypes action ++ acc) ∅ requestTypes.map ({ ets := schema.ets, - acts := schema.acts.mapOnValues (fun entry => entry.descendants), + acts := schema.acts.mapOnValues (fun entry => { ancestors := entry.ancestors }), reqty := · }) @@ -94,4 +94,13 @@ def validate (policies : Policies) (schema : Schema) : ValidationResult := let envs := schema.toEnvironments policies.forM (typecheckPolicyWithEnvironments · envs) +----- Derivations ----- + +deriving instance Lean.ToJson for Except +deriving instance Lean.ToJson for ValidationError + +instance : Lean.ToJson Unit where + toJson := λ _ => Lean.Json.null + + end Cedar.Validation diff --git a/cedar-lean/DiffTest/Main.lean b/cedar-lean/DiffTest/Main.lean index 32c1e6f13..52284d767 100644 --- a/cedar-lean/DiffTest/Main.lean +++ b/cedar-lean/DiffTest/Main.lean @@ -17,6 +17,7 @@ import Lean.Data.Json.FromToJson import Cedar.Spec +import Cedar.Validation import DiffTest.Util import DiffTest.Parser @@ -26,7 +27,7 @@ import DiffTest.Parser namespace DiffTest open Cedar.Spec -open Cedar.Data +open Cedar.Validation @[export isAuthorizedDRT] def isAuthorizedDRT (req : String) : String := let json := Lean.Json.parse req @@ -39,4 +40,14 @@ open Cedar.Data let response := isAuthorized request entities policies toString (Lean.toJson response) +@[export validateDRT] def validateDRT (req : String) : String := + let json := Lean.Json.parse req + match json with + | .error e => panic! s!"validateDRT: failed to parse input: {e}" + | .ok json => + let policies := jsonToPolicies (getJsonField json "policies") + let schema := jsonToSchema (getJsonField json "schema") + let response := validate policies schema + toString (Lean.toJson response) + end DiffTest diff --git a/cedar-lean/DiffTest/Parser.lean b/cedar-lean/DiffTest/Parser.lean index 9ceb1ed57..4ac07d7de 100644 --- a/cedar-lean/DiffTest/Parser.lean +++ b/cedar-lean/DiffTest/Parser.lean @@ -20,17 +20,21 @@ import Lean.Data.Json.FromToJson import Lean.Data.AssocList import Lean.Data.RBMap +import Std + import Cedar.Data import Cedar.Spec import Cedar.Spec.Ext +import Cedar.Validation import DiffTest.Util namespace DiffTest -open Cedar.Spec open Cedar.Data +open Cedar.Spec open Cedar.Spec.Ext +open Cedar.Validation def jsonToName (json : Lean.Json) : Name := let id := jsonToString (getJsonField json "id") @@ -42,7 +46,7 @@ def jsonToName (json : Lean.Json) : Name := } def jsonToEntityType (json : Lean.Json) : EntityType := - jsonToName (getJsonField json "Concrete") + jsonToName (getJsonField json "Specified") def jsonToEuid (json : Lean.Json) : EntityUID := let eid := jsonToString (getJsonField json "eid") @@ -215,14 +219,14 @@ def jsonToContext (json : Lean.Json) : Map Attr Value := | _ => panic! "jsonToContext: context must be a record\n" ++ toString (repr value) /- -The "Concrete" in this function refers to "concrete" vs. "unknown" entities. -We only need to support the "Concrete" case here because the Lean does not +The "Known" in this function refers to "known" vs. "unknown" entities. +We only need to support the known case here because the Lean does not support partial evaluation. -/ -partial def jsonToRequest (json : Lean.Json) : Request := - let principal := getJsonField (getJsonField json "principal") "Concrete" - let action := getJsonField (getJsonField json "action") "Concrete" - let resource := getJsonField (getJsonField json "resource") "Concrete" +def jsonToRequest (json : Lean.Json) : Request := + let principal := getJsonField (getJsonField json "principal") "Known" + let action := getJsonField (getJsonField json "action") "Known" + let resource := getJsonField (getJsonField json "resource") "Known" let context := getJsonField json "context" { principal := jsonToEuid principal, @@ -234,8 +238,8 @@ partial def jsonToRequest (json : Lean.Json) : Request := def jsonToEntityData (json : Lean.Json) : EntityData := let ancestorsArr := jsonToArray (getJsonField json "ancestors") let ancestors := Set.mk (List.map jsonToEuid ancestorsArr.toList) - let attrsKvs := jsonObjToKVList (getJsonField json "attrs") - let attrs := Map.mk (List.map (λ (k,v) => (k,jsonToValue v)) attrsKvs) + let attrsKVs := jsonObjToKVList (getJsonField json "attrs") + let attrs := Map.mk (List.map (λ (k,v) => (k,jsonToValue v)) attrsKVs) { ancestors := ancestors, attrs := attrs @@ -301,11 +305,153 @@ def jsonToPolicy (json : Lean.Json) : Policy := } /- -For now, doesn't support policy templates. +For now, `jsonToPolicies` doesn't support policy templates. A static policy is just a policy template with no blanks. -/ def jsonToPolicies (json : Lean.Json) : Policies := - let templates_kvs := jsonObjToKVList (getJsonField json "templates") - List.map (λ (_,v) => jsonToPolicy v) templates_kvs + let templatesKVs := jsonObjToKVList (getJsonField json "templates") + List.map (λ (_,v) => jsonToPolicy v) templatesKVs + +def jsonToPrimType (json : Lean.Json) : CedarType := + let tag := jsonToString json + match tag with + | "Bool" => .bool .anyBool + | "Long" => .int + | "String" => .string + | tag => panic! s!"jsonToPrimType: unknown tag {tag}" + +def jsonToExtType (json : Lean.Json) : ExtType := + let xty := jsonToName json + match xty.id with + | "ipaddr" => .ipAddr + | "decimal" => .decimal + | xty => panic! s!"jsonToExtType: unknown extension type {xty}" + +/- +The Rust data types store _descendant_ information for the entity type store +and action store, but _ancestor_ information for the entity store. The Lean +formalization standardizes on ancestor information. + +The definitions and utility functions below are used to convert the descendant +representation to the ancestor representation. +-/ +def findInMapValues [LT α] [BEq α] [DecidableLT α] (m : Map α (Set α)) (k₁ : α) : Set α := + let setOfSets := List.map (λ (k₂,v) => if v.contains k₁ then Set.singleton k₂ else Set.empty) m.toList + setOfSets.foldl (λ acc v => acc.union v) Set.empty + +def descendantsToAncestors [LT α] [BEq α] [DecidableLT α] (descendants : Map α (Set α)) : Map α (Set α) := + Map.mk (List.map + (λ (k,_) => (k, findInMapValues descendants k)) descendants.toList) + +structure JsonEntityTypeStoreEntry where + descendants : Cedar.Data.Set EntityType + attrs : RecordType + +abbrev JsonEntityTypeStore := Map EntityType JsonEntityTypeStoreEntry + +structure JsonSchemaActionEntry where + appliesToPricipal : Set EntityType + appliesToResource : Set EntityType + descendants : Set EntityUID + context : RecordType + +abbrev JsonSchemaActionStore := Map EntityUID JsonSchemaActionEntry + +def invertJsonEntityTypeStore (ets : JsonEntityTypeStore) : EntityTypeStore := + let ets := ets.toList + let descendantMap := Map.mk (List.map (λ (k,v) => (k,v.descendants)) ets) + let ancestorMap := descendantsToAncestors descendantMap + Map.mk (List.map + (λ (k,v) => (k, + { + ancestors := ancestorMap.find! k, + attrs := v.attrs + })) ets) + +def invertJsonSchemaActionStore (acts : JsonSchemaActionStore) : SchemaActionStore := + let acts := acts.toList + let descendantMap := Map.mk (List.map (λ (k,v) => (k,v.descendants)) acts) + let ancestorMap := descendantsToAncestors descendantMap + Map.mk (List.map + (λ (k,v) => (k, + { + appliesToPricipal := v.appliesToPricipal, + appliesToResource := v.appliesToResource, + ancestors := ancestorMap.find! k, + context := v.context + })) acts) + +mutual + +partial def jsonToQualifiedCedarType (json : Lean.Json) : Qualified CedarType := + let attrType := jsonToCedarType (getJsonField json "attrType") + let isRequired := jsonToBool (getJsonField json "isRequired") + if isRequired + then .required attrType + else .optional attrType + +partial def jsonToRecordType (json : Lean.Json) : RecordType := + let kvs := jsonObjToKVList json + Map.mk (List.map (λ (k,v) => (k,jsonToQualifiedCedarType v)) kvs) + +partial def jsonToEntityOrRecordType (json : Lean.Json) : CedarType := + let (tag,body) := unpackJsonSum json + match tag with + | "Record" => + let attrs := getJsonField (getJsonField body "attrs") "attrs" + .record (jsonToRecordType attrs) + | "Entity" => + let lubArr := jsonToArray (getJsonField body "lub_elements") + let lub := Array.map jsonToName lubArr + if lub.size == 1 + then .entity lub[0]! + else panic! "jsonToEntityOrRecordType: expected lub to have exactly one element" ++ json.pretty + | tag => panic! s!"jsonToEntityOrRecordType: unknown tag {tag}" + +partial def jsonToCedarType (json : Lean.Json) : CedarType := + let (tag, body) := unpackJsonSum json + match tag with + | "Primitive" => jsonToPrimType (getJsonField body "primitiveType") + | "Set" => + let elementType := getJsonField body "elementType" + .set (jsonToCedarType elementType) + | "EntityOrRecord" => jsonToEntityOrRecordType body + | "ExtensionType" => + let name := getJsonField body "name" + .ext (jsonToExtType name) + | tag => panic! s!"jsonToCedarType: unknown tag {tag}" + +partial def jsonToEntityTypeEntry (json : Lean.Json) : JsonEntityTypeStoreEntry := + let descendants := jsonToArray (getJsonField json "descendants") + let attrs := getJsonField (getJsonField json "attributes") "attrs" + { + descendants := Set.mk (List.map jsonToName descendants.toList), + attrs := jsonToRecordType attrs + } + +partial def jsonToSchemaActionEntry (json : Lean.Json) : JsonSchemaActionEntry := + let appliesTo := getJsonField json "appliesTo" + let appliesToPrincipal := jsonToArray (getJsonField appliesTo "principalApplySpec") + let appliesToResource := jsonToArray (getJsonField appliesTo "resourceApplySpec") + let descendants := jsonToArray (getJsonField json "descendants") + let context := getJsonField (getJsonField json "context") "attrs" + { + appliesToPricipal := Set.mk (List.map jsonToEntityType appliesToPrincipal.toList), + appliesToResource := Set.mk (List.map jsonToEntityType appliesToResource.toList), + descendants := Set.mk (List.map jsonToEuid descendants.toList), + context := jsonToRecordType context + } + +partial def jsonToSchema (json : Lean.Json) : Schema := + let entityTypesKVs := jsonArrayToKVList (getJsonField json "entityTypes") + let entityTypes := Map.mk (List.map (λ (k,v) => (jsonToName k,jsonToEntityTypeEntry v)) entityTypesKVs) + let actionsKVs := jsonArrayToKVList (getJsonField json "actionIds") + let actions := Map.mk (List.map (λ (k,v) => (jsonToEuid k,jsonToSchemaActionEntry v)) actionsKVs) + { + ets := invertJsonEntityTypeStore entityTypes, + acts := invertJsonSchemaActionStore actions + } + +end -- end mutual block end DiffTest diff --git a/cedar-lean/DiffTest/Util.lean b/cedar-lean/DiffTest/Util.lean index f3caf4659..712556259 100644 --- a/cedar-lean/DiffTest/Util.lean +++ b/cedar-lean/DiffTest/Util.lean @@ -53,12 +53,6 @@ def jsonArrayToKVList (json : Json) : List (Json × Json) := let arr := jsonToArray json List.map jsonToTuple arr.toList -def arrayToKVPairList (json : Array Lean.Json) : Prod (List Lean.Json) (List Lean.Json) := -List.unzip (List.map (λ x => match x with - | Lean.Json.arr kv => (kv[0]!, kv[1]!) - | _ => panic! "arrayToKVPairList: " ++ x.pretty) json.toList) - - def jsonObjToKVList (json : Json) : List (String × Json) := match json.getObj? with | .ok kvs => kvs.fold (λ acc k v => (k,v) :: acc) [] diff --git a/cedar-lean/DiffTestStandAlone/Main.lean b/cedar-lean/DiffTestStandAlone/Main.lean index eff4a6454..33b5d4dd4 100644 --- a/cedar-lean/DiffTestStandAlone/Main.lean +++ b/cedar-lean/DiffTestStandAlone/Main.lean @@ -17,6 +17,7 @@ import Lean.Data.Json.FromToJson import Cedar.Spec +import Cedar.Validation import DiffTest.Parser @@ -24,6 +25,7 @@ import DiffTest.Parser The input and output are stringified JSON objects. -/ open Cedar.Spec +open Cedar.Validation open Cedar.Data open DiffTest @@ -50,10 +52,15 @@ def main (args : List String) : IO Unit := match json with | .error e => panic! s!"isAuthorizedDRT: failed to parse input: {e}" | .ok json => - let request := jsonToRequest (getJsonField json "request") - let entities := jsonToEntities (getJsonField json "entities") + -- let request := jsonToRequest (getJsonField json "request") + -- let entities := jsonToEntities (getJsonField json "entities") + -- let policies := jsonToPolicies (getJsonField json "policies") + -- let response := isAuthorized request entities policies + -- let json := Lean.toJson response + -- IO.println (toString json) let policies := jsonToPolicies (getJsonField json "policies") - let response := isAuthorized request entities policies + let schema := jsonToSchema (getJsonField json "schema") + let response := validate policies schema let json := Lean.toJson response IO.println (toString json) | _ => IO.println s!"Incorrect number of arguments" From 91eac97aa5413b4d85078fa711f4eef162f49667 Mon Sep 17 00:00:00 2001 From: Kesha Hietala Date: Mon, 20 Nov 2023 23:06:48 +0000 Subject: [PATCH 27/57] examples for testing --- cedar-lean/validation-examples/decimal1.json | 883 +++++++++++++ cedar-lean/validation-examples/decimal2.json | 962 ++++++++++++++ cedar-lean/validation-examples/example1a.json | 802 ++++++++++++ cedar-lean/validation-examples/example2a.json | 802 ++++++++++++ cedar-lean/validation-examples/example2b.json | 802 ++++++++++++ cedar-lean/validation-examples/example2c.json | 822 ++++++++++++ cedar-lean/validation-examples/example3a.json | 790 ++++++++++++ cedar-lean/validation-examples/example3b.json | 822 ++++++++++++ cedar-lean/validation-examples/example3c.json | 792 ++++++++++++ cedar-lean/validation-examples/example4a.json | 919 +++++++++++++ cedar-lean/validation-examples/example4d.json | 860 +++++++++++++ cedar-lean/validation-examples/example4e.json | 861 +++++++++++++ cedar-lean/validation-examples/example4f.json | 915 +++++++++++++ cedar-lean/validation-examples/example5b.json | 1134 +++++++++++++++++ cedar-lean/validation-examples/ip1.json | 841 ++++++++++++ cedar-lean/validation-examples/ip2.json | 891 +++++++++++++ cedar-lean/validation-examples/ip3.json | 846 ++++++++++++ cedar-lean/validation-examples/multi1.json | 876 +++++++++++++ cedar-lean/validation-examples/multi2.json | 853 +++++++++++++ cedar-lean/validation-examples/multi3.json | 990 ++++++++++++++ cedar-lean/validation-examples/multi4.json | 1094 ++++++++++++++++ 21 files changed, 18557 insertions(+) create mode 100644 cedar-lean/validation-examples/decimal1.json create mode 100644 cedar-lean/validation-examples/decimal2.json create mode 100644 cedar-lean/validation-examples/example1a.json create mode 100644 cedar-lean/validation-examples/example2a.json create mode 100644 cedar-lean/validation-examples/example2b.json create mode 100644 cedar-lean/validation-examples/example2c.json create mode 100644 cedar-lean/validation-examples/example3a.json create mode 100644 cedar-lean/validation-examples/example3b.json create mode 100644 cedar-lean/validation-examples/example3c.json create mode 100644 cedar-lean/validation-examples/example4a.json create mode 100644 cedar-lean/validation-examples/example4d.json create mode 100644 cedar-lean/validation-examples/example4e.json create mode 100644 cedar-lean/validation-examples/example4f.json create mode 100644 cedar-lean/validation-examples/example5b.json create mode 100644 cedar-lean/validation-examples/ip1.json create mode 100644 cedar-lean/validation-examples/ip2.json create mode 100644 cedar-lean/validation-examples/ip3.json create mode 100644 cedar-lean/validation-examples/multi1.json create mode 100644 cedar-lean/validation-examples/multi2.json create mode 100644 cedar-lean/validation-examples/multi3.json create mode 100644 cedar-lean/validation-examples/multi4.json diff --git a/cedar-lean/validation-examples/decimal1.json b/cedar-lean/validation-examples/decimal1.json new file mode 100644 index 000000000..607ff0440 --- /dev/null +++ b/cedar-lean/validation-examples/decimal1.json @@ -0,0 +1,883 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": { + "account": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "Account", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": { + "account": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "Account", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": { + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "owner": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [ + { + "id": "Account", + "path": [] + }, + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": { + "owner": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": { + "department": { + "attrType": { + "Primitive": { + "primitiveType": "String" + } + }, + "isRequired": true + }, + "jobLevel": { + "attrType": { + "Primitive": { + "primitiveType": "Long" + } + }, + "isRequired": true + } + } + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "photo": { + "attrType": { + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "filesize_mb": { + "attrType": { + "Primitive": { + "primitiveType": "Long" + } + }, + "isRequired": true + }, + "filetype": { + "attrType": { + "Primitive": { + "primitiveType": "String" + } + }, + "isRequired": true + } + } + }, + "open_attributes": "ClosedAttributes" + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "greaterThan", + "path": [] + }, + "args": [ + { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 102, + "end": 109 + }, + "data": null + }, + "attr": "confidence_score" + } + }, + "source_info": { + "start": 102, + "end": 155 + }, + "data": null + }, + { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "decimal", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "0.75" + } + }, + "source_info": { + "start": 147, + "end": 153 + }, + "data": null + } + ] + } + }, + "source_info": { + "start": 139, + "end": 154 + }, + "data": null + } + ] + } + }, + "source_info": { + "start": 102, + "end": 155 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file diff --git a/cedar-lean/validation-examples/decimal2.json b/cedar-lean/validation-examples/decimal2.json new file mode 100644 index 000000000..628ab2a0c --- /dev/null +++ b/cedar-lean/validation-examples/decimal2.json @@ -0,0 +1,962 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Album", + "path": [] + } + ], + "attributes": { + "attrs": { + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "owner": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": { + "department": { + "attrType": { + "Primitive": { + "primitiveType": "String" + } + }, + "isRequired": true + }, + "jobLevel": { + "attrType": { + "Primitive": { + "primitiveType": "Long" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": { + "account": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "Account", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + }, + { + "id": "Account", + "path": [] + } + ], + "attributes": { + "attrs": { + "owner": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": { + "account": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "Account", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "photo": { + "attrType": { + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "filesize_mb": { + "attrType": { + "Primitive": { + "primitiveType": "Long" + } + }, + "isRequired": true + }, + "filetype": { + "attrType": { + "Primitive": { + "primitiveType": "String" + } + }, + "isRequired": true + } + } + }, + "open_attributes": "ClosedAttributes" + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "And": { + "left": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "greaterThanOrEqual", + "path": [] + }, + "args": [ + { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 104, + "end": 111 + }, + "data": null + }, + "attr": "confidence_score" + } + }, + "source_info": { + "start": 104, + "end": 163 + }, + "data": null + }, + { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "decimal", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "0.4" + } + }, + "source_info": { + "start": 156, + "end": 161 + }, + "data": null + } + ] + } + }, + "source_info": { + "start": 148, + "end": 162 + }, + "data": null + } + ] + } + }, + "source_info": { + "start": 104, + "end": 163 + }, + "data": null + }, + "right": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "lessThanOrEqual", + "path": [] + }, + "args": [ + { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 169, + "end": 176 + }, + "data": null + }, + "attr": "confidence_score" + } + }, + "source_info": { + "start": 169, + "end": 225 + }, + "data": null + }, + { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "decimal", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "0.5" + } + }, + "source_info": { + "start": 218, + "end": 223 + }, + "data": null + } + ] + } + }, + "source_info": { + "start": 210, + "end": 224 + }, + "data": null + } + ] + } + }, + "source_info": { + "start": 169, + "end": 225 + }, + "data": null + } + } + }, + "source_info": { + "start": 104, + "end": 225 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file diff --git a/cedar-lean/validation-examples/example1a.json b/cedar-lean/validation-examples/example1a.json new file mode 100644 index 000000000..490192515 --- /dev/null +++ b/cedar-lean/validation-examples/example1a.json @@ -0,0 +1,802 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Video", + "path": [] + }, + { + "id": "Album", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Video", + "path": [] + }, + { + "name": { + "id": "Video", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Video", + "path": [] + }, + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "Administrator", + "path": [] + } + }, + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Video", + "path": [] + } + }, + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + } + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 56, + "end": 168 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file diff --git a/cedar-lean/validation-examples/example2a.json b/cedar-lean/validation-examples/example2a.json new file mode 100644 index 000000000..4a3344580 --- /dev/null +++ b/cedar-lean/validation-examples/example2a.json @@ -0,0 +1,802 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Album", + "path": [] + }, + { + "id": "Video", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Video", + "path": [] + }, + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Video", + "path": [] + }, + { + "name": { + "id": "Video", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "Administrator", + "path": [] + } + }, + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + }, + { + "Specified": { + "id": "Video", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + } + } + } + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 63, + "end": 187 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file diff --git a/cedar-lean/validation-examples/example2b.json b/cedar-lean/validation-examples/example2b.json new file mode 100644 index 000000000..bc1272881 --- /dev/null +++ b/cedar-lean/validation-examples/example2b.json @@ -0,0 +1,802 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Video", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Album", + "path": [] + }, + { + "id": "Video", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Video", + "path": [] + }, + { + "name": { + "id": "Video", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + }, + { + "Specified": { + "id": "Administrator", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Video", + "path": [] + } + }, + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + } + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 68, + "end": 174 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file diff --git a/cedar-lean/validation-examples/example2c.json b/cedar-lean/validation-examples/example2c.json new file mode 100644 index 000000000..2143a969e --- /dev/null +++ b/cedar-lean/validation-examples/example2c.json @@ -0,0 +1,822 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Video", + "path": [] + }, + { + "id": "Photo", + "path": [] + }, + { + "id": "Album", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Video", + "path": [] + }, + { + "name": { + "id": "Video", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + }, + { + "id": "Video", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + }, + { + "Specified": { + "id": "Administrator", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + }, + { + "Specified": { + "id": "Video", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + } + }, + "action_constraint": { + "In": [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + } + ] + }, + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 89, + "end": 232 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file diff --git a/cedar-lean/validation-examples/example3a.json b/cedar-lean/validation-examples/example3a.json new file mode 100644 index 000000000..347c97905 --- /dev/null +++ b/cedar-lean/validation-examples/example3a.json @@ -0,0 +1,790 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Video", + "path": [] + }, + { + "name": { + "id": "Video", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Video", + "path": [] + }, + { + "id": "Album", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Video", + "path": [] + }, + { + "id": "Album", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + }, + { + "Specified": { + "id": "Administrator", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + }, + { + "Specified": { + "id": "Video", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 63, + "end": 152 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file diff --git a/cedar-lean/validation-examples/example3b.json b/cedar-lean/validation-examples/example3b.json new file mode 100644 index 000000000..0aa07de3f --- /dev/null +++ b/cedar-lean/validation-examples/example3b.json @@ -0,0 +1,822 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Video", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Video", + "path": [] + }, + { + "name": { + "id": "Video", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + }, + { + "id": "Video", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + }, + { + "Specified": { + "id": "Administrator", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + }, + { + "Specified": { + "id": "Video", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + } + }, + "action_constraint": { + "In": [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + ] + }, + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 86, + "end": 231 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file diff --git a/cedar-lean/validation-examples/example3c.json b/cedar-lean/validation-examples/example3c.json new file mode 100644 index 000000000..e2fcdcb94 --- /dev/null +++ b/cedar-lean/validation-examples/example3c.json @@ -0,0 +1,792 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "Video", + "path": [] + }, + { + "name": { + "id": "Video", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Video", + "path": [] + }, + { + "id": "Album", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Album", + "path": [] + }, + { + "id": "Video", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "Administrator", + "path": [] + } + }, + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Video", + "path": [] + } + }, + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + } + }, + "action_constraint": "Any", + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 85, + "end": 173 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file diff --git a/cedar-lean/validation-examples/example4a.json b/cedar-lean/validation-examples/example4a.json new file mode 100644 index 000000000..5e8686723 --- /dev/null +++ b/cedar-lean/validation-examples/example4a.json @@ -0,0 +1,919 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": { + "account": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "Account", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Album", + "path": [] + } + ], + "attributes": { + "attrs": { + "account": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "Account", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": { + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "owner": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": { + "department": { + "attrType": { + "Primitive": { + "primitiveType": "String" + } + }, + "isRequired": true + }, + "jobLevel": { + "attrType": { + "Primitive": { + "primitiveType": "Long" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Album", + "path": [] + }, + { + "id": "Account", + "path": [] + } + ], + "attributes": { + "attrs": { + "owner": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + }, + "isRequired": true + } + } + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "photo": { + "attrType": { + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "filesize_mb": { + "attrType": { + "Primitive": { + "primitiveType": "Long" + } + }, + "isRequired": true + }, + "filetype": { + "attrType": { + "Primitive": { + "primitiveType": "String" + } + }, + "isRequired": true + } + } + }, + "open_attributes": "ClosedAttributes" + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": { + "In": [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + ] + }, + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "device_prototypes" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "And": { + "left": { + "expr_kind": { + "BinaryApp": { + "op": "Eq", + "arg1": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "principal" + }, + "source_info": { + "start": 257, + "end": 266 + }, + "data": null + }, + "attr": "department" + } + }, + "source_info": { + "start": 257, + "end": 277 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "Lit": { + "String": "HardwareEngineering" + } + }, + "source_info": { + "start": 281, + "end": 302 + }, + "data": null + } + } + }, + "source_info": { + "start": 257, + "end": 302 + }, + "data": null + }, + "right": { + "expr_kind": { + "UnaryApp": { + "op": "Not", + "arg": { + "expr_kind": { + "BinaryApp": { + "op": "Less", + "arg1": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "principal" + }, + "source_info": { + "start": 306, + "end": 315 + }, + "data": null + }, + "attr": "jobLevel" + } + }, + "source_info": { + "start": 306, + "end": 324 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "Lit": { + "Long": 5 + } + }, + "source_info": { + "start": 328, + "end": 329 + }, + "data": null + } + } + }, + "source_info": { + "start": 306, + "end": 329 + }, + "data": null + } + } + }, + "source_info": { + "start": 306, + "end": 329 + }, + "data": null + } + } + }, + "source_info": { + "start": 257, + "end": 329 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file diff --git a/cedar-lean/validation-examples/example4d.json b/cedar-lean/validation-examples/example4d.json new file mode 100644 index 000000000..0dfc2670a --- /dev/null +++ b/cedar-lean/validation-examples/example4d.json @@ -0,0 +1,860 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": { + "department": { + "attrType": { + "Primitive": { + "primitiveType": "String" + } + }, + "isRequired": true + }, + "jobLevel": { + "attrType": { + "Primitive": { + "primitiveType": "Long" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Account", + "path": [] + }, + { + "id": "Album", + "path": [] + } + ], + "attributes": { + "attrs": { + "owner": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Album", + "path": [] + } + ], + "attributes": { + "attrs": { + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "owner": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": { + "account": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "Account", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Album", + "path": [] + } + ], + "attributes": { + "attrs": { + "account": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "Account", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "photo": { + "attrType": { + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "filesize_mb": { + "attrType": { + "Primitive": { + "primitiveType": "Long" + } + }, + "isRequired": true + }, + "filetype": { + "attrType": { + "Primitive": { + "primitiveType": "String" + } + }, + "isRequired": true + } + } + }, + "open_attributes": "ClosedAttributes" + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": "Any", + "resource_constraint": { + "constraint": "Any" + }, + "non_head_constraints": { + "expr_kind": { + "And": { + "left": { + "expr_kind": { + "HasAttr": { + "expr": { + "expr_kind": { + "Var": "resource" + }, + "source_info": { + "start": 337, + "end": 345 + }, + "data": null + }, + "attr": "account" + } + }, + "source_info": { + "start": 337, + "end": 357 + }, + "data": null + }, + "right": { + "expr_kind": { + "BinaryApp": { + "op": "Eq", + "arg1": { + "expr_kind": { + "Var": "principal" + }, + "source_info": { + "start": 361, + "end": 370 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "resource" + }, + "source_info": { + "start": 374, + "end": 382 + }, + "data": null + }, + "attr": "account" + } + }, + "source_info": { + "start": 374, + "end": 396 + }, + "data": null + }, + "attr": "owner" + } + }, + "source_info": { + "start": 374, + "end": 396 + }, + "data": null + } + } + }, + "source_info": { + "start": 361, + "end": 396 + }, + "data": null + } + } + }, + "source_info": { + "start": 337, + "end": 396 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file diff --git a/cedar-lean/validation-examples/example4e.json b/cedar-lean/validation-examples/example4e.json new file mode 100644 index 000000000..72d052bdc --- /dev/null +++ b/cedar-lean/validation-examples/example4e.json @@ -0,0 +1,861 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": { + "account": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "Account", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + }, + { + "id": "Account", + "path": [] + } + ], + "attributes": { + "attrs": { + "owner": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": { + "department": { + "attrType": { + "Primitive": { + "primitiveType": "String" + } + }, + "isRequired": true + }, + "jobLevel": { + "attrType": { + "Primitive": { + "primitiveType": "Long" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": { + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "owner": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": { + "account": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "Account", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "photo": { + "attrType": { + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "filesize_mb": { + "attrType": { + "Primitive": { + "primitiveType": "Long" + } + }, + "isRequired": true + }, + "filetype": { + "attrType": { + "Primitive": { + "primitiveType": "String" + } + }, + "isRequired": true + } + } + }, + "open_attributes": "ClosedAttributes" + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": "Any" + }, + "non_head_constraints": { + "expr_kind": { + "BinaryApp": { + "op": "Eq", + "arg1": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "principal" + }, + "source_info": { + "start": 337, + "end": 346 + }, + "data": null + }, + "attr": "department" + } + }, + "source_info": { + "start": 337, + "end": 357 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "resource" + }, + "source_info": { + "start": 361, + "end": 369 + }, + "data": null + }, + "attr": "account" + } + }, + "source_info": { + "start": 361, + "end": 394 + }, + "data": null + }, + "attr": "owner" + } + }, + "source_info": { + "start": 361, + "end": 394 + }, + "data": null + }, + "attr": "department" + } + }, + "source_info": { + "start": 361, + "end": 394 + }, + "data": null + } + } + }, + "source_info": { + "start": 337, + "end": 394 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file diff --git a/cedar-lean/validation-examples/example4f.json b/cedar-lean/validation-examples/example4f.json new file mode 100644 index 000000000..e4bf679c6 --- /dev/null +++ b/cedar-lean/validation-examples/example4f.json @@ -0,0 +1,915 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [ + { + "id": "Account", + "path": [] + }, + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": { + "owner": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": { + "account": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "Account", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Album", + "path": [] + } + ], + "attributes": { + "attrs": { + "account": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "Account", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": { + "department": { + "attrType": { + "Primitive": { + "primitiveType": "String" + } + }, + "isRequired": true + }, + "jobLevel": { + "attrType": { + "Primitive": { + "primitiveType": "Long" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Album", + "path": [] + } + ], + "attributes": { + "attrs": { + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "owner": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "photo": { + "attrType": { + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "filesize_mb": { + "attrType": { + "Primitive": { + "primitiveType": "Long" + } + }, + "isRequired": true + }, + "filetype": { + "attrType": { + "Primitive": { + "primitiveType": "String" + } + }, + "isRequired": true + } + } + }, + "open_attributes": "ClosedAttributes" + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": "Any", + "resource_constraint": { + "constraint": "Any" + }, + "non_head_constraints": { + "expr_kind": { + "Or": { + "left": { + "expr_kind": { + "And": { + "left": { + "expr_kind": { + "HasAttr": { + "expr": { + "expr_kind": { + "Var": "resource" + }, + "source_info": { + "start": 364, + "end": 372 + }, + "data": null + }, + "attr": "account" + } + }, + "source_info": { + "start": 364, + "end": 384 + }, + "data": null + }, + "right": { + "expr_kind": { + "BinaryApp": { + "op": "Eq", + "arg1": { + "expr_kind": { + "Var": "principal" + }, + "source_info": { + "start": 388, + "end": 397 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "resource" + }, + "source_info": { + "start": 401, + "end": 409 + }, + "data": null + }, + "attr": "account" + } + }, + "source_info": { + "start": 401, + "end": 423 + }, + "data": null + }, + "attr": "owner" + } + }, + "source_info": { + "start": 401, + "end": 423 + }, + "data": null + } + } + }, + "source_info": { + "start": 388, + "end": 423 + }, + "data": null + } + } + }, + "source_info": { + "start": 364, + "end": 423 + }, + "data": null + }, + "right": { + "expr_kind": { + "BinaryApp": { + "op": "Contains", + "arg1": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "resource" + }, + "source_info": { + "start": 430, + "end": 438 + }, + "data": null + }, + "attr": "admins" + } + }, + "source_info": { + "start": 430, + "end": 465 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "Var": "principal" + }, + "source_info": { + "start": 455, + "end": 464 + }, + "data": null + } + } + }, + "source_info": { + "start": 430, + "end": 465 + }, + "data": null + } + } + }, + "source_info": { + "start": 363, + "end": 465 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file diff --git a/cedar-lean/validation-examples/example5b.json b/cedar-lean/validation-examples/example5b.json new file mode 100644 index 000000000..6c329a052 --- /dev/null +++ b/cedar-lean/validation-examples/example5b.json @@ -0,0 +1,1134 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Album", + "path": [] + }, + { + "id": "Account", + "path": [] + } + ], + "attributes": { + "attrs": { + "owner": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": { + "department": { + "attrType": { + "Primitive": { + "primitiveType": "String" + } + }, + "isRequired": true + }, + "jobLevel": { + "attrType": { + "Primitive": { + "primitiveType": "Long" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": { + "account": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "Account", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": { + "account": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "Account", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": { + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "owner": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "photo": { + "attrType": { + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "filesize_mb": { + "attrType": { + "Primitive": { + "primitiveType": "Long" + } + }, + "isRequired": true + }, + "filetype": { + "attrType": { + "Primitive": { + "primitiveType": "String" + } + }, + "isRequired": true + } + } + }, + "open_attributes": "ClosedAttributes" + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + } + }, + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Or": { + "left": { + "expr_kind": { + "And": { + "left": { + "expr_kind": { + "BinaryApp": { + "op": "Contains", + "arg1": { + "expr_kind": { + "Set": [ + { + "expr_kind": { + "Lit": { + "String": "JPEG" + } + }, + "source_info": { + "start": 322, + "end": 328 + }, + "data": null + }, + { + "expr_kind": { + "Lit": { + "String": "PNG" + } + }, + "source_info": { + "start": 330, + "end": 335 + }, + "data": null + } + ] + }, + "source_info": { + "start": 321, + "end": 336 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 346, + "end": 353 + }, + "data": null + }, + "attr": "photo" + } + }, + "source_info": { + "start": 346, + "end": 368 + }, + "data": null + }, + "attr": "filetype" + } + }, + "source_info": { + "start": 346, + "end": 368 + }, + "data": null + } + } + }, + "source_info": { + "start": 321, + "end": 369 + }, + "data": null + }, + "right": { + "expr_kind": { + "BinaryApp": { + "op": "LessEq", + "arg1": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 376, + "end": 383 + }, + "data": null + }, + "attr": "photo" + } + }, + "source_info": { + "start": 376, + "end": 401 + }, + "data": null + }, + "attr": "filesize_mb" + } + }, + "source_info": { + "start": 376, + "end": 401 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "Lit": { + "Long": 1 + } + }, + "source_info": { + "start": 405, + "end": 406 + }, + "data": null + } + } + }, + "source_info": { + "start": 376, + "end": 406 + }, + "data": null + } + } + }, + "source_info": { + "start": 321, + "end": 406 + }, + "data": null + }, + "right": { + "expr_kind": { + "And": { + "left": { + "expr_kind": { + "And": { + "left": { + "expr_kind": { + "BinaryApp": { + "op": "Eq", + "arg1": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 414, + "end": 421 + }, + "data": null + }, + "attr": "photo" + } + }, + "source_info": { + "start": 414, + "end": 436 + }, + "data": null + }, + "attr": "filetype" + } + }, + "source_info": { + "start": 414, + "end": 436 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "Lit": { + "String": "RAW" + } + }, + "source_info": { + "start": 440, + "end": 445 + }, + "data": null + } + } + }, + "source_info": { + "start": 414, + "end": 445 + }, + "data": null + }, + "right": { + "expr_kind": { + "BinaryApp": { + "op": "LessEq", + "arg1": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 452, + "end": 459 + }, + "data": null + }, + "attr": "photo" + } + }, + "source_info": { + "start": 452, + "end": 477 + }, + "data": null + }, + "attr": "filesize_mb" + } + }, + "source_info": { + "start": 452, + "end": 477 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "Lit": { + "Long": 100 + } + }, + "source_info": { + "start": 481, + "end": 484 + }, + "data": null + } + } + }, + "source_info": { + "start": 452, + "end": 484 + }, + "data": null + } + } + }, + "source_info": { + "start": 414, + "end": 523 + }, + "data": null + }, + "right": { + "expr_kind": { + "BinaryApp": { + "op": "In", + "arg1": { + "expr_kind": { + "Var": "principal" + }, + "source_info": { + "start": 491, + "end": 500 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + } + } + }, + "source_info": { + "start": 504, + "end": 523 + }, + "data": null + } + } + }, + "source_info": { + "start": 491, + "end": 523 + }, + "data": null + } + } + }, + "source_info": { + "start": 414, + "end": 523 + }, + "data": null + } + } + }, + "source_info": { + "start": 320, + "end": 524 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file diff --git a/cedar-lean/validation-examples/ip1.json b/cedar-lean/validation-examples/ip1.json new file mode 100644 index 000000000..f4f2b06c0 --- /dev/null +++ b/cedar-lean/validation-examples/ip1.json @@ -0,0 +1,841 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Video", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Video", + "path": [] + }, + { + "name": { + "id": "Video", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Album", + "path": [] + }, + { + "id": "Video", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "Administrator", + "path": [] + } + }, + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Video", + "path": [] + } + }, + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "BinaryApp": { + "op": "Eq", + "arg1": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 102, + "end": 109 + }, + "data": null + }, + "attr": "source_ip" + } + }, + "source_info": { + "start": 102, + "end": 119 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "ip", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "222.222.222.222" + } + }, + "source_info": { + "start": 126, + "end": 143 + }, + "data": null + } + ] + } + }, + "source_info": { + "start": 123, + "end": 144 + }, + "data": null + } + } + }, + "source_info": { + "start": 102, + "end": 144 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file diff --git a/cedar-lean/validation-examples/ip2.json b/cedar-lean/validation-examples/ip2.json new file mode 100644 index 000000000..df51e7cd2 --- /dev/null +++ b/cedar-lean/validation-examples/ip2.json @@ -0,0 +1,891 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Video", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Video", + "path": [] + }, + { + "id": "Album", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Video", + "path": [] + }, + { + "name": { + "id": "Video", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + }, + { + "Specified": { + "id": "Administrator", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + }, + { + "Specified": { + "id": "Video", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "And": { + "left": { + "expr_kind": { + "UnaryApp": { + "op": "Not", + "arg": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "isLoopback", + "path": [] + }, + "args": [ + { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 104, + "end": 111 + }, + "data": null + }, + "attr": "source_ip" + } + }, + "source_info": { + "start": 104, + "end": 134 + }, + "data": null + } + ] + } + }, + "source_info": { + "start": 104, + "end": 134 + }, + "data": null + } + } + }, + "source_info": { + "start": 102, + "end": 135 + }, + "data": null + }, + "right": { + "expr_kind": { + "UnaryApp": { + "op": "Not", + "arg": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "isMulticast", + "path": [] + }, + "args": [ + { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 141, + "end": 148 + }, + "data": null + }, + "attr": "source_ip" + } + }, + "source_info": { + "start": 141, + "end": 172 + }, + "data": null + } + ] + } + }, + "source_info": { + "start": 141, + "end": 172 + }, + "data": null + } + } + }, + "source_info": { + "start": 139, + "end": 173 + }, + "data": null + } + } + }, + "source_info": { + "start": 102, + "end": 173 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file diff --git a/cedar-lean/validation-examples/ip3.json b/cedar-lean/validation-examples/ip3.json new file mode 100644 index 000000000..56cbf856a --- /dev/null +++ b/cedar-lean/validation-examples/ip3.json @@ -0,0 +1,846 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "Video", + "path": [] + }, + { + "name": { + "id": "Video", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Video", + "path": [] + }, + { + "id": "Photo", + "path": [] + }, + { + "id": "Album", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Video", + "path": [] + }, + { + "id": "Photo", + "path": [] + }, + { + "id": "Album", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + }, + { + "Specified": { + "id": "Administrator", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Video", + "path": [] + } + }, + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "isInRange", + "path": [] + }, + "args": [ + { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 102, + "end": 109 + }, + "data": null + }, + "attr": "source_ip" + } + }, + "source_info": { + "start": 102, + "end": 153 + }, + "data": null + }, + { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "ip", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "222.222.222.0/24" + } + }, + "source_info": { + "start": 133, + "end": 151 + }, + "data": null + } + ] + } + }, + "source_info": { + "start": 130, + "end": 152 + }, + "data": null + } + ] + } + }, + "source_info": { + "start": 102, + "end": 153 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file diff --git a/cedar-lean/validation-examples/multi1.json b/cedar-lean/validation-examples/multi1.json new file mode 100644 index 000000000..a6323545d --- /dev/null +++ b/cedar-lean/validation-examples/multi1.json @@ -0,0 +1,876 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Video", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Video", + "path": [] + }, + { + "id": "Photo", + "path": [] + }, + { + "id": "Album", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Video", + "path": [] + }, + { + "name": { + "id": "Video", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "Administrator", + "path": [] + } + }, + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + }, + { + "Specified": { + "id": "Video", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy1": { + "id": "policy1", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "bob" + } + } + } + }, + "action_constraint": { + "In": [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + } + ] + }, + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 204, + "end": 318 + }, + "data": null + } + }, + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + } + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 96, + "end": 202 + }, + "data": null + } + } + }, + "links": { + "policy1": { + "template_id": "policy1", + "link_id": null, + "values": {} + }, + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file diff --git a/cedar-lean/validation-examples/multi2.json b/cedar-lean/validation-examples/multi2.json new file mode 100644 index 000000000..06b040763 --- /dev/null +++ b/cedar-lean/validation-examples/multi2.json @@ -0,0 +1,853 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "Video", + "path": [] + }, + { + "name": { + "id": "Video", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Video", + "path": [] + }, + { + "id": "Album", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Album", + "path": [] + }, + { + "id": "Video", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "Administrator", + "path": [] + } + }, + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Video", + "path": [] + } + }, + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 121, + "end": 210 + }, + "data": null + } + }, + "policy1": { + "id": "policy1", + "annotations": {}, + "effect": "forbid", + "principal_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "bob" + } + } + } + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 226, + "end": 330 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + }, + "policy1": { + "template_id": "policy1", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file diff --git a/cedar-lean/validation-examples/multi3.json b/cedar-lean/validation-examples/multi3.json new file mode 100644 index 000000000..3d27a3b68 --- /dev/null +++ b/cedar-lean/validation-examples/multi3.json @@ -0,0 +1,990 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": { + "account": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "Account", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": { + "department": { + "attrType": { + "Primitive": { + "primitiveType": "String" + } + }, + "isRequired": true + }, + "jobLevel": { + "attrType": { + "Primitive": { + "primitiveType": "Long" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": { + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "owner": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": { + "account": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "Account", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Account", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": { + "owner": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + }, + "isRequired": true + } + } + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "photo": { + "attrType": { + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "filesize_mb": { + "attrType": { + "Primitive": { + "primitiveType": "Long" + } + }, + "isRequired": true + }, + "filetype": { + "attrType": { + "Primitive": { + "primitiveType": "String" + } + }, + "isRequired": true + } + } + }, + "open_attributes": "ClosedAttributes" + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy1": { + "id": "policy1", + "annotations": {}, + "effect": "forbid", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": "Any", + "resource_constraint": { + "constraint": "Any" + }, + "non_head_constraints": { + "expr_kind": { + "And": { + "left": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "resource" + }, + "source_info": { + "start": 398, + "end": 406 + }, + "data": null + }, + "attr": "private" + } + }, + "source_info": { + "start": 398, + "end": 414 + }, + "data": null + }, + "right": { + "expr_kind": { + "UnaryApp": { + "op": "Not", + "arg": { + "expr_kind": { + "And": { + "left": { + "expr_kind": { + "HasAttr": { + "expr": { + "expr_kind": { + "Var": "resource" + }, + "source_info": { + "start": 426, + "end": 434 + }, + "data": null + }, + "attr": "account" + } + }, + "source_info": { + "start": 426, + "end": 446 + }, + "data": null + }, + "right": { + "expr_kind": { + "BinaryApp": { + "op": "Eq", + "arg1": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "resource" + }, + "source_info": { + "start": 450, + "end": 458 + }, + "data": null + }, + "attr": "account" + } + }, + "source_info": { + "start": 450, + "end": 472 + }, + "data": null + }, + "attr": "owner" + } + }, + "source_info": { + "start": 450, + "end": 472 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "Var": "principal" + }, + "source_info": { + "start": 476, + "end": 485 + }, + "data": null + } + } + }, + "source_info": { + "start": 450, + "end": 485 + }, + "data": null + } + } + }, + "source_info": { + "start": 426, + "end": 485 + }, + "data": null + } + } + }, + "source_info": { + "start": 417, + "end": 487 + }, + "data": null + } + } + }, + "source_info": { + "start": 354, + "end": 488 + }, + "data": null + } + }, + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + } + } + } + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 145, + "end": 258 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + }, + "policy1": { + "template_id": "policy1", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file diff --git a/cedar-lean/validation-examples/multi4.json b/cedar-lean/validation-examples/multi4.json new file mode 100644 index 000000000..62cafffd9 --- /dev/null +++ b/cedar-lean/validation-examples/multi4.json @@ -0,0 +1,1094 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Album", + "path": [] + } + ], + "attributes": { + "attrs": { + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "owner": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Account", + "path": [] + }, + { + "id": "Album", + "path": [] + } + ], + "attributes": { + "attrs": { + "owner": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": { + "account": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "Account", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": { + "department": { + "attrType": { + "Primitive": { + "primitiveType": "String" + } + }, + "isRequired": true + }, + "jobLevel": { + "attrType": { + "Primitive": { + "primitiveType": "Long" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": { + "account": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "Account", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "photo": { + "attrType": { + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "filesize_mb": { + "attrType": { + "Primitive": { + "primitiveType": "Long" + } + }, + "isRequired": true + }, + "filetype": { + "attrType": { + "Primitive": { + "primitiveType": "String" + } + }, + "isRequired": true + } + } + }, + "open_attributes": "ClosedAttributes" + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + } + } + } + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 140, + "end": 253 + }, + "data": null + } + }, + "policy3": { + "id": "policy3", + "annotations": {}, + "effect": "forbid", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": "Any", + "resource_constraint": { + "constraint": "Any" + }, + "non_head_constraints": { + "expr_kind": { + "UnaryApp": { + "op": "Not", + "arg": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 751, + "end": 758 + }, + "data": null + }, + "attr": "authenticated" + } + }, + "source_info": { + "start": 751, + "end": 772 + }, + "data": null + } + } + }, + "source_info": { + "start": 750, + "end": 772 + }, + "data": null + } + }, + "policy2": { + "id": "policy2", + "annotations": {}, + "effect": "forbid", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": "Any", + "resource_constraint": { + "constraint": "Any" + }, + "non_head_constraints": { + "expr_kind": { + "And": { + "left": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "resource" + }, + "source_info": { + "start": 548, + "end": 556 + }, + "data": null + }, + "attr": "private" + } + }, + "source_info": { + "start": 548, + "end": 564 + }, + "data": null + }, + "right": { + "expr_kind": { + "UnaryApp": { + "op": "Not", + "arg": { + "expr_kind": { + "And": { + "left": { + "expr_kind": { + "HasAttr": { + "expr": { + "expr_kind": { + "Var": "resource" + }, + "source_info": { + "start": 576, + "end": 584 + }, + "data": null + }, + "attr": "account" + } + }, + "source_info": { + "start": 576, + "end": 596 + }, + "data": null + }, + "right": { + "expr_kind": { + "BinaryApp": { + "op": "Eq", + "arg1": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "resource" + }, + "source_info": { + "start": 600, + "end": 608 + }, + "data": null + }, + "attr": "account" + } + }, + "source_info": { + "start": 600, + "end": 622 + }, + "data": null + }, + "attr": "owner" + } + }, + "source_info": { + "start": 600, + "end": 622 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "Var": "principal" + }, + "source_info": { + "start": 626, + "end": 635 + }, + "data": null + } + } + }, + "source_info": { + "start": 600, + "end": 635 + }, + "data": null + } + } + }, + "source_info": { + "start": 576, + "end": 635 + }, + "data": null + } + } + }, + "source_info": { + "start": 567, + "end": 637 + }, + "data": null + } + } + }, + "source_info": { + "start": 504, + "end": 638 + }, + "data": null + } + }, + "policy1": { + "id": "policy1", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": "Any", + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "alice_vacation" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "BinaryApp": { + "op": "Eq", + "arg1": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "principal" + }, + "source_info": { + "start": 401, + "end": 410 + }, + "data": null + }, + "attr": "department" + } + }, + "source_info": { + "start": 401, + "end": 421 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "Lit": { + "String": "Sales" + } + }, + "source_info": { + "start": 425, + "end": 432 + }, + "data": null + } + } + }, + "source_info": { + "start": 401, + "end": 432 + }, + "data": null + } + } + }, + "links": { + "policy1": { + "template_id": "policy1", + "link_id": null, + "values": {} + }, + "policy3": { + "template_id": "policy3", + "link_id": null, + "values": {} + }, + "policy2": { + "template_id": "policy2", + "link_id": null, + "values": {} + }, + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file From d05803e7c37b284b8cc60fad0c136e9c4caaf02f Mon Sep 17 00:00:00 2001 From: Kesha Hietala Date: Tue, 21 Nov 2023 08:57:26 -0500 Subject: [PATCH 28/57] fix some bugs in the validator spec --- cedar-lean/Cedar/Validation/Subtyping.lean | 23 ++++---- cedar-lean/Cedar/Validation/Typechecker.lean | 5 ++ cedar-lean/Cedar/Validation/Types.lean | 9 ++++ cedar-lean/Cedar/Validation/Validator.lean | 56 +++++++++++++++++++- 4 files changed, 81 insertions(+), 12 deletions(-) diff --git a/cedar-lean/Cedar/Validation/Subtyping.lean b/cedar-lean/Cedar/Validation/Subtyping.lean index ec1dc8498..8b5ea1090 100644 --- a/cedar-lean/Cedar/Validation/Subtyping.lean +++ b/cedar-lean/Cedar/Validation/Subtyping.lean @@ -46,15 +46,18 @@ mutual def lub? (ty₁ ty₂ : CedarType) : Option CedarType := - match ty₁, ty₂ with - | .bool b₁, .bool b₂ => .some (.bool (lubBool b₁ b₂)) - | .set s₁, .set s₂ => do - let lub ← lub? s₁ s₂ - .some (.set lub) - | .record (.mk r₁), .record (.mk r₂) => do - let lub ← lubRecordType r₁ r₂ - .some (.record (Map.mk lub)) - | _, _ => .none + if ty₁ == ty₂ + then .some ty₁ + else + match ty₁, ty₂ with + | .bool b₁, .bool b₂ => .some (.bool (lubBool b₁ b₂)) + | .set s₁, .set s₂ => do + let lub ← lub? s₁ s₂ + .some (.set lub) + | .record (.mk r₁), .record (.mk r₂) => do + let lub ← lubRecordType r₁ r₂ + .some (.record (Map.mk lub)) + | _, _ => .none end def subty (ty₁ ty₂ : CedarType) : Bool := @@ -65,4 +68,4 @@ def subty (ty₁ ty₂ : CedarType) : Bool := infix:50 " ⊔ " => lub? infix:50 " ⊑ " => subty -end Cedar.Validation \ No newline at end of file +end Cedar.Validation diff --git a/cedar-lean/Cedar/Validation/Typechecker.lean b/cedar-lean/Cedar/Validation/Typechecker.lean index bd7d6784a..b9a7e4c31 100644 --- a/cedar-lean/Cedar/Validation/Typechecker.lean +++ b/cedar-lean/Cedar/Validation/Typechecker.lean @@ -284,4 +284,9 @@ def typeOf (x : Expr) (c : Capabilities) (env : Environment) : ResultType := let tys ← xs.mapM₁ (λ ⟨x₁, _⟩ => justType (typeOf x₁ c env)) typeOfCall xfn tys xs +---- Derivations ----- + +deriving instance Repr for RequestType +deriving instance Repr for Environment + end Cedar.Validation diff --git a/cedar-lean/Cedar/Validation/Types.lean b/cedar-lean/Cedar/Validation/Types.lean index 31510a172..ab542b663 100644 --- a/cedar-lean/Cedar/Validation/Types.lean +++ b/cedar-lean/Cedar/Validation/Types.lean @@ -110,6 +110,15 @@ def ActionStore.descendentOf (as : ActionStore) (uid₁ uid₂ : EntityUID) : B ----- Derivations ----- +deriving instance Repr for BoolType +deriving instance Repr for ExtType +deriving instance Repr for Qualified +deriving instance Repr for CedarType +deriving instance Repr for TypeError + +deriving instance Repr for EntityTypeStoreEntry +deriving instance Repr for ActionStoreEntry + deriving instance DecidableEq for BoolType deriving instance DecidableEq for ExtType diff --git a/cedar-lean/Cedar/Validation/Validator.lean b/cedar-lean/Cedar/Validation/Validator.lean index 93e5b7aa6..2fba0f778 100644 --- a/cedar-lean/Cedar/Validation/Validator.lean +++ b/cedar-lean/Cedar/Validation/Validator.lean @@ -69,9 +69,58 @@ inductive ValidationError where abbrev ValidationResult := Except ValidationError Unit +-- TODO: prove termination and get rid of `partial` +partial def mapOnVars (f : Var → Expr) : Expr → Expr + | .lit l => .lit l + | .var var => f var + | .ite x₁ x₂ x₃ => + let x₁ := mapOnVars f x₁ + let x₂ := mapOnVars f x₂ + let x₃ := mapOnVars f x₃ + .ite x₁ x₂ x₃ + | .and x₁ x₂ => + let x₁ := mapOnVars f x₁ + let x₂ := mapOnVars f x₂ + .and x₁ x₂ + | .or x₁ x₂ => + let x₁ := mapOnVars f x₁ + let x₂ := mapOnVars f x₂ + .or x₁ x₂ + | .unaryApp op₁ x₁ => + let x₁ := mapOnVars f x₁ + .unaryApp op₁ x₁ + | .binaryApp op₂ x₁ x₂ => + let x₁ := mapOnVars f x₁ + let x₂ := mapOnVars f x₂ + .binaryApp op₂ x₁ x₂ + | .hasAttr x₁ a => + let x₁ := mapOnVars f x₁ + .hasAttr x₁ a + | .getAttr x₁ a => + let x₁ := mapOnVars f x₁ + .getAttr x₁ a + | .set xs => + let xs := xs.map (mapOnVars f) + .set xs + | .record axs => + let axs := axs.map (λ (k,v) => (k, mapOnVars f v)) + .record axs + | .call xfn xs => + let xs := xs.map (mapOnVars f) + .call xfn xs + +/- Substitute `action` variable for a literal EUID to improve typechecking precision. -/ +def substituteAction (uid : EntityUID) (expr : Expr) : Expr := + let f (var : Var) : Expr := + match var with + | .action => .lit (.entityUID uid) + | _ => .var var + mapOnVars f expr + /-- Check that a policy is Boolean-typed. -/ def typecheckPolicy (policy : Policy) (env : Environment) : Except ValidationError CedarType := - match typeOf policy.toExpr ∅ env with + let expr := substituteAction env.reqty.action policy.toExpr + match typeOf expr ∅ env with | .ok (ty, _) => if ty ⊑ .bool .anyBool then .ok ty @@ -96,11 +145,14 @@ def validate (policies : Policies) (schema : Schema) : ValidationResult := ----- Derivations ----- +deriving instance Repr for SchemaActionEntry +deriving instance Repr for Schema +deriving instance Repr for ValidationError + deriving instance Lean.ToJson for Except deriving instance Lean.ToJson for ValidationError instance : Lean.ToJson Unit where toJson := λ _ => Lean.Json.null - end Cedar.Validation From cccdacf84cd222f7b4b7f875e989db6450f466d1 Mon Sep 17 00:00:00 2001 From: Kesha Hietala Date: Tue, 21 Nov 2023 10:10:45 -0500 Subject: [PATCH 29/57] rename DiffTestStandAlone -> Cli; add more examples --- .../{DiffTestStandAlone => Cli}/Main.lean | 39 +- cedar-lean/README.md | 5 +- cedar-lean/diff_test_jsons/5b.json | 1585 ----------------- cedar-lean/diff_test_jsons/test.json | 1332 -------------- cedar-lean/diff_test_jsons/test_small.json | 389 ---- cedar-lean/diff_test_jsons/test_smaller.json | 189 -- cedar-lean/lakefile.lean | 4 +- cedar-lean/validation-examples/decimal1.json | 883 --------- cedar-lean/validation-examples/decimal2.json | 962 ---------- cedar-lean/validation-examples/example1a.json | 802 --------- cedar-lean/validation-examples/example2a.json | 802 --------- cedar-lean/validation-examples/example2b.json | 802 --------- cedar-lean/validation-examples/example2c.json | 822 --------- cedar-lean/validation-examples/example3a.json | 790 -------- cedar-lean/validation-examples/example3b.json | 822 --------- cedar-lean/validation-examples/example3c.json | 792 -------- cedar-lean/validation-examples/example4a.json | 919 ---------- cedar-lean/validation-examples/example4d.json | 860 --------- cedar-lean/validation-examples/example4e.json | 861 --------- cedar-lean/validation-examples/example4f.json | 915 ---------- cedar-lean/validation-examples/example5b.json | 1134 ------------ cedar-lean/validation-examples/ip1.json | 841 --------- cedar-lean/validation-examples/ip2.json | 891 --------- cedar-lean/validation-examples/ip3.json | 846 --------- cedar-lean/validation-examples/multi1.json | 876 --------- cedar-lean/validation-examples/multi2.json | 853 --------- cedar-lean/validation-examples/multi3.json | 990 ---------- cedar-lean/validation-examples/multi4.json | 1094 ------------ 28 files changed, 28 insertions(+), 22072 deletions(-) rename cedar-lean/{DiffTestStandAlone => Cli}/Main.lean (57%) delete mode 100644 cedar-lean/diff_test_jsons/5b.json delete mode 100644 cedar-lean/diff_test_jsons/test.json delete mode 100644 cedar-lean/diff_test_jsons/test_small.json delete mode 100644 cedar-lean/diff_test_jsons/test_smaller.json delete mode 100644 cedar-lean/validation-examples/decimal1.json delete mode 100644 cedar-lean/validation-examples/decimal2.json delete mode 100644 cedar-lean/validation-examples/example1a.json delete mode 100644 cedar-lean/validation-examples/example2a.json delete mode 100644 cedar-lean/validation-examples/example2b.json delete mode 100644 cedar-lean/validation-examples/example2c.json delete mode 100644 cedar-lean/validation-examples/example3a.json delete mode 100644 cedar-lean/validation-examples/example3b.json delete mode 100644 cedar-lean/validation-examples/example3c.json delete mode 100644 cedar-lean/validation-examples/example4a.json delete mode 100644 cedar-lean/validation-examples/example4d.json delete mode 100644 cedar-lean/validation-examples/example4e.json delete mode 100644 cedar-lean/validation-examples/example4f.json delete mode 100644 cedar-lean/validation-examples/example5b.json delete mode 100644 cedar-lean/validation-examples/ip1.json delete mode 100644 cedar-lean/validation-examples/ip2.json delete mode 100644 cedar-lean/validation-examples/ip3.json delete mode 100644 cedar-lean/validation-examples/multi1.json delete mode 100644 cedar-lean/validation-examples/multi2.json delete mode 100644 cedar-lean/validation-examples/multi3.json delete mode 100644 cedar-lean/validation-examples/multi4.json diff --git a/cedar-lean/DiffTestStandAlone/Main.lean b/cedar-lean/Cli/Main.lean similarity index 57% rename from cedar-lean/DiffTestStandAlone/Main.lean rename to cedar-lean/Cli/Main.lean index 33b5d4dd4..378e3463e 100644 --- a/cedar-lean/DiffTestStandAlone/Main.lean +++ b/cedar-lean/Cli/Main.lean @@ -29,7 +29,6 @@ open Cedar.Validation open Cedar.Data open DiffTest - def fileStream (filename : System.FilePath) : IO (Option IO.FS.Stream) := do let fileExists ← filename.pathExists if not fileExists then @@ -43,24 +42,32 @@ def fileStream (filename : System.FilePath) : IO (Option IO.FS.Stream) := do def readFile (filename : String) : IO String := IO.FS.readFile filename +def printUsage (err : String) : IO Unit := + IO.println s!"{err}\nUsage: Cli " + def main (args : List String) : IO Unit := match args.length with - | 1 => do - let filename := args.head! + | 2 => do + let command := args.get! 0 + let filename := args.get! 1 let req ← readFile filename let json := Lean.Json.parse req match json with - | .error e => panic! s!"isAuthorizedDRT: failed to parse input: {e}" + | .error e => panic! s!"Failed to parse input: {e}" | .ok json => - -- let request := jsonToRequest (getJsonField json "request") - -- let entities := jsonToEntities (getJsonField json "entities") - -- let policies := jsonToPolicies (getJsonField json "policies") - -- let response := isAuthorized request entities policies - -- let json := Lean.toJson response - -- IO.println (toString json) - let policies := jsonToPolicies (getJsonField json "policies") - let schema := jsonToSchema (getJsonField json "schema") - let response := validate policies schema - let json := Lean.toJson response - IO.println (toString json) - | _ => IO.println s!"Incorrect number of arguments" + match command with + | "authorize" => + let request := jsonToRequest (getJsonField json "request") + let entities := jsonToEntities (getJsonField json "entities") + let policies := jsonToPolicies (getJsonField json "policies") + let response := isAuthorized request entities policies + let json := Lean.toJson response + IO.println (toString json) + | "validate" => + let policies := jsonToPolicies (getJsonField json "policies") + let schema := jsonToSchema (getJsonField json "schema") + let response := validate policies schema + let json := Lean.toJson response + IO.println (toString json) + | _ => printUsage s!"Invalid command `{command}` (expected `authorize` or `validate`)" + | n => printUsage s!"Incorrect number of arguments (expected 2, but got {n})" diff --git a/cedar-lean/README.md b/cedar-lean/README.md index 425da8868..540994f31 100644 --- a/cedar-lean/README.md +++ b/cedar-lean/README.md @@ -24,9 +24,10 @@ To run the unit tests: $ lake exe CedarUnitTests ``` -To run integration test JSON file: +To run on integration test JSON files: ```shell -lake exe DiffTestStandAlone diff_test_jsons/5b.json +lake exe Cli authorize Cli/json-inputs/authorize/example1a.json +lake exe Cli validate Cli/json-inputs/validate/example1a.json ``` ## Updating the Lean toolchain diff --git a/cedar-lean/diff_test_jsons/5b.json b/cedar-lean/diff_test_jsons/5b.json deleted file mode 100644 index 0e88d6ee6..000000000 --- a/cedar-lean/diff_test_jsons/5b.json +++ /dev/null @@ -1,1585 +0,0 @@ -{ - "request": { - "principal": { - "Concrete": { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "ahmad" - } - }, - "action": { - "Concrete": { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - } - }, - "resource": { - "Concrete": { - "ty": { - "Concrete": { - "id": "Album", - "path": [] - } - }, - "eid": "alice_vacation" - } - }, - "context": { - "expr_kind": { - "Record": { - "authenticated": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": null, - "data": null - }, - "photo": { - "expr_kind": { - "Record": { - "filesize_mb": { - "expr_kind": { - "Lit": { - "Long": 1 - } - }, - "source_info": null, - "data": null - }, - "filetype": { - "expr_kind": { - "Lit": { - "String": "PNG" - } - }, - "source_info": null, - "data": null - } - } - }, - "source_info": null, - "data": null - } - } - }, - "source_info": null, - "data": null - } - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": "Any" - }, - "action_constraint": { - "Eq": { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - } - }, - "resource_constraint": { - "constraint": { - "In": { - "EUID": { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "Or": { - "left": { - "expr_kind": { - "And": { - "left": { - "expr_kind": { - "BinaryApp": { - "op": "Contains", - "arg1": { - "expr_kind": { - "Set": [ - { - "expr_kind": { - "Lit": { - "String": "JPEG" - } - }, - "source_info": { - "start": 322, - "end": 328 - }, - "data": null - }, - { - "expr_kind": { - "Lit": { - "String": "PNG" - } - }, - "source_info": { - "start": 330, - "end": 335 - }, - "data": null - } - ] - }, - "source_info": { - "start": 321, - "end": 336 - }, - "data": null - }, - "arg2": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "context" - }, - "source_info": { - "start": 346, - "end": 353 - }, - "data": null - }, - "attr": "photo" - } - }, - "source_info": { - "start": 346, - "end": 368 - }, - "data": null - }, - "attr": "filetype" - } - }, - "source_info": { - "start": 346, - "end": 368 - }, - "data": null - } - } - }, - "source_info": { - "start": 321, - "end": 369 - }, - "data": null - }, - "right": { - "expr_kind": { - "BinaryApp": { - "op": "LessEq", - "arg1": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "context" - }, - "source_info": { - "start": 376, - "end": 383 - }, - "data": null - }, - "attr": "photo" - } - }, - "source_info": { - "start": 376, - "end": 401 - }, - "data": null - }, - "attr": "filesize_mb" - } - }, - "source_info": { - "start": 376, - "end": 401 - }, - "data": null - }, - "arg2": { - "expr_kind": { - "Lit": { - "Long": 1 - } - }, - "source_info": { - "start": 405, - "end": 406 - }, - "data": null - } - } - }, - "source_info": { - "start": 376, - "end": 406 - }, - "data": null - } - } - }, - "source_info": { - "start": 321, - "end": 406 - }, - "data": null - }, - "right": { - "expr_kind": { - "And": { - "left": { - "expr_kind": { - "And": { - "left": { - "expr_kind": { - "BinaryApp": { - "op": "Eq", - "arg1": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "context" - }, - "source_info": { - "start": 414, - "end": 421 - }, - "data": null - }, - "attr": "photo" - } - }, - "source_info": { - "start": 414, - "end": 436 - }, - "data": null - }, - "attr": "filetype" - } - }, - "source_info": { - "start": 414, - "end": 436 - }, - "data": null - }, - "arg2": { - "expr_kind": { - "Lit": { - "String": "RAW" - } - }, - "source_info": { - "start": 440, - "end": 445 - }, - "data": null - } - } - }, - "source_info": { - "start": 414, - "end": 445 - }, - "data": null - }, - "right": { - "expr_kind": { - "BinaryApp": { - "op": "LessEq", - "arg1": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "context" - }, - "source_info": { - "start": 452, - "end": 459 - }, - "data": null - }, - "attr": "photo" - } - }, - "source_info": { - "start": 452, - "end": 477 - }, - "data": null - }, - "attr": "filesize_mb" - } - }, - "source_info": { - "start": 452, - "end": 477 - }, - "data": null - }, - "arg2": { - "expr_kind": { - "Lit": { - "Long": 100 - } - }, - "source_info": { - "start": 481, - "end": 484 - }, - "data": null - } - } - }, - "source_info": { - "start": 452, - "end": 484 - }, - "data": null - } - } - }, - "source_info": { - "start": 414, - "end": 523 - }, - "data": null - }, - "right": { - "expr_kind": { - "BinaryApp": { - "op": "In", - "arg1": { - "expr_kind": { - "Var": "principal" - }, - "source_info": { - "start": 491, - "end": 500 - }, - "data": null - }, - "arg2": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Concrete": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "AVTeam" - } - } - }, - "source_info": { - "start": 504, - "end": 523 - }, - "data": null - } - } - }, - "source_info": { - "start": 491, - "end": 523 - }, - "data": null - } - } - }, - "source_info": { - "start": 414, - "end": 523 - }, - "data": null - } - } - }, - "source_info": { - "start": 320, - "end": 524 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "entities": { - "entities": [ - [ - { - "ty": { - "Concrete": { - "id": "Album", - "path": [] - } - }, - "eid": "device_prototypes" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Album", - "path": [] - } - }, - "eid": "device_prototypes" - }, - "attrs": { - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Photo", - "path": [] - } - }, - "eid": "prototype_v0.jpg" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Photo", - "path": [] - } - }, - "eid": "prototype_v0.jpg" - }, - "attrs": { - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "ahmad" - } - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Concrete": { - "id": "Album", - "path": [] - } - }, - "eid": "device_prototypes" - } - ] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "giuseppe" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "giuseppe" - }, - "attrs": { - "department": { - "expr_kind": { - "Lit": { - "String": "CustomerSupport" - } - }, - "source_info": null, - "data": null - }, - "jobLevel": { - "expr_kind": { - "Lit": { - "Long": 7 - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Concrete": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "AVTeam" - } - ] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "ahmad" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "ahmad" - }, - "attrs": { - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "owner": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "ahmad" - } - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Concrete": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - } - ] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "AVTeam" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "AVTeam" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "ahmad" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "ahmad" - }, - "attrs": { - "jobLevel": { - "expr_kind": { - "Lit": { - "Long": 4 - } - }, - "source_info": null, - "data": null - }, - "department": { - "expr_kind": { - "Lit": { - "String": "HardwareEngineering" - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - }, - "attrs": { - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "owner": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Concrete": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - } - ] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "stacey" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "stacey" - }, - "attrs": { - "jobLevel": { - "expr_kind": { - "Lit": { - "Long": 6 - } - }, - "source_info": null, - "data": null - }, - "department": { - "expr_kind": { - "Lit": { - "String": "Sales" - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Concrete": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "alice_friends" - } - ] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - }, - "attrs": { - "owner": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - }, - "attrs": { - "jobLevel": { - "expr_kind": { - "Lit": { - "Long": 5 - } - }, - "source_info": null, - "data": null - }, - "department": { - "expr_kind": { - "Lit": { - "String": "HardwareEngineering" - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Concrete": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "AVTeam" - }, - { - "ty": { - "Concrete": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "alice_friends" - } - ] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Photo", - "path": [] - } - }, - "eid": "sales_projections.jpg" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Photo", - "path": [] - } - }, - "eid": "sales_projections.jpg" - }, - "attrs": { - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "stacey" - } - } - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [ - { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "giuseppe" - } - } - }, - "source_info": null, - "data": null - } - ] - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "stacey" - } - ] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Photo", - "path": [] - } - }, - "eid": "alice_w2.jpg" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Photo", - "path": [] - } - }, - "eid": "alice_w2.jpg" - }, - "attrs": { - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - }, - { - "ty": { - "Concrete": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - } - ] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Album", - "path": [] - } - }, - "eid": "alice_vacation" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Album", - "path": [] - } - }, - "eid": "alice_vacation" - }, - "attrs": { - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - }, - { - "ty": { - "Concrete": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - } - ] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Photo", - "path": [] - } - }, - "eid": "vacation.jpg" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Photo", - "path": [] - } - }, - "eid": "vacation.jpg" - }, - "attrs": { - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Concrete": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - }, - { - "ty": { - "Concrete": { - "id": "Album", - "path": [] - } - }, - "eid": "alice_vacation" - }, - { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - ] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "alice_friends" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "alice_friends" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "stacey" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "stacey" - }, - "attrs": { - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "owner": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "stacey" - } - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - } - }, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "attrs": {}, - "ancestors": [] - } - ] - ] - } -} \ No newline at end of file diff --git a/cedar-lean/diff_test_jsons/test.json b/cedar-lean/diff_test_jsons/test.json deleted file mode 100644 index bbbba3a8f..000000000 --- a/cedar-lean/diff_test_jsons/test.json +++ /dev/null @@ -1,1332 +0,0 @@ -{ - "request": { - "principal": { - "Concrete": { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - }, - "action": { - "Concrete": { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource": { - "Concrete": { - "ty": { - "Concrete": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - } - }, - "context": { - "expr_kind": { - "Record": { - "authenticated": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "confidence_score": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "decimal", - "path": [] - }, - "args": [ - { - "expr_kind": { - "Lit": { - "String": "0.8" - } - }, - "source_info": null, - "data": null - } - ] - } - }, - "source_info": null, - "data": null - }, - "source_ip": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "ip", - "path": [] - }, - "args": [ - { - "expr_kind": { - "Lit": { - "String": "123.123.123.123" - } - }, - "source_info": null, - "data": null - } - ] - } - }, - "source_info": null, - "data": null - } - } - }, - "source_info": null, - "data": null - } - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": "Any" - }, - "action_constraint": { - "Eq": { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource_constraint": { - "constraint": { - "Eq": { - "EUID": { - "ty": { - "Concrete": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "greaterThan", - "path": [] - }, - "args": [ - { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "context" - }, - "source_info": { - "start": 102, - "end": 109 - }, - "data": null - }, - "attr": "confidence_score" - } - }, - "source_info": { - "start": 102, - "end": 155 - }, - "data": null - }, - { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "decimal", - "path": [] - }, - "args": [ - { - "expr_kind": { - "Lit": { - "String": "0.75" - } - }, - "source_info": { - "start": 147, - "end": 153 - }, - "data": null - } - ] - } - }, - "source_info": { - "start": 139, - "end": 154 - }, - "data": null - } - ] - } - }, - "source_info": { - "start": 102, - "end": 155 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "entities": { - "entities": [ - [ - { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Photo", - "path": [] - } - }, - "eid": "vacation.jpg" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Photo", - "path": [] - } - }, - "eid": "vacation.jpg" - }, - "attrs": { - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Concrete": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - }, - { - "ty": { - "Concrete": { - "id": "Album", - "path": [] - } - }, - "eid": "alice_vacation" - }, - { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - ] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Photo", - "path": [] - } - }, - "eid": "sales_projections.jpg" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Photo", - "path": [] - } - }, - "eid": "sales_projections.jpg" - }, - "attrs": { - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [ - { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "giuseppe" - } - } - }, - "source_info": null, - "data": null - } - ] - }, - "source_info": null, - "data": null - }, - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "stacey" - } - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "stacey" - } - ] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Album", - "path": [] - } - }, - "eid": "device_prototypes" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Album", - "path": [] - } - }, - "eid": "device_prototypes" - }, - "attrs": { - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Photo", - "path": [] - } - }, - "eid": "alice_w2.jpg" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Photo", - "path": [] - } - }, - "eid": "alice_w2.jpg" - }, - "attrs": { - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - }, - { - "ty": { - "Concrete": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - } - ] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "alice_friends" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "alice_friends" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "ahmad" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "ahmad" - }, - "attrs": { - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "owner": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "ahmad" - } - } - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Concrete": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - } - ] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - }, - "attrs": { - "jobLevel": { - "expr_kind": { - "Lit": { - "Long": 5 - } - }, - "source_info": null, - "data": null - }, - "department": { - "expr_kind": { - "Lit": { - "String": "HardwareEngineering" - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Concrete": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "AVTeam" - }, - { - "ty": { - "Concrete": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "alice_friends" - } - ] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "stacey" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "stacey" - }, - "attrs": { - "department": { - "expr_kind": { - "Lit": { - "String": "Sales" - } - }, - "source_info": null, - "data": null - }, - "jobLevel": { - "expr_kind": { - "Lit": { - "Long": 6 - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Concrete": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "alice_friends" - } - ] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "AVTeam" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "AVTeam" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "ahmad" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "ahmad" - }, - "attrs": { - "jobLevel": { - "expr_kind": { - "Lit": { - "Long": 4 - } - }, - "source_info": null, - "data": null - }, - "department": { - "expr_kind": { - "Lit": { - "String": "HardwareEngineering" - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - }, - "attrs": { - "owner": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Photo", - "path": [] - } - }, - "eid": "prototype_v0.jpg" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Photo", - "path": [] - } - }, - "eid": "prototype_v0.jpg" - }, - "attrs": { - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "ahmad" - } - } - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Concrete": { - "id": "Album", - "path": [] - } - }, - "eid": "device_prototypes" - } - ] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "giuseppe" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "giuseppe" - }, - "attrs": { - "department": { - "expr_kind": { - "Lit": { - "String": "CustomerSupport" - } - }, - "source_info": null, - "data": null - }, - "jobLevel": { - "expr_kind": { - "Lit": { - "Long": 7 - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Concrete": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "AVTeam" - } - ] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Album", - "path": [] - } - }, - "eid": "alice_vacation" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Album", - "path": [] - } - }, - "eid": "alice_vacation" - }, - "attrs": { - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Concrete": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - }, - { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - ] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - }, - "attrs": { - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "owner": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Concrete": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - } - ] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "stacey" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "stacey" - }, - "attrs": { - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "owner": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "stacey" - } - } - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [] - } - ] - ] - } -} \ No newline at end of file diff --git a/cedar-lean/diff_test_jsons/test_small.json b/cedar-lean/diff_test_jsons/test_small.json deleted file mode 100644 index 8edc22084..000000000 --- a/cedar-lean/diff_test_jsons/test_small.json +++ /dev/null @@ -1,389 +0,0 @@ -{ - "request": { - "principal": { - "Concrete": { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - }, - "action": { - "Concrete": { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource": { - "Concrete": { - "ty": { - "Concrete": { - "id": "Photo", - "path": [] - } - }, - "eid": "vacation.jpg" - } - }, - "context": { - "expr_kind": { - "Record": { - "authenticated": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": null, - "data": null - }, - "confidence_score": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "decimal", - "path": [] - }, - "args": [ - { - "expr_kind": { - "Lit": { - "String": "0.6" - } - }, - "source_info": null, - "data": null - } - ] - } - }, - "source_info": null, - "data": null - }, - "source_ip": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "ip", - "path": [] - }, - "args": [ - { - "expr_kind": { - "Lit": { - "String": "123.123.123.123" - } - }, - "source_info": null, - "data": null - } - ] - } - }, - "source_info": null, - "data": null - } - } - }, - "source_info": null, - "data": null - } - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": { - "Eq": { - "EUID": { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - } - } - }, - "action_constraint": { - "Eq": { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource_constraint": { - "constraint": { - "Eq": { - "EUID": { - "ty": { - "Concrete": { - "id": "Photo", - "path": [] - } - }, - "eid": "vacation.jpg" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": { - "start": 56, - "end": 161 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "entities": { - "entities": [ - [ - { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Photo", - "path": [] - } - }, - "eid": "vacation.jpg" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Photo", - "path": [] - } - }, - "eid": "vacation.jpg" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "attrs": {}, - "ancestors": [] - } - ] - ] - } -} \ No newline at end of file diff --git a/cedar-lean/diff_test_jsons/test_smaller.json b/cedar-lean/diff_test_jsons/test_smaller.json deleted file mode 100644 index 0d22edc62..000000000 --- a/cedar-lean/diff_test_jsons/test_smaller.json +++ /dev/null @@ -1,189 +0,0 @@ -{ - "request": { - "principal": { - "Concrete": { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - }, - "action": { - "Concrete": { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource": { - "Concrete": { - "ty": { - "Concrete": { - "id": "Photo", - "path": [] - } - }, - "eid": "vacation.jpg" - } - }, - "context": { - "expr_kind": { - "Record": {} - }, - "source_info": null, - "data": null - } - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": { - "Eq": { - "EUID": { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - } - } - }, - "action_constraint": { - "Eq": { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource_constraint": { - "constraint": { - "Eq": { - "EUID": { - "ty": { - "Concrete": { - "id": "Photo", - "path": [] - } - }, - "eid": "vacation.jpg" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": { - "start": 56, - "end": 161 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "entities": { - "entities": [ - [ - { - "ty": { - "Concrete": { - "id": "Photo", - "path": [] - } - }, - "eid": "vacation.jpg" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Photo", - "path": [] - } - }, - "eid": "vacation.jpg" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "attrs": {}, - "ancestors": [] - } - ] - ] - } -} \ No newline at end of file diff --git a/cedar-lean/lakefile.lean b/cedar-lean/lakefile.lean index 85f207acf..dddcb0eaf 100644 --- a/cedar-lean/lakefile.lean +++ b/cedar-lean/lakefile.lean @@ -34,5 +34,5 @@ lean_lib DiffTest where lean_exe CedarUnitTests where root := `UnitTest.Main -lean_exe DiffTestStandAlone where - root := `DiffTestStandAlone.Main +lean_exe Cli where + root := `Cli.Main diff --git a/cedar-lean/validation-examples/decimal1.json b/cedar-lean/validation-examples/decimal1.json deleted file mode 100644 index 607ff0440..000000000 --- a/cedar-lean/validation-examples/decimal1.json +++ /dev/null @@ -1,883 +0,0 @@ -{ - "schema": { - "entityTypes": [ - [ - { - "id": "Administrator", - "path": [] - }, - { - "name": { - "id": "Administrator", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Album", - "path": [] - }, - { - "name": { - "id": "Album", - "path": [] - }, - "descendants": [ - { - "id": "Album", - "path": [] - }, - { - "id": "Photo", - "path": [] - } - ], - "attributes": { - "attrs": { - "account": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "Account", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "Photo", - "path": [] - }, - { - "name": { - "id": "Photo", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": { - "account": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "Account", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "Account", - "path": [] - }, - { - "name": { - "id": "Account", - "path": [] - }, - "descendants": [ - { - "id": "Album", - "path": [] - }, - { - "id": "Photo", - "path": [] - } - ], - "attributes": { - "attrs": { - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "owner": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "UserGroup", - "path": [] - }, - { - "name": { - "id": "UserGroup", - "path": [] - }, - "descendants": [ - { - "id": "User", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "AccountGroup", - "path": [] - }, - { - "name": { - "id": "AccountGroup", - "path": [] - }, - "descendants": [ - { - "id": "Account", - "path": [] - }, - { - "id": "Album", - "path": [] - }, - { - "id": "Photo", - "path": [] - } - ], - "attributes": { - "attrs": { - "owner": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "User", - "path": [] - }, - { - "name": { - "id": "User", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": { - "department": { - "attrType": { - "Primitive": { - "primitiveType": "String" - } - }, - "isRequired": true - }, - "jobLevel": { - "attrType": { - "Primitive": { - "primitiveType": "Long" - } - }, - "isRequired": true - } - } - } - } - ] - ], - "actionIds": [ - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Account", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "photo": { - "attrType": { - "EntityOrRecord": { - "Record": { - "attrs": { - "attrs": { - "filesize_mb": { - "attrType": { - "Primitive": { - "primitiveType": "Long" - } - }, - "isRequired": true - }, - "filetype": { - "attrType": { - "Primitive": { - "primitiveType": "String" - } - }, - "isRequired": true - } - } - }, - "open_attributes": "ClosedAttributes" - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ] - ] - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": "Any" - }, - "action_constraint": { - "Eq": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource_constraint": { - "constraint": { - "Eq": { - "EUID": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "greaterThan", - "path": [] - }, - "args": [ - { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "context" - }, - "source_info": { - "start": 102, - "end": 109 - }, - "data": null - }, - "attr": "confidence_score" - } - }, - "source_info": { - "start": 102, - "end": 155 - }, - "data": null - }, - { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "decimal", - "path": [] - }, - "args": [ - { - "expr_kind": { - "Lit": { - "String": "0.75" - } - }, - "source_info": { - "start": 147, - "end": 153 - }, - "data": null - } - ] - } - }, - "source_info": { - "start": 139, - "end": 154 - }, - "data": null - } - ] - } - }, - "source_info": { - "start": 102, - "end": 155 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "mode": "Strict" -} \ No newline at end of file diff --git a/cedar-lean/validation-examples/decimal2.json b/cedar-lean/validation-examples/decimal2.json deleted file mode 100644 index 628ab2a0c..000000000 --- a/cedar-lean/validation-examples/decimal2.json +++ /dev/null @@ -1,962 +0,0 @@ -{ - "schema": { - "entityTypes": [ - [ - { - "id": "Administrator", - "path": [] - }, - { - "name": { - "id": "Administrator", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "UserGroup", - "path": [] - }, - { - "name": { - "id": "UserGroup", - "path": [] - }, - "descendants": [ - { - "id": "User", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Account", - "path": [] - }, - { - "name": { - "id": "Account", - "path": [] - }, - "descendants": [ - { - "id": "Photo", - "path": [] - }, - { - "id": "Album", - "path": [] - } - ], - "attributes": { - "attrs": { - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "owner": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "User", - "path": [] - }, - { - "name": { - "id": "User", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": { - "department": { - "attrType": { - "Primitive": { - "primitiveType": "String" - } - }, - "isRequired": true - }, - "jobLevel": { - "attrType": { - "Primitive": { - "primitiveType": "Long" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "Photo", - "path": [] - }, - { - "name": { - "id": "Photo", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": { - "account": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "Account", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "AccountGroup", - "path": [] - }, - { - "name": { - "id": "AccountGroup", - "path": [] - }, - "descendants": [ - { - "id": "Album", - "path": [] - }, - { - "id": "Photo", - "path": [] - }, - { - "id": "Account", - "path": [] - } - ], - "attributes": { - "attrs": { - "owner": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "Album", - "path": [] - }, - { - "name": { - "id": "Album", - "path": [] - }, - "descendants": [ - { - "id": "Album", - "path": [] - }, - { - "id": "Photo", - "path": [] - } - ], - "attributes": { - "attrs": { - "account": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "Account", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ] - ], - "actionIds": [ - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "photo": { - "attrType": { - "EntityOrRecord": { - "Record": { - "attrs": { - "attrs": { - "filesize_mb": { - "attrType": { - "Primitive": { - "primitiveType": "Long" - } - }, - "isRequired": true - }, - "filetype": { - "attrType": { - "Primitive": { - "primitiveType": "String" - } - }, - "isRequired": true - } - } - }, - "open_attributes": "ClosedAttributes" - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Account", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ] - ] - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": "Any" - }, - "action_constraint": { - "Eq": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource_constraint": { - "constraint": { - "Eq": { - "EUID": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "And": { - "left": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "greaterThanOrEqual", - "path": [] - }, - "args": [ - { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "context" - }, - "source_info": { - "start": 104, - "end": 111 - }, - "data": null - }, - "attr": "confidence_score" - } - }, - "source_info": { - "start": 104, - "end": 163 - }, - "data": null - }, - { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "decimal", - "path": [] - }, - "args": [ - { - "expr_kind": { - "Lit": { - "String": "0.4" - } - }, - "source_info": { - "start": 156, - "end": 161 - }, - "data": null - } - ] - } - }, - "source_info": { - "start": 148, - "end": 162 - }, - "data": null - } - ] - } - }, - "source_info": { - "start": 104, - "end": 163 - }, - "data": null - }, - "right": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "lessThanOrEqual", - "path": [] - }, - "args": [ - { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "context" - }, - "source_info": { - "start": 169, - "end": 176 - }, - "data": null - }, - "attr": "confidence_score" - } - }, - "source_info": { - "start": 169, - "end": 225 - }, - "data": null - }, - { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "decimal", - "path": [] - }, - "args": [ - { - "expr_kind": { - "Lit": { - "String": "0.5" - } - }, - "source_info": { - "start": 218, - "end": 223 - }, - "data": null - } - ] - } - }, - "source_info": { - "start": 210, - "end": 224 - }, - "data": null - } - ] - } - }, - "source_info": { - "start": 169, - "end": 225 - }, - "data": null - } - } - }, - "source_info": { - "start": 104, - "end": 225 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "mode": "Strict" -} \ No newline at end of file diff --git a/cedar-lean/validation-examples/example1a.json b/cedar-lean/validation-examples/example1a.json deleted file mode 100644 index 490192515..000000000 --- a/cedar-lean/validation-examples/example1a.json +++ /dev/null @@ -1,802 +0,0 @@ -{ - "schema": { - "entityTypes": [ - [ - { - "id": "Account", - "path": [] - }, - { - "name": { - "id": "Account", - "path": [] - }, - "descendants": [ - { - "id": "Photo", - "path": [] - }, - { - "id": "Video", - "path": [] - }, - { - "id": "Album", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "AccountGroup", - "path": [] - }, - { - "name": { - "id": "AccountGroup", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Administrator", - "path": [] - }, - { - "name": { - "id": "Administrator", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Video", - "path": [] - }, - { - "name": { - "id": "Video", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Album", - "path": [] - }, - { - "name": { - "id": "Album", - "path": [] - }, - "descendants": [ - { - "id": "Video", - "path": [] - }, - { - "id": "Album", - "path": [] - }, - { - "id": "Photo", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "User", - "path": [] - }, - { - "name": { - "id": "User", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Photo", - "path": [] - }, - { - "name": { - "id": "Photo", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "UserGroup", - "path": [] - }, - { - "name": { - "id": "UserGroup", - "path": [] - }, - "descendants": [ - { - "id": "User", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ] - ], - "actionIds": [ - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Account", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "Administrator", - "path": [] - } - }, - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Video", - "path": [] - } - }, - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ] - ] - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": { - "Eq": { - "EUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - } - } - }, - "action_constraint": { - "Eq": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource_constraint": { - "constraint": { - "Eq": { - "EUID": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": { - "start": 56, - "end": 168 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "mode": "Strict" -} \ No newline at end of file diff --git a/cedar-lean/validation-examples/example2a.json b/cedar-lean/validation-examples/example2a.json deleted file mode 100644 index 4a3344580..000000000 --- a/cedar-lean/validation-examples/example2a.json +++ /dev/null @@ -1,802 +0,0 @@ -{ - "schema": { - "entityTypes": [ - [ - { - "id": "AccountGroup", - "path": [] - }, - { - "name": { - "id": "AccountGroup", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Administrator", - "path": [] - }, - { - "name": { - "id": "Administrator", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Photo", - "path": [] - }, - { - "name": { - "id": "Photo", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Album", - "path": [] - }, - { - "name": { - "id": "Album", - "path": [] - }, - "descendants": [ - { - "id": "Photo", - "path": [] - }, - { - "id": "Album", - "path": [] - }, - { - "id": "Video", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "User", - "path": [] - }, - { - "name": { - "id": "User", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Account", - "path": [] - }, - { - "name": { - "id": "Account", - "path": [] - }, - "descendants": [ - { - "id": "Video", - "path": [] - }, - { - "id": "Album", - "path": [] - }, - { - "id": "Photo", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "UserGroup", - "path": [] - }, - { - "name": { - "id": "UserGroup", - "path": [] - }, - "descendants": [ - { - "id": "User", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Video", - "path": [] - }, - { - "name": { - "id": "Video", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ] - ], - "actionIds": [ - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "Administrator", - "path": [] - } - }, - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - }, - { - "Specified": { - "id": "Video", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Account", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ] - ] - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": { - "In": { - "EUID": { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "jane_friends" - } - } - } - }, - "action_constraint": { - "Eq": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource_constraint": { - "constraint": { - "Eq": { - "EUID": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": { - "start": 63, - "end": 187 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "mode": "Strict" -} \ No newline at end of file diff --git a/cedar-lean/validation-examples/example2b.json b/cedar-lean/validation-examples/example2b.json deleted file mode 100644 index bc1272881..000000000 --- a/cedar-lean/validation-examples/example2b.json +++ /dev/null @@ -1,802 +0,0 @@ -{ - "schema": { - "entityTypes": [ - [ - { - "id": "UserGroup", - "path": [] - }, - { - "name": { - "id": "UserGroup", - "path": [] - }, - "descendants": [ - { - "id": "User", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Album", - "path": [] - }, - { - "name": { - "id": "Album", - "path": [] - }, - "descendants": [ - { - "id": "Album", - "path": [] - }, - { - "id": "Video", - "path": [] - }, - { - "id": "Photo", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Administrator", - "path": [] - }, - { - "name": { - "id": "Administrator", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Photo", - "path": [] - }, - { - "name": { - "id": "Photo", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "User", - "path": [] - }, - { - "name": { - "id": "User", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Account", - "path": [] - }, - { - "name": { - "id": "Account", - "path": [] - }, - "descendants": [ - { - "id": "Photo", - "path": [] - }, - { - "id": "Album", - "path": [] - }, - { - "id": "Video", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "AccountGroup", - "path": [] - }, - { - "name": { - "id": "AccountGroup", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Video", - "path": [] - }, - { - "name": { - "id": "Video", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ] - ], - "actionIds": [ - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Account", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - }, - { - "Specified": { - "id": "Administrator", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Video", - "path": [] - } - }, - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ] - ] - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": { - "Eq": { - "EUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - } - } - }, - "action_constraint": { - "Eq": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource_constraint": { - "constraint": { - "In": { - "EUID": { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": { - "start": 68, - "end": 174 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "mode": "Strict" -} \ No newline at end of file diff --git a/cedar-lean/validation-examples/example2c.json b/cedar-lean/validation-examples/example2c.json deleted file mode 100644 index 2143a969e..000000000 --- a/cedar-lean/validation-examples/example2c.json +++ /dev/null @@ -1,822 +0,0 @@ -{ - "schema": { - "entityTypes": [ - [ - { - "id": "AccountGroup", - "path": [] - }, - { - "name": { - "id": "AccountGroup", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Account", - "path": [] - }, - { - "name": { - "id": "Account", - "path": [] - }, - "descendants": [ - { - "id": "Video", - "path": [] - }, - { - "id": "Photo", - "path": [] - }, - { - "id": "Album", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Video", - "path": [] - }, - { - "name": { - "id": "Video", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "UserGroup", - "path": [] - }, - { - "name": { - "id": "UserGroup", - "path": [] - }, - "descendants": [ - { - "id": "User", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "User", - "path": [] - }, - { - "name": { - "id": "User", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Album", - "path": [] - }, - { - "name": { - "id": "Album", - "path": [] - }, - "descendants": [ - { - "id": "Album", - "path": [] - }, - { - "id": "Photo", - "path": [] - }, - { - "id": "Video", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Administrator", - "path": [] - }, - { - "name": { - "id": "Administrator", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Photo", - "path": [] - }, - { - "name": { - "id": "Photo", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ] - ], - "actionIds": [ - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Account", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - }, - { - "Specified": { - "id": "Administrator", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - }, - { - "Specified": { - "id": "Video", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ] - ] - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": { - "Eq": { - "EUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - } - } - }, - "action_constraint": { - "In": [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - } - ] - }, - "resource_constraint": { - "constraint": { - "In": { - "EUID": { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": { - "start": 89, - "end": 232 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "mode": "Strict" -} \ No newline at end of file diff --git a/cedar-lean/validation-examples/example3a.json b/cedar-lean/validation-examples/example3a.json deleted file mode 100644 index 347c97905..000000000 --- a/cedar-lean/validation-examples/example3a.json +++ /dev/null @@ -1,790 +0,0 @@ -{ - "schema": { - "entityTypes": [ - [ - { - "id": "AccountGroup", - "path": [] - }, - { - "name": { - "id": "AccountGroup", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Video", - "path": [] - }, - { - "name": { - "id": "Video", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Photo", - "path": [] - }, - { - "name": { - "id": "Photo", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "UserGroup", - "path": [] - }, - { - "name": { - "id": "UserGroup", - "path": [] - }, - "descendants": [ - { - "id": "User", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Account", - "path": [] - }, - { - "name": { - "id": "Account", - "path": [] - }, - "descendants": [ - { - "id": "Photo", - "path": [] - }, - { - "id": "Video", - "path": [] - }, - { - "id": "Album", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Album", - "path": [] - }, - { - "name": { - "id": "Album", - "path": [] - }, - "descendants": [ - { - "id": "Photo", - "path": [] - }, - { - "id": "Video", - "path": [] - }, - { - "id": "Album", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "User", - "path": [] - }, - { - "name": { - "id": "User", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Administrator", - "path": [] - }, - { - "name": { - "id": "Administrator", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ] - ], - "actionIds": [ - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - }, - { - "Specified": { - "id": "Administrator", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - }, - { - "Specified": { - "id": "Video", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Account", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ] - ] - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": "Any" - }, - "action_constraint": { - "Eq": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource_constraint": { - "constraint": { - "In": { - "EUID": { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": { - "start": 63, - "end": 152 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "mode": "Strict" -} \ No newline at end of file diff --git a/cedar-lean/validation-examples/example3b.json b/cedar-lean/validation-examples/example3b.json deleted file mode 100644 index 0aa07de3f..000000000 --- a/cedar-lean/validation-examples/example3b.json +++ /dev/null @@ -1,822 +0,0 @@ -{ - "schema": { - "entityTypes": [ - [ - { - "id": "Album", - "path": [] - }, - { - "name": { - "id": "Album", - "path": [] - }, - "descendants": [ - { - "id": "Album", - "path": [] - }, - { - "id": "Video", - "path": [] - }, - { - "id": "Photo", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Video", - "path": [] - }, - { - "name": { - "id": "Video", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Administrator", - "path": [] - }, - { - "name": { - "id": "Administrator", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Photo", - "path": [] - }, - { - "name": { - "id": "Photo", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "AccountGroup", - "path": [] - }, - { - "name": { - "id": "AccountGroup", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Account", - "path": [] - }, - { - "name": { - "id": "Account", - "path": [] - }, - "descendants": [ - { - "id": "Album", - "path": [] - }, - { - "id": "Photo", - "path": [] - }, - { - "id": "Video", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "UserGroup", - "path": [] - }, - { - "name": { - "id": "UserGroup", - "path": [] - }, - "descendants": [ - { - "id": "User", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "User", - "path": [] - }, - { - "name": { - "id": "User", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ] - ], - "actionIds": [ - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Account", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - }, - { - "Specified": { - "id": "Administrator", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - }, - { - "Specified": { - "id": "Video", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ] - ] - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": { - "Eq": { - "EUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - } - } - }, - "action_constraint": { - "In": [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - ] - }, - "resource_constraint": { - "constraint": { - "In": { - "EUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": { - "start": 86, - "end": 231 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "mode": "Strict" -} \ No newline at end of file diff --git a/cedar-lean/validation-examples/example3c.json b/cedar-lean/validation-examples/example3c.json deleted file mode 100644 index e2fcdcb94..000000000 --- a/cedar-lean/validation-examples/example3c.json +++ /dev/null @@ -1,792 +0,0 @@ -{ - "schema": { - "entityTypes": [ - [ - { - "id": "Video", - "path": [] - }, - { - "name": { - "id": "Video", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Album", - "path": [] - }, - { - "name": { - "id": "Album", - "path": [] - }, - "descendants": [ - { - "id": "Photo", - "path": [] - }, - { - "id": "Video", - "path": [] - }, - { - "id": "Album", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "User", - "path": [] - }, - { - "name": { - "id": "User", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Photo", - "path": [] - }, - { - "name": { - "id": "Photo", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "AccountGroup", - "path": [] - }, - { - "name": { - "id": "AccountGroup", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "UserGroup", - "path": [] - }, - { - "name": { - "id": "UserGroup", - "path": [] - }, - "descendants": [ - { - "id": "User", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Administrator", - "path": [] - }, - { - "name": { - "id": "Administrator", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Account", - "path": [] - }, - { - "name": { - "id": "Account", - "path": [] - }, - "descendants": [ - { - "id": "Photo", - "path": [] - }, - { - "id": "Album", - "path": [] - }, - { - "id": "Video", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ] - ], - "actionIds": [ - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "Administrator", - "path": [] - } - }, - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Video", - "path": [] - } - }, - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Account", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ] - ] - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": { - "Eq": { - "EUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - } - } - }, - "action_constraint": "Any", - "resource_constraint": { - "constraint": { - "In": { - "EUID": { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": { - "start": 85, - "end": 173 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "mode": "Strict" -} \ No newline at end of file diff --git a/cedar-lean/validation-examples/example4a.json b/cedar-lean/validation-examples/example4a.json deleted file mode 100644 index 5e8686723..000000000 --- a/cedar-lean/validation-examples/example4a.json +++ /dev/null @@ -1,919 +0,0 @@ -{ - "schema": { - "entityTypes": [ - [ - { - "id": "Administrator", - "path": [] - }, - { - "name": { - "id": "Administrator", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "UserGroup", - "path": [] - }, - { - "name": { - "id": "UserGroup", - "path": [] - }, - "descendants": [ - { - "id": "User", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Photo", - "path": [] - }, - { - "name": { - "id": "Photo", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": { - "account": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "Account", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "Album", - "path": [] - }, - { - "name": { - "id": "Album", - "path": [] - }, - "descendants": [ - { - "id": "Photo", - "path": [] - }, - { - "id": "Album", - "path": [] - } - ], - "attributes": { - "attrs": { - "account": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "Account", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "Account", - "path": [] - }, - { - "name": { - "id": "Account", - "path": [] - }, - "descendants": [ - { - "id": "Album", - "path": [] - }, - { - "id": "Photo", - "path": [] - } - ], - "attributes": { - "attrs": { - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "owner": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "User", - "path": [] - }, - { - "name": { - "id": "User", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": { - "department": { - "attrType": { - "Primitive": { - "primitiveType": "String" - } - }, - "isRequired": true - }, - "jobLevel": { - "attrType": { - "Primitive": { - "primitiveType": "Long" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "AccountGroup", - "path": [] - }, - { - "name": { - "id": "AccountGroup", - "path": [] - }, - "descendants": [ - { - "id": "Photo", - "path": [] - }, - { - "id": "Album", - "path": [] - }, - { - "id": "Account", - "path": [] - } - ], - "attributes": { - "attrs": { - "owner": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - }, - "isRequired": true - } - } - } - } - ] - ], - "actionIds": [ - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Account", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "photo": { - "attrType": { - "EntityOrRecord": { - "Record": { - "attrs": { - "attrs": { - "filesize_mb": { - "attrType": { - "Primitive": { - "primitiveType": "Long" - } - }, - "isRequired": true - }, - "filetype": { - "attrType": { - "Primitive": { - "primitiveType": "String" - } - }, - "isRequired": true - } - } - }, - "open_attributes": "ClosedAttributes" - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ] - ] - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": "Any" - }, - "action_constraint": { - "In": [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - ] - }, - "resource_constraint": { - "constraint": { - "In": { - "EUID": { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "device_prototypes" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "And": { - "left": { - "expr_kind": { - "BinaryApp": { - "op": "Eq", - "arg1": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "principal" - }, - "source_info": { - "start": 257, - "end": 266 - }, - "data": null - }, - "attr": "department" - } - }, - "source_info": { - "start": 257, - "end": 277 - }, - "data": null - }, - "arg2": { - "expr_kind": { - "Lit": { - "String": "HardwareEngineering" - } - }, - "source_info": { - "start": 281, - "end": 302 - }, - "data": null - } - } - }, - "source_info": { - "start": 257, - "end": 302 - }, - "data": null - }, - "right": { - "expr_kind": { - "UnaryApp": { - "op": "Not", - "arg": { - "expr_kind": { - "BinaryApp": { - "op": "Less", - "arg1": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "principal" - }, - "source_info": { - "start": 306, - "end": 315 - }, - "data": null - }, - "attr": "jobLevel" - } - }, - "source_info": { - "start": 306, - "end": 324 - }, - "data": null - }, - "arg2": { - "expr_kind": { - "Lit": { - "Long": 5 - } - }, - "source_info": { - "start": 328, - "end": 329 - }, - "data": null - } - } - }, - "source_info": { - "start": 306, - "end": 329 - }, - "data": null - } - } - }, - "source_info": { - "start": 306, - "end": 329 - }, - "data": null - } - } - }, - "source_info": { - "start": 257, - "end": 329 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "mode": "Strict" -} \ No newline at end of file diff --git a/cedar-lean/validation-examples/example4d.json b/cedar-lean/validation-examples/example4d.json deleted file mode 100644 index 0dfc2670a..000000000 --- a/cedar-lean/validation-examples/example4d.json +++ /dev/null @@ -1,860 +0,0 @@ -{ - "schema": { - "entityTypes": [ - [ - { - "id": "User", - "path": [] - }, - { - "name": { - "id": "User", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": { - "department": { - "attrType": { - "Primitive": { - "primitiveType": "String" - } - }, - "isRequired": true - }, - "jobLevel": { - "attrType": { - "Primitive": { - "primitiveType": "Long" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "UserGroup", - "path": [] - }, - { - "name": { - "id": "UserGroup", - "path": [] - }, - "descendants": [ - { - "id": "User", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "AccountGroup", - "path": [] - }, - { - "name": { - "id": "AccountGroup", - "path": [] - }, - "descendants": [ - { - "id": "Photo", - "path": [] - }, - { - "id": "Account", - "path": [] - }, - { - "id": "Album", - "path": [] - } - ], - "attributes": { - "attrs": { - "owner": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "Account", - "path": [] - }, - { - "name": { - "id": "Account", - "path": [] - }, - "descendants": [ - { - "id": "Photo", - "path": [] - }, - { - "id": "Album", - "path": [] - } - ], - "attributes": { - "attrs": { - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "owner": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "Photo", - "path": [] - }, - { - "name": { - "id": "Photo", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": { - "account": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "Account", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "Album", - "path": [] - }, - { - "name": { - "id": "Album", - "path": [] - }, - "descendants": [ - { - "id": "Photo", - "path": [] - }, - { - "id": "Album", - "path": [] - } - ], - "attributes": { - "attrs": { - "account": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "Account", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "Administrator", - "path": [] - }, - { - "name": { - "id": "Administrator", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ] - ], - "actionIds": [ - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Account", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "photo": { - "attrType": { - "EntityOrRecord": { - "Record": { - "attrs": { - "attrs": { - "filesize_mb": { - "attrType": { - "Primitive": { - "primitiveType": "Long" - } - }, - "isRequired": true - }, - "filetype": { - "attrType": { - "Primitive": { - "primitiveType": "String" - } - }, - "isRequired": true - } - } - }, - "open_attributes": "ClosedAttributes" - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ] - ] - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": "Any" - }, - "action_constraint": "Any", - "resource_constraint": { - "constraint": "Any" - }, - "non_head_constraints": { - "expr_kind": { - "And": { - "left": { - "expr_kind": { - "HasAttr": { - "expr": { - "expr_kind": { - "Var": "resource" - }, - "source_info": { - "start": 337, - "end": 345 - }, - "data": null - }, - "attr": "account" - } - }, - "source_info": { - "start": 337, - "end": 357 - }, - "data": null - }, - "right": { - "expr_kind": { - "BinaryApp": { - "op": "Eq", - "arg1": { - "expr_kind": { - "Var": "principal" - }, - "source_info": { - "start": 361, - "end": 370 - }, - "data": null - }, - "arg2": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "resource" - }, - "source_info": { - "start": 374, - "end": 382 - }, - "data": null - }, - "attr": "account" - } - }, - "source_info": { - "start": 374, - "end": 396 - }, - "data": null - }, - "attr": "owner" - } - }, - "source_info": { - "start": 374, - "end": 396 - }, - "data": null - } - } - }, - "source_info": { - "start": 361, - "end": 396 - }, - "data": null - } - } - }, - "source_info": { - "start": 337, - "end": 396 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "mode": "Strict" -} \ No newline at end of file diff --git a/cedar-lean/validation-examples/example4e.json b/cedar-lean/validation-examples/example4e.json deleted file mode 100644 index 72d052bdc..000000000 --- a/cedar-lean/validation-examples/example4e.json +++ /dev/null @@ -1,861 +0,0 @@ -{ - "schema": { - "entityTypes": [ - [ - { - "id": "Administrator", - "path": [] - }, - { - "name": { - "id": "Administrator", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Album", - "path": [] - }, - { - "name": { - "id": "Album", - "path": [] - }, - "descendants": [ - { - "id": "Album", - "path": [] - }, - { - "id": "Photo", - "path": [] - } - ], - "attributes": { - "attrs": { - "account": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "Account", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "AccountGroup", - "path": [] - }, - { - "name": { - "id": "AccountGroup", - "path": [] - }, - "descendants": [ - { - "id": "Album", - "path": [] - }, - { - "id": "Photo", - "path": [] - }, - { - "id": "Account", - "path": [] - } - ], - "attributes": { - "attrs": { - "owner": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "User", - "path": [] - }, - { - "name": { - "id": "User", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": { - "department": { - "attrType": { - "Primitive": { - "primitiveType": "String" - } - }, - "isRequired": true - }, - "jobLevel": { - "attrType": { - "Primitive": { - "primitiveType": "Long" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "UserGroup", - "path": [] - }, - { - "name": { - "id": "UserGroup", - "path": [] - }, - "descendants": [ - { - "id": "User", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Account", - "path": [] - }, - { - "name": { - "id": "Account", - "path": [] - }, - "descendants": [ - { - "id": "Album", - "path": [] - }, - { - "id": "Photo", - "path": [] - } - ], - "attributes": { - "attrs": { - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "owner": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "Photo", - "path": [] - }, - { - "name": { - "id": "Photo", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": { - "account": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "Account", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ] - ], - "actionIds": [ - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Account", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "photo": { - "attrType": { - "EntityOrRecord": { - "Record": { - "attrs": { - "attrs": { - "filesize_mb": { - "attrType": { - "Primitive": { - "primitiveType": "Long" - } - }, - "isRequired": true - }, - "filetype": { - "attrType": { - "Primitive": { - "primitiveType": "String" - } - }, - "isRequired": true - } - } - }, - "open_attributes": "ClosedAttributes" - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ] - ] - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": "Any" - }, - "action_constraint": { - "Eq": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource_constraint": { - "constraint": "Any" - }, - "non_head_constraints": { - "expr_kind": { - "BinaryApp": { - "op": "Eq", - "arg1": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "principal" - }, - "source_info": { - "start": 337, - "end": 346 - }, - "data": null - }, - "attr": "department" - } - }, - "source_info": { - "start": 337, - "end": 357 - }, - "data": null - }, - "arg2": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "resource" - }, - "source_info": { - "start": 361, - "end": 369 - }, - "data": null - }, - "attr": "account" - } - }, - "source_info": { - "start": 361, - "end": 394 - }, - "data": null - }, - "attr": "owner" - } - }, - "source_info": { - "start": 361, - "end": 394 - }, - "data": null - }, - "attr": "department" - } - }, - "source_info": { - "start": 361, - "end": 394 - }, - "data": null - } - } - }, - "source_info": { - "start": 337, - "end": 394 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "mode": "Strict" -} \ No newline at end of file diff --git a/cedar-lean/validation-examples/example4f.json b/cedar-lean/validation-examples/example4f.json deleted file mode 100644 index e4bf679c6..000000000 --- a/cedar-lean/validation-examples/example4f.json +++ /dev/null @@ -1,915 +0,0 @@ -{ - "schema": { - "entityTypes": [ - [ - { - "id": "AccountGroup", - "path": [] - }, - { - "name": { - "id": "AccountGroup", - "path": [] - }, - "descendants": [ - { - "id": "Account", - "path": [] - }, - { - "id": "Album", - "path": [] - }, - { - "id": "Photo", - "path": [] - } - ], - "attributes": { - "attrs": { - "owner": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "Photo", - "path": [] - }, - { - "name": { - "id": "Photo", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": { - "account": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "Account", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "Administrator", - "path": [] - }, - { - "name": { - "id": "Administrator", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "UserGroup", - "path": [] - }, - { - "name": { - "id": "UserGroup", - "path": [] - }, - "descendants": [ - { - "id": "User", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Album", - "path": [] - }, - { - "name": { - "id": "Album", - "path": [] - }, - "descendants": [ - { - "id": "Photo", - "path": [] - }, - { - "id": "Album", - "path": [] - } - ], - "attributes": { - "attrs": { - "account": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "Account", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "User", - "path": [] - }, - { - "name": { - "id": "User", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": { - "department": { - "attrType": { - "Primitive": { - "primitiveType": "String" - } - }, - "isRequired": true - }, - "jobLevel": { - "attrType": { - "Primitive": { - "primitiveType": "Long" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "Account", - "path": [] - }, - { - "name": { - "id": "Account", - "path": [] - }, - "descendants": [ - { - "id": "Photo", - "path": [] - }, - { - "id": "Album", - "path": [] - } - ], - "attributes": { - "attrs": { - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "owner": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ] - ], - "actionIds": [ - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Account", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "photo": { - "attrType": { - "EntityOrRecord": { - "Record": { - "attrs": { - "attrs": { - "filesize_mb": { - "attrType": { - "Primitive": { - "primitiveType": "Long" - } - }, - "isRequired": true - }, - "filetype": { - "attrType": { - "Primitive": { - "primitiveType": "String" - } - }, - "isRequired": true - } - } - }, - "open_attributes": "ClosedAttributes" - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ] - ] - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": "Any" - }, - "action_constraint": "Any", - "resource_constraint": { - "constraint": "Any" - }, - "non_head_constraints": { - "expr_kind": { - "Or": { - "left": { - "expr_kind": { - "And": { - "left": { - "expr_kind": { - "HasAttr": { - "expr": { - "expr_kind": { - "Var": "resource" - }, - "source_info": { - "start": 364, - "end": 372 - }, - "data": null - }, - "attr": "account" - } - }, - "source_info": { - "start": 364, - "end": 384 - }, - "data": null - }, - "right": { - "expr_kind": { - "BinaryApp": { - "op": "Eq", - "arg1": { - "expr_kind": { - "Var": "principal" - }, - "source_info": { - "start": 388, - "end": 397 - }, - "data": null - }, - "arg2": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "resource" - }, - "source_info": { - "start": 401, - "end": 409 - }, - "data": null - }, - "attr": "account" - } - }, - "source_info": { - "start": 401, - "end": 423 - }, - "data": null - }, - "attr": "owner" - } - }, - "source_info": { - "start": 401, - "end": 423 - }, - "data": null - } - } - }, - "source_info": { - "start": 388, - "end": 423 - }, - "data": null - } - } - }, - "source_info": { - "start": 364, - "end": 423 - }, - "data": null - }, - "right": { - "expr_kind": { - "BinaryApp": { - "op": "Contains", - "arg1": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "resource" - }, - "source_info": { - "start": 430, - "end": 438 - }, - "data": null - }, - "attr": "admins" - } - }, - "source_info": { - "start": 430, - "end": 465 - }, - "data": null - }, - "arg2": { - "expr_kind": { - "Var": "principal" - }, - "source_info": { - "start": 455, - "end": 464 - }, - "data": null - } - } - }, - "source_info": { - "start": 430, - "end": 465 - }, - "data": null - } - } - }, - "source_info": { - "start": 363, - "end": 465 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "mode": "Strict" -} \ No newline at end of file diff --git a/cedar-lean/validation-examples/example5b.json b/cedar-lean/validation-examples/example5b.json deleted file mode 100644 index 6c329a052..000000000 --- a/cedar-lean/validation-examples/example5b.json +++ /dev/null @@ -1,1134 +0,0 @@ -{ - "schema": { - "entityTypes": [ - [ - { - "id": "AccountGroup", - "path": [] - }, - { - "name": { - "id": "AccountGroup", - "path": [] - }, - "descendants": [ - { - "id": "Photo", - "path": [] - }, - { - "id": "Album", - "path": [] - }, - { - "id": "Account", - "path": [] - } - ], - "attributes": { - "attrs": { - "owner": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "Administrator", - "path": [] - }, - { - "name": { - "id": "Administrator", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "User", - "path": [] - }, - { - "name": { - "id": "User", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": { - "department": { - "attrType": { - "Primitive": { - "primitiveType": "String" - } - }, - "isRequired": true - }, - "jobLevel": { - "attrType": { - "Primitive": { - "primitiveType": "Long" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "Photo", - "path": [] - }, - { - "name": { - "id": "Photo", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": { - "account": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "Account", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "Album", - "path": [] - }, - { - "name": { - "id": "Album", - "path": [] - }, - "descendants": [ - { - "id": "Album", - "path": [] - }, - { - "id": "Photo", - "path": [] - } - ], - "attributes": { - "attrs": { - "account": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "Account", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "Account", - "path": [] - }, - { - "name": { - "id": "Account", - "path": [] - }, - "descendants": [ - { - "id": "Album", - "path": [] - }, - { - "id": "Photo", - "path": [] - } - ], - "attributes": { - "attrs": { - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "owner": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "UserGroup", - "path": [] - }, - { - "name": { - "id": "UserGroup", - "path": [] - }, - "descendants": [ - { - "id": "User", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ] - ], - "actionIds": [ - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "photo": { - "attrType": { - "EntityOrRecord": { - "Record": { - "attrs": { - "attrs": { - "filesize_mb": { - "attrType": { - "Primitive": { - "primitiveType": "Long" - } - }, - "isRequired": true - }, - "filetype": { - "attrType": { - "Primitive": { - "primitiveType": "String" - } - }, - "isRequired": true - } - } - }, - "open_attributes": "ClosedAttributes" - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Account", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ] - ] - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": "Any" - }, - "action_constraint": { - "Eq": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - } - }, - "resource_constraint": { - "constraint": { - "In": { - "EUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "Or": { - "left": { - "expr_kind": { - "And": { - "left": { - "expr_kind": { - "BinaryApp": { - "op": "Contains", - "arg1": { - "expr_kind": { - "Set": [ - { - "expr_kind": { - "Lit": { - "String": "JPEG" - } - }, - "source_info": { - "start": 322, - "end": 328 - }, - "data": null - }, - { - "expr_kind": { - "Lit": { - "String": "PNG" - } - }, - "source_info": { - "start": 330, - "end": 335 - }, - "data": null - } - ] - }, - "source_info": { - "start": 321, - "end": 336 - }, - "data": null - }, - "arg2": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "context" - }, - "source_info": { - "start": 346, - "end": 353 - }, - "data": null - }, - "attr": "photo" - } - }, - "source_info": { - "start": 346, - "end": 368 - }, - "data": null - }, - "attr": "filetype" - } - }, - "source_info": { - "start": 346, - "end": 368 - }, - "data": null - } - } - }, - "source_info": { - "start": 321, - "end": 369 - }, - "data": null - }, - "right": { - "expr_kind": { - "BinaryApp": { - "op": "LessEq", - "arg1": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "context" - }, - "source_info": { - "start": 376, - "end": 383 - }, - "data": null - }, - "attr": "photo" - } - }, - "source_info": { - "start": 376, - "end": 401 - }, - "data": null - }, - "attr": "filesize_mb" - } - }, - "source_info": { - "start": 376, - "end": 401 - }, - "data": null - }, - "arg2": { - "expr_kind": { - "Lit": { - "Long": 1 - } - }, - "source_info": { - "start": 405, - "end": 406 - }, - "data": null - } - } - }, - "source_info": { - "start": 376, - "end": 406 - }, - "data": null - } - } - }, - "source_info": { - "start": 321, - "end": 406 - }, - "data": null - }, - "right": { - "expr_kind": { - "And": { - "left": { - "expr_kind": { - "And": { - "left": { - "expr_kind": { - "BinaryApp": { - "op": "Eq", - "arg1": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "context" - }, - "source_info": { - "start": 414, - "end": 421 - }, - "data": null - }, - "attr": "photo" - } - }, - "source_info": { - "start": 414, - "end": 436 - }, - "data": null - }, - "attr": "filetype" - } - }, - "source_info": { - "start": 414, - "end": 436 - }, - "data": null - }, - "arg2": { - "expr_kind": { - "Lit": { - "String": "RAW" - } - }, - "source_info": { - "start": 440, - "end": 445 - }, - "data": null - } - } - }, - "source_info": { - "start": 414, - "end": 445 - }, - "data": null - }, - "right": { - "expr_kind": { - "BinaryApp": { - "op": "LessEq", - "arg1": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "context" - }, - "source_info": { - "start": 452, - "end": 459 - }, - "data": null - }, - "attr": "photo" - } - }, - "source_info": { - "start": 452, - "end": 477 - }, - "data": null - }, - "attr": "filesize_mb" - } - }, - "source_info": { - "start": 452, - "end": 477 - }, - "data": null - }, - "arg2": { - "expr_kind": { - "Lit": { - "Long": 100 - } - }, - "source_info": { - "start": 481, - "end": 484 - }, - "data": null - } - } - }, - "source_info": { - "start": 452, - "end": 484 - }, - "data": null - } - } - }, - "source_info": { - "start": 414, - "end": 523 - }, - "data": null - }, - "right": { - "expr_kind": { - "BinaryApp": { - "op": "In", - "arg1": { - "expr_kind": { - "Var": "principal" - }, - "source_info": { - "start": 491, - "end": 500 - }, - "data": null - }, - "arg2": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "AVTeam" - } - } - }, - "source_info": { - "start": 504, - "end": 523 - }, - "data": null - } - } - }, - "source_info": { - "start": 491, - "end": 523 - }, - "data": null - } - } - }, - "source_info": { - "start": 414, - "end": 523 - }, - "data": null - } - } - }, - "source_info": { - "start": 320, - "end": 524 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "mode": "Strict" -} \ No newline at end of file diff --git a/cedar-lean/validation-examples/ip1.json b/cedar-lean/validation-examples/ip1.json deleted file mode 100644 index f4f2b06c0..000000000 --- a/cedar-lean/validation-examples/ip1.json +++ /dev/null @@ -1,841 +0,0 @@ -{ - "schema": { - "entityTypes": [ - [ - { - "id": "Album", - "path": [] - }, - { - "name": { - "id": "Album", - "path": [] - }, - "descendants": [ - { - "id": "Album", - "path": [] - }, - { - "id": "Video", - "path": [] - }, - { - "id": "Photo", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "User", - "path": [] - }, - { - "name": { - "id": "User", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Administrator", - "path": [] - }, - { - "name": { - "id": "Administrator", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "UserGroup", - "path": [] - }, - { - "name": { - "id": "UserGroup", - "path": [] - }, - "descendants": [ - { - "id": "User", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Video", - "path": [] - }, - { - "name": { - "id": "Video", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Photo", - "path": [] - }, - { - "name": { - "id": "Photo", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "AccountGroup", - "path": [] - }, - { - "name": { - "id": "AccountGroup", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Account", - "path": [] - }, - { - "name": { - "id": "Account", - "path": [] - }, - "descendants": [ - { - "id": "Photo", - "path": [] - }, - { - "id": "Album", - "path": [] - }, - { - "id": "Video", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ] - ], - "actionIds": [ - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Account", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "Administrator", - "path": [] - } - }, - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Video", - "path": [] - } - }, - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ] - ] - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": "Any" - }, - "action_constraint": { - "Eq": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource_constraint": { - "constraint": { - "Eq": { - "EUID": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "BinaryApp": { - "op": "Eq", - "arg1": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "context" - }, - "source_info": { - "start": 102, - "end": 109 - }, - "data": null - }, - "attr": "source_ip" - } - }, - "source_info": { - "start": 102, - "end": 119 - }, - "data": null - }, - "arg2": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "ip", - "path": [] - }, - "args": [ - { - "expr_kind": { - "Lit": { - "String": "222.222.222.222" - } - }, - "source_info": { - "start": 126, - "end": 143 - }, - "data": null - } - ] - } - }, - "source_info": { - "start": 123, - "end": 144 - }, - "data": null - } - } - }, - "source_info": { - "start": 102, - "end": 144 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "mode": "Strict" -} \ No newline at end of file diff --git a/cedar-lean/validation-examples/ip2.json b/cedar-lean/validation-examples/ip2.json deleted file mode 100644 index df51e7cd2..000000000 --- a/cedar-lean/validation-examples/ip2.json +++ /dev/null @@ -1,891 +0,0 @@ -{ - "schema": { - "entityTypes": [ - [ - { - "id": "Photo", - "path": [] - }, - { - "name": { - "id": "Photo", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Administrator", - "path": [] - }, - { - "name": { - "id": "Administrator", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Account", - "path": [] - }, - { - "name": { - "id": "Account", - "path": [] - }, - "descendants": [ - { - "id": "Album", - "path": [] - }, - { - "id": "Video", - "path": [] - }, - { - "id": "Photo", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "AccountGroup", - "path": [] - }, - { - "name": { - "id": "AccountGroup", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Album", - "path": [] - }, - { - "name": { - "id": "Album", - "path": [] - }, - "descendants": [ - { - "id": "Photo", - "path": [] - }, - { - "id": "Video", - "path": [] - }, - { - "id": "Album", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "User", - "path": [] - }, - { - "name": { - "id": "User", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "UserGroup", - "path": [] - }, - { - "name": { - "id": "UserGroup", - "path": [] - }, - "descendants": [ - { - "id": "User", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Video", - "path": [] - }, - { - "name": { - "id": "Video", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ] - ], - "actionIds": [ - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - }, - { - "Specified": { - "id": "Administrator", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - }, - { - "Specified": { - "id": "Video", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Account", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ] - ] - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": "Any" - }, - "action_constraint": { - "Eq": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource_constraint": { - "constraint": { - "Eq": { - "EUID": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "And": { - "left": { - "expr_kind": { - "UnaryApp": { - "op": "Not", - "arg": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "isLoopback", - "path": [] - }, - "args": [ - { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "context" - }, - "source_info": { - "start": 104, - "end": 111 - }, - "data": null - }, - "attr": "source_ip" - } - }, - "source_info": { - "start": 104, - "end": 134 - }, - "data": null - } - ] - } - }, - "source_info": { - "start": 104, - "end": 134 - }, - "data": null - } - } - }, - "source_info": { - "start": 102, - "end": 135 - }, - "data": null - }, - "right": { - "expr_kind": { - "UnaryApp": { - "op": "Not", - "arg": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "isMulticast", - "path": [] - }, - "args": [ - { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "context" - }, - "source_info": { - "start": 141, - "end": 148 - }, - "data": null - }, - "attr": "source_ip" - } - }, - "source_info": { - "start": 141, - "end": 172 - }, - "data": null - } - ] - } - }, - "source_info": { - "start": 141, - "end": 172 - }, - "data": null - } - } - }, - "source_info": { - "start": 139, - "end": 173 - }, - "data": null - } - } - }, - "source_info": { - "start": 102, - "end": 173 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "mode": "Strict" -} \ No newline at end of file diff --git a/cedar-lean/validation-examples/ip3.json b/cedar-lean/validation-examples/ip3.json deleted file mode 100644 index 56cbf856a..000000000 --- a/cedar-lean/validation-examples/ip3.json +++ /dev/null @@ -1,846 +0,0 @@ -{ - "schema": { - "entityTypes": [ - [ - { - "id": "Video", - "path": [] - }, - { - "name": { - "id": "Video", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Administrator", - "path": [] - }, - { - "name": { - "id": "Administrator", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Photo", - "path": [] - }, - { - "name": { - "id": "Photo", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "User", - "path": [] - }, - { - "name": { - "id": "User", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Album", - "path": [] - }, - { - "name": { - "id": "Album", - "path": [] - }, - "descendants": [ - { - "id": "Video", - "path": [] - }, - { - "id": "Photo", - "path": [] - }, - { - "id": "Album", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Account", - "path": [] - }, - { - "name": { - "id": "Account", - "path": [] - }, - "descendants": [ - { - "id": "Video", - "path": [] - }, - { - "id": "Photo", - "path": [] - }, - { - "id": "Album", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "UserGroup", - "path": [] - }, - { - "name": { - "id": "UserGroup", - "path": [] - }, - "descendants": [ - { - "id": "User", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "AccountGroup", - "path": [] - }, - { - "name": { - "id": "AccountGroup", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ] - ], - "actionIds": [ - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Account", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - }, - { - "Specified": { - "id": "Administrator", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Video", - "path": [] - } - }, - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ] - ] - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": "Any" - }, - "action_constraint": { - "Eq": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource_constraint": { - "constraint": { - "Eq": { - "EUID": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "isInRange", - "path": [] - }, - "args": [ - { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "context" - }, - "source_info": { - "start": 102, - "end": 109 - }, - "data": null - }, - "attr": "source_ip" - } - }, - "source_info": { - "start": 102, - "end": 153 - }, - "data": null - }, - { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "ip", - "path": [] - }, - "args": [ - { - "expr_kind": { - "Lit": { - "String": "222.222.222.0/24" - } - }, - "source_info": { - "start": 133, - "end": 151 - }, - "data": null - } - ] - } - }, - "source_info": { - "start": 130, - "end": 152 - }, - "data": null - } - ] - } - }, - "source_info": { - "start": 102, - "end": 153 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "mode": "Strict" -} \ No newline at end of file diff --git a/cedar-lean/validation-examples/multi1.json b/cedar-lean/validation-examples/multi1.json deleted file mode 100644 index a6323545d..000000000 --- a/cedar-lean/validation-examples/multi1.json +++ /dev/null @@ -1,876 +0,0 @@ -{ - "schema": { - "entityTypes": [ - [ - { - "id": "UserGroup", - "path": [] - }, - { - "name": { - "id": "UserGroup", - "path": [] - }, - "descendants": [ - { - "id": "User", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Administrator", - "path": [] - }, - { - "name": { - "id": "Administrator", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "AccountGroup", - "path": [] - }, - { - "name": { - "id": "AccountGroup", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Album", - "path": [] - }, - { - "name": { - "id": "Album", - "path": [] - }, - "descendants": [ - { - "id": "Album", - "path": [] - }, - { - "id": "Video", - "path": [] - }, - { - "id": "Photo", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "User", - "path": [] - }, - { - "name": { - "id": "User", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Photo", - "path": [] - }, - { - "name": { - "id": "Photo", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Account", - "path": [] - }, - { - "name": { - "id": "Account", - "path": [] - }, - "descendants": [ - { - "id": "Video", - "path": [] - }, - { - "id": "Photo", - "path": [] - }, - { - "id": "Album", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Video", - "path": [] - }, - { - "name": { - "id": "Video", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ] - ], - "actionIds": [ - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Account", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "Administrator", - "path": [] - } - }, - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - }, - { - "Specified": { - "id": "Video", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ] - ] - }, - "policies": { - "templates": { - "policy1": { - "id": "policy1", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": { - "Eq": { - "EUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "bob" - } - } - } - }, - "action_constraint": { - "In": [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - } - ] - }, - "resource_constraint": { - "constraint": { - "In": { - "EUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "bob" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": { - "start": 204, - "end": 318 - }, - "data": null - } - }, - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": { - "Eq": { - "EUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - } - } - }, - "action_constraint": { - "Eq": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource_constraint": { - "constraint": { - "In": { - "EUID": { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": { - "start": 96, - "end": 202 - }, - "data": null - } - } - }, - "links": { - "policy1": { - "template_id": "policy1", - "link_id": null, - "values": {} - }, - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "mode": "Strict" -} \ No newline at end of file diff --git a/cedar-lean/validation-examples/multi2.json b/cedar-lean/validation-examples/multi2.json deleted file mode 100644 index 06b040763..000000000 --- a/cedar-lean/validation-examples/multi2.json +++ /dev/null @@ -1,853 +0,0 @@ -{ - "schema": { - "entityTypes": [ - [ - { - "id": "Video", - "path": [] - }, - { - "name": { - "id": "Video", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "UserGroup", - "path": [] - }, - { - "name": { - "id": "UserGroup", - "path": [] - }, - "descendants": [ - { - "id": "User", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Administrator", - "path": [] - }, - { - "name": { - "id": "Administrator", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Album", - "path": [] - }, - { - "name": { - "id": "Album", - "path": [] - }, - "descendants": [ - { - "id": "Photo", - "path": [] - }, - { - "id": "Video", - "path": [] - }, - { - "id": "Album", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Photo", - "path": [] - }, - { - "name": { - "id": "Photo", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "User", - "path": [] - }, - { - "name": { - "id": "User", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "AccountGroup", - "path": [] - }, - { - "name": { - "id": "AccountGroup", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Account", - "path": [] - }, - { - "name": { - "id": "Account", - "path": [] - }, - "descendants": [ - { - "id": "Photo", - "path": [] - }, - { - "id": "Album", - "path": [] - }, - { - "id": "Video", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ] - ], - "actionIds": [ - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Account", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "Administrator", - "path": [] - } - }, - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Video", - "path": [] - } - }, - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ] - ] - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": "Any" - }, - "action_constraint": { - "Eq": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource_constraint": { - "constraint": { - "In": { - "EUID": { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": { - "start": 121, - "end": 210 - }, - "data": null - } - }, - "policy1": { - "id": "policy1", - "annotations": {}, - "effect": "forbid", - "principal_constraint": { - "constraint": { - "Eq": { - "EUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "bob" - } - } - } - }, - "action_constraint": { - "Eq": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource_constraint": { - "constraint": { - "In": { - "EUID": { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": { - "start": 226, - "end": 330 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - }, - "policy1": { - "template_id": "policy1", - "link_id": null, - "values": {} - } - } - }, - "mode": "Strict" -} \ No newline at end of file diff --git a/cedar-lean/validation-examples/multi3.json b/cedar-lean/validation-examples/multi3.json deleted file mode 100644 index 3d27a3b68..000000000 --- a/cedar-lean/validation-examples/multi3.json +++ /dev/null @@ -1,990 +0,0 @@ -{ - "schema": { - "entityTypes": [ - [ - { - "id": "UserGroup", - "path": [] - }, - { - "name": { - "id": "UserGroup", - "path": [] - }, - "descendants": [ - { - "id": "User", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Album", - "path": [] - }, - { - "name": { - "id": "Album", - "path": [] - }, - "descendants": [ - { - "id": "Album", - "path": [] - }, - { - "id": "Photo", - "path": [] - } - ], - "attributes": { - "attrs": { - "account": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "Account", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "User", - "path": [] - }, - { - "name": { - "id": "User", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": { - "department": { - "attrType": { - "Primitive": { - "primitiveType": "String" - } - }, - "isRequired": true - }, - "jobLevel": { - "attrType": { - "Primitive": { - "primitiveType": "Long" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "Account", - "path": [] - }, - { - "name": { - "id": "Account", - "path": [] - }, - "descendants": [ - { - "id": "Album", - "path": [] - }, - { - "id": "Photo", - "path": [] - } - ], - "attributes": { - "attrs": { - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "owner": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "Administrator", - "path": [] - }, - { - "name": { - "id": "Administrator", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Photo", - "path": [] - }, - { - "name": { - "id": "Photo", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": { - "account": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "Account", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "AccountGroup", - "path": [] - }, - { - "name": { - "id": "AccountGroup", - "path": [] - }, - "descendants": [ - { - "id": "Album", - "path": [] - }, - { - "id": "Account", - "path": [] - }, - { - "id": "Photo", - "path": [] - } - ], - "attributes": { - "attrs": { - "owner": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - }, - "isRequired": true - } - } - } - } - ] - ], - "actionIds": [ - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Account", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "photo": { - "attrType": { - "EntityOrRecord": { - "Record": { - "attrs": { - "attrs": { - "filesize_mb": { - "attrType": { - "Primitive": { - "primitiveType": "Long" - } - }, - "isRequired": true - }, - "filetype": { - "attrType": { - "Primitive": { - "primitiveType": "String" - } - }, - "isRequired": true - } - } - }, - "open_attributes": "ClosedAttributes" - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ] - ] - }, - "policies": { - "templates": { - "policy1": { - "id": "policy1", - "annotations": {}, - "effect": "forbid", - "principal_constraint": { - "constraint": "Any" - }, - "action_constraint": "Any", - "resource_constraint": { - "constraint": "Any" - }, - "non_head_constraints": { - "expr_kind": { - "And": { - "left": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "resource" - }, - "source_info": { - "start": 398, - "end": 406 - }, - "data": null - }, - "attr": "private" - } - }, - "source_info": { - "start": 398, - "end": 414 - }, - "data": null - }, - "right": { - "expr_kind": { - "UnaryApp": { - "op": "Not", - "arg": { - "expr_kind": { - "And": { - "left": { - "expr_kind": { - "HasAttr": { - "expr": { - "expr_kind": { - "Var": "resource" - }, - "source_info": { - "start": 426, - "end": 434 - }, - "data": null - }, - "attr": "account" - } - }, - "source_info": { - "start": 426, - "end": 446 - }, - "data": null - }, - "right": { - "expr_kind": { - "BinaryApp": { - "op": "Eq", - "arg1": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "resource" - }, - "source_info": { - "start": 450, - "end": 458 - }, - "data": null - }, - "attr": "account" - } - }, - "source_info": { - "start": 450, - "end": 472 - }, - "data": null - }, - "attr": "owner" - } - }, - "source_info": { - "start": 450, - "end": 472 - }, - "data": null - }, - "arg2": { - "expr_kind": { - "Var": "principal" - }, - "source_info": { - "start": 476, - "end": 485 - }, - "data": null - } - } - }, - "source_info": { - "start": 450, - "end": 485 - }, - "data": null - } - } - }, - "source_info": { - "start": 426, - "end": 485 - }, - "data": null - } - } - }, - "source_info": { - "start": 417, - "end": 487 - }, - "data": null - } - } - }, - "source_info": { - "start": 354, - "end": 488 - }, - "data": null - } - }, - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": { - "In": { - "EUID": { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "alice_friends" - } - } - } - }, - "action_constraint": { - "Eq": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource_constraint": { - "constraint": { - "In": { - "EUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": { - "start": 145, - "end": 258 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - }, - "policy1": { - "template_id": "policy1", - "link_id": null, - "values": {} - } - } - }, - "mode": "Strict" -} \ No newline at end of file diff --git a/cedar-lean/validation-examples/multi4.json b/cedar-lean/validation-examples/multi4.json deleted file mode 100644 index 62cafffd9..000000000 --- a/cedar-lean/validation-examples/multi4.json +++ /dev/null @@ -1,1094 +0,0 @@ -{ - "schema": { - "entityTypes": [ - [ - { - "id": "Account", - "path": [] - }, - { - "name": { - "id": "Account", - "path": [] - }, - "descendants": [ - { - "id": "Photo", - "path": [] - }, - { - "id": "Album", - "path": [] - } - ], - "attributes": { - "attrs": { - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "owner": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "AccountGroup", - "path": [] - }, - { - "name": { - "id": "AccountGroup", - "path": [] - }, - "descendants": [ - { - "id": "Photo", - "path": [] - }, - { - "id": "Account", - "path": [] - }, - { - "id": "Album", - "path": [] - } - ], - "attributes": { - "attrs": { - "owner": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "Photo", - "path": [] - }, - { - "name": { - "id": "Photo", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": { - "account": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "Account", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "UserGroup", - "path": [] - }, - { - "name": { - "id": "UserGroup", - "path": [] - }, - "descendants": [ - { - "id": "User", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "User", - "path": [] - }, - { - "name": { - "id": "User", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": { - "department": { - "attrType": { - "Primitive": { - "primitiveType": "String" - } - }, - "isRequired": true - }, - "jobLevel": { - "attrType": { - "Primitive": { - "primitiveType": "Long" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "Administrator", - "path": [] - }, - { - "name": { - "id": "Administrator", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Album", - "path": [] - }, - { - "name": { - "id": "Album", - "path": [] - }, - "descendants": [ - { - "id": "Album", - "path": [] - }, - { - "id": "Photo", - "path": [] - } - ], - "attributes": { - "attrs": { - "account": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "Account", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ] - ], - "actionIds": [ - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Account", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "photo": { - "attrType": { - "EntityOrRecord": { - "Record": { - "attrs": { - "attrs": { - "filesize_mb": { - "attrType": { - "Primitive": { - "primitiveType": "Long" - } - }, - "isRequired": true - }, - "filetype": { - "attrType": { - "Primitive": { - "primitiveType": "String" - } - }, - "isRequired": true - } - } - }, - "open_attributes": "ClosedAttributes" - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ] - ] - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": { - "In": { - "EUID": { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "alice_friends" - } - } - } - }, - "action_constraint": { - "Eq": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource_constraint": { - "constraint": { - "In": { - "EUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": { - "start": 140, - "end": 253 - }, - "data": null - } - }, - "policy3": { - "id": "policy3", - "annotations": {}, - "effect": "forbid", - "principal_constraint": { - "constraint": "Any" - }, - "action_constraint": "Any", - "resource_constraint": { - "constraint": "Any" - }, - "non_head_constraints": { - "expr_kind": { - "UnaryApp": { - "op": "Not", - "arg": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "context" - }, - "source_info": { - "start": 751, - "end": 758 - }, - "data": null - }, - "attr": "authenticated" - } - }, - "source_info": { - "start": 751, - "end": 772 - }, - "data": null - } - } - }, - "source_info": { - "start": 750, - "end": 772 - }, - "data": null - } - }, - "policy2": { - "id": "policy2", - "annotations": {}, - "effect": "forbid", - "principal_constraint": { - "constraint": "Any" - }, - "action_constraint": "Any", - "resource_constraint": { - "constraint": "Any" - }, - "non_head_constraints": { - "expr_kind": { - "And": { - "left": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "resource" - }, - "source_info": { - "start": 548, - "end": 556 - }, - "data": null - }, - "attr": "private" - } - }, - "source_info": { - "start": 548, - "end": 564 - }, - "data": null - }, - "right": { - "expr_kind": { - "UnaryApp": { - "op": "Not", - "arg": { - "expr_kind": { - "And": { - "left": { - "expr_kind": { - "HasAttr": { - "expr": { - "expr_kind": { - "Var": "resource" - }, - "source_info": { - "start": 576, - "end": 584 - }, - "data": null - }, - "attr": "account" - } - }, - "source_info": { - "start": 576, - "end": 596 - }, - "data": null - }, - "right": { - "expr_kind": { - "BinaryApp": { - "op": "Eq", - "arg1": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "resource" - }, - "source_info": { - "start": 600, - "end": 608 - }, - "data": null - }, - "attr": "account" - } - }, - "source_info": { - "start": 600, - "end": 622 - }, - "data": null - }, - "attr": "owner" - } - }, - "source_info": { - "start": 600, - "end": 622 - }, - "data": null - }, - "arg2": { - "expr_kind": { - "Var": "principal" - }, - "source_info": { - "start": 626, - "end": 635 - }, - "data": null - } - } - }, - "source_info": { - "start": 600, - "end": 635 - }, - "data": null - } - } - }, - "source_info": { - "start": 576, - "end": 635 - }, - "data": null - } - } - }, - "source_info": { - "start": 567, - "end": 637 - }, - "data": null - } - } - }, - "source_info": { - "start": 504, - "end": 638 - }, - "data": null - } - }, - "policy1": { - "id": "policy1", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": "Any" - }, - "action_constraint": "Any", - "resource_constraint": { - "constraint": { - "In": { - "EUID": { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "alice_vacation" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "BinaryApp": { - "op": "Eq", - "arg1": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "principal" - }, - "source_info": { - "start": 401, - "end": 410 - }, - "data": null - }, - "attr": "department" - } - }, - "source_info": { - "start": 401, - "end": 421 - }, - "data": null - }, - "arg2": { - "expr_kind": { - "Lit": { - "String": "Sales" - } - }, - "source_info": { - "start": 425, - "end": 432 - }, - "data": null - } - } - }, - "source_info": { - "start": 401, - "end": 432 - }, - "data": null - } - } - }, - "links": { - "policy1": { - "template_id": "policy1", - "link_id": null, - "values": {} - }, - "policy3": { - "template_id": "policy3", - "link_id": null, - "values": {} - }, - "policy2": { - "template_id": "policy2", - "link_id": null, - "values": {} - }, - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "mode": "Strict" -} \ No newline at end of file From 7b5d327e6b21ab3ae0ca587988cc912990bb0ef9 Mon Sep 17 00:00:00 2001 From: Kesha Hietala Date: Tue, 21 Nov 2023 10:12:05 -0500 Subject: [PATCH 30/57] forgot to add examples --- .../Cli/json-inputs/authorize/decimal1.json | 1332 ++++++++++++++ .../Cli/json-inputs/authorize/decimal2.json | 1411 +++++++++++++++ .../Cli/json-inputs/authorize/example1a.json | 717 ++++++++ .../Cli/json-inputs/authorize/example2a.json | 717 ++++++++ .../Cli/json-inputs/authorize/example2b.json | 717 ++++++++ .../Cli/json-inputs/authorize/example2c.json | 737 ++++++++ .../Cli/json-inputs/authorize/example3a.json | 705 ++++++++ .../Cli/json-inputs/authorize/example3b.json | 737 ++++++++ .../Cli/json-inputs/authorize/example3c.json | 707 ++++++++ .../Cli/json-inputs/authorize/example4a.json | 1344 ++++++++++++++ .../Cli/json-inputs/authorize/example4d.json | 1285 +++++++++++++ .../Cli/json-inputs/authorize/example4e.json | 1286 +++++++++++++ .../Cli/json-inputs/authorize/example4f.json | 1340 ++++++++++++++ .../Cli/json-inputs/authorize/example5b.json | 1585 +++++++++++++++++ cedar-lean/Cli/json-inputs/authorize/ip1.json | 756 ++++++++ cedar-lean/Cli/json-inputs/authorize/ip2.json | 806 +++++++++ cedar-lean/Cli/json-inputs/authorize/ip3.json | 761 ++++++++ .../Cli/json-inputs/authorize/multi1.json | 791 ++++++++ .../Cli/json-inputs/authorize/multi2.json | 768 ++++++++ .../Cli/json-inputs/authorize/multi3.json | 1439 +++++++++++++++ .../Cli/json-inputs/authorize/multi4.json | 1519 ++++++++++++++++ .../Cli/json-inputs/validate/decimal1.json | 883 +++++++++ .../Cli/json-inputs/validate/decimal2.json | 962 ++++++++++ .../Cli/json-inputs/validate/example1a.json | 802 +++++++++ .../Cli/json-inputs/validate/example2a.json | 802 +++++++++ .../Cli/json-inputs/validate/example2b.json | 802 +++++++++ .../Cli/json-inputs/validate/example2c.json | 822 +++++++++ .../Cli/json-inputs/validate/example3a.json | 790 ++++++++ .../Cli/json-inputs/validate/example3b.json | 822 +++++++++ .../Cli/json-inputs/validate/example3c.json | 792 ++++++++ .../Cli/json-inputs/validate/example4a.json | 919 ++++++++++ .../Cli/json-inputs/validate/example4d.json | 860 +++++++++ .../Cli/json-inputs/validate/example4e.json | 861 +++++++++ .../Cli/json-inputs/validate/example4f.json | 915 ++++++++++ .../Cli/json-inputs/validate/example5b.json | 1134 ++++++++++++ cedar-lean/Cli/json-inputs/validate/ip1.json | 841 +++++++++ cedar-lean/Cli/json-inputs/validate/ip2.json | 891 +++++++++ cedar-lean/Cli/json-inputs/validate/ip3.json | 846 +++++++++ .../Cli/json-inputs/validate/multi1.json | 876 +++++++++ .../Cli/json-inputs/validate/multi2.json | 853 +++++++++ .../Cli/json-inputs/validate/multi3.json | 990 ++++++++++ .../Cli/json-inputs/validate/multi4.json | 1094 ++++++++++++ 42 files changed, 40017 insertions(+) create mode 100644 cedar-lean/Cli/json-inputs/authorize/decimal1.json create mode 100644 cedar-lean/Cli/json-inputs/authorize/decimal2.json create mode 100644 cedar-lean/Cli/json-inputs/authorize/example1a.json create mode 100644 cedar-lean/Cli/json-inputs/authorize/example2a.json create mode 100644 cedar-lean/Cli/json-inputs/authorize/example2b.json create mode 100644 cedar-lean/Cli/json-inputs/authorize/example2c.json create mode 100644 cedar-lean/Cli/json-inputs/authorize/example3a.json create mode 100644 cedar-lean/Cli/json-inputs/authorize/example3b.json create mode 100644 cedar-lean/Cli/json-inputs/authorize/example3c.json create mode 100644 cedar-lean/Cli/json-inputs/authorize/example4a.json create mode 100644 cedar-lean/Cli/json-inputs/authorize/example4d.json create mode 100644 cedar-lean/Cli/json-inputs/authorize/example4e.json create mode 100644 cedar-lean/Cli/json-inputs/authorize/example4f.json create mode 100644 cedar-lean/Cli/json-inputs/authorize/example5b.json create mode 100644 cedar-lean/Cli/json-inputs/authorize/ip1.json create mode 100644 cedar-lean/Cli/json-inputs/authorize/ip2.json create mode 100644 cedar-lean/Cli/json-inputs/authorize/ip3.json create mode 100644 cedar-lean/Cli/json-inputs/authorize/multi1.json create mode 100644 cedar-lean/Cli/json-inputs/authorize/multi2.json create mode 100644 cedar-lean/Cli/json-inputs/authorize/multi3.json create mode 100644 cedar-lean/Cli/json-inputs/authorize/multi4.json create mode 100644 cedar-lean/Cli/json-inputs/validate/decimal1.json create mode 100644 cedar-lean/Cli/json-inputs/validate/decimal2.json create mode 100644 cedar-lean/Cli/json-inputs/validate/example1a.json create mode 100644 cedar-lean/Cli/json-inputs/validate/example2a.json create mode 100644 cedar-lean/Cli/json-inputs/validate/example2b.json create mode 100644 cedar-lean/Cli/json-inputs/validate/example2c.json create mode 100644 cedar-lean/Cli/json-inputs/validate/example3a.json create mode 100644 cedar-lean/Cli/json-inputs/validate/example3b.json create mode 100644 cedar-lean/Cli/json-inputs/validate/example3c.json create mode 100644 cedar-lean/Cli/json-inputs/validate/example4a.json create mode 100644 cedar-lean/Cli/json-inputs/validate/example4d.json create mode 100644 cedar-lean/Cli/json-inputs/validate/example4e.json create mode 100644 cedar-lean/Cli/json-inputs/validate/example4f.json create mode 100644 cedar-lean/Cli/json-inputs/validate/example5b.json create mode 100644 cedar-lean/Cli/json-inputs/validate/ip1.json create mode 100644 cedar-lean/Cli/json-inputs/validate/ip2.json create mode 100644 cedar-lean/Cli/json-inputs/validate/ip3.json create mode 100644 cedar-lean/Cli/json-inputs/validate/multi1.json create mode 100644 cedar-lean/Cli/json-inputs/validate/multi2.json create mode 100644 cedar-lean/Cli/json-inputs/validate/multi3.json create mode 100644 cedar-lean/Cli/json-inputs/validate/multi4.json diff --git a/cedar-lean/Cli/json-inputs/authorize/decimal1.json b/cedar-lean/Cli/json-inputs/authorize/decimal1.json new file mode 100644 index 000000000..8c888c389 --- /dev/null +++ b/cedar-lean/Cli/json-inputs/authorize/decimal1.json @@ -0,0 +1,1332 @@ +{ + "request": { + "principal": { + "Known": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + }, + "action": { + "Known": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource": { + "Known": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + } + }, + "context": { + "expr_kind": { + "Record": { + "authenticated": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "confidence_score": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "decimal", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "0.8" + } + }, + "source_info": null, + "data": null + } + ] + } + }, + "source_info": null, + "data": null + }, + "source_ip": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "ip", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "123.123.123.123" + } + }, + "source_info": null, + "data": null + } + ] + } + }, + "source_info": null, + "data": null + } + } + }, + "source_info": null, + "data": null + } + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "greaterThan", + "path": [] + }, + "args": [ + { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 102, + "end": 109 + }, + "data": null + }, + "attr": "confidence_score" + } + }, + "source_info": { + "start": 102, + "end": 155 + }, + "data": null + }, + { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "decimal", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "0.75" + } + }, + "source_info": { + "start": 147, + "end": 153 + }, + "data": null + } + ] + } + }, + "source_info": { + "start": 139, + "end": 154 + }, + "data": null + } + ] + } + }, + "source_info": { + "start": 102, + "end": 155 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "entities": { + "entities": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + "attrs": { + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "prototype_v0.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "prototype_v0.jpg" + }, + "attrs": { + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "ahmad" + } + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "device_prototypes" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + }, + "attrs": { + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "stacey" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "giuseppe" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "giuseppe" + }, + "attrs": { + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 7 + } + }, + "source_info": null, + "data": null + }, + "department": { + "expr_kind": { + "Lit": { + "String": "CustomerSupport" + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "sales_projections.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "sales_projections.jpg" + }, + "attrs": { + "admins": { + "expr_kind": { + "Set": [ + { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "giuseppe" + } + } + }, + "source_info": null, + "data": null + } + ] + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "device_prototypes" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "device_prototypes" + }, + "attrs": { + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + }, + "attrs": { + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "stacey" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "stacey" + }, + "attrs": { + "department": { + "expr_kind": { + "Lit": { + "String": "Sales" + } + }, + "source_info": null, + "data": null + }, + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 6 + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "alice_vacation" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "alice_vacation" + }, + "attrs": { + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + }, + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "ahmad" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "ahmad" + }, + "attrs": { + "department": { + "expr_kind": { + "Lit": { + "String": "HardwareEngineering" + } + }, + "source_info": null, + "data": null + }, + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 4 + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "ahmad" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "ahmad" + }, + "attrs": { + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "ahmad" + } + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "vacation.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "vacation.jpg" + }, + "attrs": { + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + }, + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "alice_vacation" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "alice_w2.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "alice_w2.jpg" + }, + "attrs": { + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + }, + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + "attrs": { + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 5 + } + }, + "source_info": null, + "data": null + }, + "department": { + "expr_kind": { + "Lit": { + "String": "HardwareEngineering" + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + }, + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "attrs": {}, + "ancestors": [] + } + ] + ] + } +} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/authorize/decimal2.json b/cedar-lean/Cli/json-inputs/authorize/decimal2.json new file mode 100644 index 000000000..18af5d916 --- /dev/null +++ b/cedar-lean/Cli/json-inputs/authorize/decimal2.json @@ -0,0 +1,1411 @@ +{ + "request": { + "principal": { + "Known": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + }, + "action": { + "Known": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource": { + "Known": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + } + }, + "context": { + "expr_kind": { + "Record": { + "authenticated": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "confidence_score": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "decimal", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "0.455" + } + }, + "source_info": null, + "data": null + } + ] + } + }, + "source_info": null, + "data": null + }, + "source_ip": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "ip", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "123.123.123.123" + } + }, + "source_info": null, + "data": null + } + ] + } + }, + "source_info": null, + "data": null + } + } + }, + "source_info": null, + "data": null + } + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "And": { + "left": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "greaterThanOrEqual", + "path": [] + }, + "args": [ + { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 104, + "end": 111 + }, + "data": null + }, + "attr": "confidence_score" + } + }, + "source_info": { + "start": 104, + "end": 163 + }, + "data": null + }, + { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "decimal", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "0.4" + } + }, + "source_info": { + "start": 156, + "end": 161 + }, + "data": null + } + ] + } + }, + "source_info": { + "start": 148, + "end": 162 + }, + "data": null + } + ] + } + }, + "source_info": { + "start": 104, + "end": 163 + }, + "data": null + }, + "right": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "lessThanOrEqual", + "path": [] + }, + "args": [ + { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 169, + "end": 176 + }, + "data": null + }, + "attr": "confidence_score" + } + }, + "source_info": { + "start": 169, + "end": 225 + }, + "data": null + }, + { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "decimal", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "0.5" + } + }, + "source_info": { + "start": 218, + "end": 223 + }, + "data": null + } + ] + } + }, + "source_info": { + "start": 210, + "end": 224 + }, + "data": null + } + ] + } + }, + "source_info": { + "start": 169, + "end": 225 + }, + "data": null + } + } + }, + "source_info": { + "start": 104, + "end": 225 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "entities": { + "entities": [ + [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "prototype_v0.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "prototype_v0.jpg" + }, + "attrs": { + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "ahmad" + } + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "device_prototypes" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "giuseppe" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "giuseppe" + }, + "attrs": { + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 7 + } + }, + "source_info": null, + "data": null + }, + "department": { + "expr_kind": { + "Lit": { + "String": "CustomerSupport" + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + }, + "attrs": { + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "ahmad" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "ahmad" + }, + "attrs": { + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 4 + } + }, + "source_info": null, + "data": null + }, + "department": { + "expr_kind": { + "Lit": { + "String": "HardwareEngineering" + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "ahmad" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "ahmad" + }, + "attrs": { + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "ahmad" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "vacation.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "vacation.jpg" + }, + "attrs": { + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "alice_vacation" + }, + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + }, + "attrs": { + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "stacey" + } + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "stacey" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "stacey" + }, + "attrs": { + "department": { + "expr_kind": { + "Lit": { + "String": "Sales" + } + }, + "source_info": null, + "data": null + }, + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 6 + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "device_prototypes" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "device_prototypes" + }, + "attrs": { + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + "attrs": { + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "sales_projections.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "sales_projections.jpg" + }, + "attrs": { + "admins": { + "expr_kind": { + "Set": [ + { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "giuseppe" + } + } + }, + "source_info": null, + "data": null + } + ] + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + "attrs": { + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 5 + } + }, + "source_info": null, + "data": null + }, + "department": { + "expr_kind": { + "Lit": { + "String": "HardwareEngineering" + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + }, + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "alice_w2.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "alice_w2.jpg" + }, + "attrs": { + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "alice_vacation" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "alice_vacation" + }, + "attrs": { + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + ] + } + ] + ] + } +} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/authorize/example1a.json b/cedar-lean/Cli/json-inputs/authorize/example1a.json new file mode 100644 index 000000000..f2096d5ce --- /dev/null +++ b/cedar-lean/Cli/json-inputs/authorize/example1a.json @@ -0,0 +1,717 @@ +{ + "request": { + "principal": { + "Known": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + }, + "action": { + "Known": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource": { + "Known": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + } + }, + "context": { + "expr_kind": { + "Record": { + "authenticated": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": null, + "data": null + }, + "confidence_score": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "decimal", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "0.6" + } + }, + "source_info": null, + "data": null + } + ] + } + }, + "source_info": null, + "data": null + }, + "source_ip": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "ip", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "123.123.123.123" + } + }, + "source_info": null, + "data": null + } + ] + } + }, + "source_info": null, + "data": null + } + } + }, + "source_info": null, + "data": null + } + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + } + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 56, + "end": 168 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "entities": { + "entities": [ + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "bob" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "bob" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Administrator", + "path": [] + } + }, + "eid": "ahmad" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Administrator", + "path": [] + } + }, + "eid": "ahmad" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Video", + "path": [] + } + }, + "eid": "surf.mp4" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Video", + "path": [] + } + }, + "eid": "surf.mp4" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "passportscan.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "passportscan.jpg" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "selfie.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "selfie.jpg" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "tim" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "tim" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "attrs": {}, + "ancestors": [] + } + ] + ] + } +} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/authorize/example2a.json b/cedar-lean/Cli/json-inputs/authorize/example2a.json new file mode 100644 index 000000000..fa6bed243 --- /dev/null +++ b/cedar-lean/Cli/json-inputs/authorize/example2a.json @@ -0,0 +1,717 @@ +{ + "request": { + "principal": { + "Known": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + }, + "action": { + "Known": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource": { + "Known": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + } + }, + "context": { + "expr_kind": { + "Record": { + "authenticated": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": null, + "data": null + }, + "confidence_score": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "decimal", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "0.6" + } + }, + "source_info": null, + "data": null + } + ] + } + }, + "source_info": null, + "data": null + }, + "source_ip": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "ip", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "123.123.123.123" + } + }, + "source_info": null, + "data": null + } + ] + } + }, + "source_info": null, + "data": null + } + } + }, + "source_info": null, + "data": null + } + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + } + } + } + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 63, + "end": 187 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "entities": { + "entities": [ + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "selfie.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "selfie.jpg" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "bob" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "bob" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Administrator", + "path": [] + } + }, + "eid": "ahmad" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Administrator", + "path": [] + } + }, + "eid": "ahmad" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "tim" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "tim" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Video", + "path": [] + } + }, + "eid": "surf.mp4" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Video", + "path": [] + } + }, + "eid": "surf.mp4" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "passportscan.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "passportscan.jpg" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "attrs": {}, + "ancestors": [] + } + ] + ] + } +} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/authorize/example2b.json b/cedar-lean/Cli/json-inputs/authorize/example2b.json new file mode 100644 index 000000000..e726ec89f --- /dev/null +++ b/cedar-lean/Cli/json-inputs/authorize/example2b.json @@ -0,0 +1,717 @@ +{ + "request": { + "principal": { + "Known": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + }, + "action": { + "Known": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource": { + "Known": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + } + }, + "context": { + "expr_kind": { + "Record": { + "authenticated": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": null, + "data": null + }, + "confidence_score": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "decimal", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "0.6" + } + }, + "source_info": null, + "data": null + } + ] + } + }, + "source_info": null, + "data": null + }, + "source_ip": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "ip", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "123.123.123.123" + } + }, + "source_info": null, + "data": null + } + ] + } + }, + "source_info": null, + "data": null + } + } + }, + "source_info": null, + "data": null + } + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + } + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 68, + "end": 174 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "entities": { + "entities": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "tim" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "tim" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "bob" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "bob" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Administrator", + "path": [] + } + }, + "eid": "ahmad" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Administrator", + "path": [] + } + }, + "eid": "ahmad" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "passportscan.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "passportscan.jpg" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "selfie.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "selfie.jpg" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Video", + "path": [] + } + }, + "eid": "surf.mp4" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Video", + "path": [] + } + }, + "eid": "surf.mp4" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + }, + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + } + ] + } + ] + ] + } +} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/authorize/example2c.json b/cedar-lean/Cli/json-inputs/authorize/example2c.json new file mode 100644 index 000000000..f1f307b5a --- /dev/null +++ b/cedar-lean/Cli/json-inputs/authorize/example2c.json @@ -0,0 +1,737 @@ +{ + "request": { + "principal": { + "Known": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + }, + "action": { + "Known": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + } + }, + "resource": { + "Known": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + } + }, + "context": { + "expr_kind": { + "Record": { + "authenticated": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": null, + "data": null + }, + "confidence_score": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "decimal", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "0.6" + } + }, + "source_info": null, + "data": null + } + ] + } + }, + "source_info": null, + "data": null + }, + "source_ip": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "ip", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "123.123.123.123" + } + }, + "source_info": null, + "data": null + } + ] + } + }, + "source_info": null, + "data": null + } + } + }, + "source_info": null, + "data": null + } + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + } + }, + "action_constraint": { + "In": [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + } + ] + }, + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 89, + "end": 232 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "entities": { + "entities": [ + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "passportscan.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "passportscan.jpg" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Administrator", + "path": [] + } + }, + "eid": "ahmad" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Administrator", + "path": [] + } + }, + "eid": "ahmad" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "selfie.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "selfie.jpg" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "bob" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "bob" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "tim" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "tim" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Video", + "path": [] + } + }, + "eid": "surf.mp4" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Video", + "path": [] + } + }, + "eid": "surf.mp4" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ] + ] + } +} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/authorize/example3a.json b/cedar-lean/Cli/json-inputs/authorize/example3a.json new file mode 100644 index 000000000..acabaf5a3 --- /dev/null +++ b/cedar-lean/Cli/json-inputs/authorize/example3a.json @@ -0,0 +1,705 @@ +{ + "request": { + "principal": { + "Known": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + }, + "action": { + "Known": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource": { + "Known": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + } + }, + "context": { + "expr_kind": { + "Record": { + "authenticated": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": null, + "data": null + }, + "confidence_score": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "decimal", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "0.6" + } + }, + "source_info": null, + "data": null + } + ] + } + }, + "source_info": null, + "data": null + }, + "source_ip": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "ip", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "123.123.123.123" + } + }, + "source_info": null, + "data": null + } + ] + } + }, + "source_info": null, + "data": null + } + } + }, + "source_info": null, + "data": null + } + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 63, + "end": 152 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "entities": { + "entities": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Administrator", + "path": [] + } + }, + "eid": "ahmad" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Administrator", + "path": [] + } + }, + "eid": "ahmad" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Video", + "path": [] + } + }, + "eid": "surf.mp4" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Video", + "path": [] + } + }, + "eid": "surf.mp4" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "tim" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "tim" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "selfie.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "selfie.jpg" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "passportscan.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "passportscan.jpg" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "bob" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "bob" + }, + "attrs": {}, + "ancestors": [] + } + ] + ] + } +} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/authorize/example3b.json b/cedar-lean/Cli/json-inputs/authorize/example3b.json new file mode 100644 index 000000000..d8c71260d --- /dev/null +++ b/cedar-lean/Cli/json-inputs/authorize/example3b.json @@ -0,0 +1,737 @@ +{ + "request": { + "principal": { + "Known": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + }, + "action": { + "Known": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource": { + "Known": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + } + }, + "context": { + "expr_kind": { + "Record": { + "authenticated": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": null, + "data": null + }, + "confidence_score": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "decimal", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "0.6" + } + }, + "source_info": null, + "data": null + } + ] + } + }, + "source_info": null, + "data": null + }, + "source_ip": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "ip", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "123.123.123.123" + } + }, + "source_info": null, + "data": null + } + ] + } + }, + "source_info": null, + "data": null + } + } + }, + "source_info": null, + "data": null + } + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + } + }, + "action_constraint": { + "In": [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + ] + }, + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 86, + "end": 231 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "entities": { + "entities": [ + [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Administrator", + "path": [] + } + }, + "eid": "ahmad" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Administrator", + "path": [] + } + }, + "eid": "ahmad" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Video", + "path": [] + } + }, + "eid": "surf.mp4" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Video", + "path": [] + } + }, + "eid": "surf.mp4" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + }, + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "tim" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "tim" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "passportscan.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "passportscan.jpg" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "bob" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "bob" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "selfie.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "selfie.jpg" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ] + ] + } +} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/authorize/example3c.json b/cedar-lean/Cli/json-inputs/authorize/example3c.json new file mode 100644 index 000000000..c1e51a49a --- /dev/null +++ b/cedar-lean/Cli/json-inputs/authorize/example3c.json @@ -0,0 +1,707 @@ +{ + "request": { + "principal": { + "Known": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + }, + "action": { + "Known": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource": { + "Known": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + } + }, + "context": { + "expr_kind": { + "Record": { + "authenticated": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": null, + "data": null + }, + "confidence_score": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "decimal", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "0.6" + } + }, + "source_info": null, + "data": null + } + ] + } + }, + "source_info": null, + "data": null + }, + "source_ip": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "ip", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "123.123.123.123" + } + }, + "source_info": null, + "data": null + } + ] + } + }, + "source_info": null, + "data": null + } + } + }, + "source_info": null, + "data": null + } + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + } + }, + "action_constraint": "Any", + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 85, + "end": 173 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "entities": { + "entities": [ + [ + { + "ty": { + "Specified": { + "id": "Video", + "path": [] + } + }, + "eid": "surf.mp4" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Video", + "path": [] + } + }, + "eid": "surf.mp4" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + }, + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "selfie.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "selfie.jpg" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "tim" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "tim" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Administrator", + "path": [] + } + }, + "eid": "ahmad" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Administrator", + "path": [] + } + }, + "eid": "ahmad" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "passportscan.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "passportscan.jpg" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "bob" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "bob" + }, + "attrs": {}, + "ancestors": [] + } + ] + ] + } +} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/authorize/example4a.json b/cedar-lean/Cli/json-inputs/authorize/example4a.json new file mode 100644 index 000000000..46b7a1343 --- /dev/null +++ b/cedar-lean/Cli/json-inputs/authorize/example4a.json @@ -0,0 +1,1344 @@ +{ + "request": { + "principal": { + "Known": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + }, + "action": { + "Known": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource": { + "Known": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "prototype_v0.jpg" + } + }, + "context": { + "expr_kind": { + "Record": { + "authenticated": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": null, + "data": null + } + } + }, + "source_info": null, + "data": null + } + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": { + "In": [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + ] + }, + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "device_prototypes" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "And": { + "left": { + "expr_kind": { + "BinaryApp": { + "op": "Eq", + "arg1": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "principal" + }, + "source_info": { + "start": 257, + "end": 266 + }, + "data": null + }, + "attr": "department" + } + }, + "source_info": { + "start": 257, + "end": 277 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "Lit": { + "String": "HardwareEngineering" + } + }, + "source_info": { + "start": 281, + "end": 302 + }, + "data": null + } + } + }, + "source_info": { + "start": 257, + "end": 302 + }, + "data": null + }, + "right": { + "expr_kind": { + "UnaryApp": { + "op": "Not", + "arg": { + "expr_kind": { + "BinaryApp": { + "op": "Less", + "arg1": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "principal" + }, + "source_info": { + "start": 306, + "end": 315 + }, + "data": null + }, + "attr": "jobLevel" + } + }, + "source_info": { + "start": 306, + "end": 324 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "Lit": { + "Long": 5 + } + }, + "source_info": { + "start": 328, + "end": 329 + }, + "data": null + } + } + }, + "source_info": { + "start": 306, + "end": 329 + }, + "data": null + } + } + }, + "source_info": { + "start": 306, + "end": 329 + }, + "data": null + } + } + }, + "source_info": { + "start": 257, + "end": 329 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "entities": { + "entities": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "device_prototypes" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "device_prototypes" + }, + "attrs": { + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + }, + "attrs": { + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "stacey" + } + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + "attrs": { + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 5 + } + }, + "source_info": null, + "data": null + }, + "department": { + "expr_kind": { + "Lit": { + "String": "HardwareEngineering" + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + }, + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "ahmad" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "ahmad" + }, + "attrs": { + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 4 + } + }, + "source_info": null, + "data": null + }, + "department": { + "expr_kind": { + "Lit": { + "String": "HardwareEngineering" + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + "attrs": { + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "ahmad" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "ahmad" + }, + "attrs": { + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "ahmad" + } + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + }, + "attrs": { + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "sales_projections.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "sales_projections.jpg" + }, + "attrs": { + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [ + { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "giuseppe" + } + } + }, + "source_info": null, + "data": null + } + ] + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + } + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "alice_w2.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "alice_w2.jpg" + }, + "attrs": { + "private": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + }, + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "stacey" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "stacey" + }, + "attrs": { + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 6 + } + }, + "source_info": null, + "data": null + }, + "department": { + "expr_kind": { + "Lit": { + "String": "Sales" + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "giuseppe" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "giuseppe" + }, + "attrs": { + "department": { + "expr_kind": { + "Lit": { + "String": "CustomerSupport" + } + }, + "source_info": null, + "data": null + }, + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 7 + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "prototype_v0.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "prototype_v0.jpg" + }, + "attrs": { + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "ahmad" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "device_prototypes" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "vacation.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "vacation.jpg" + }, + "attrs": { + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + }, + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "alice_vacation" + }, + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "alice_vacation" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "alice_vacation" + }, + "attrs": { + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + ] + } + ] + ] + } +} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/authorize/example4d.json b/cedar-lean/Cli/json-inputs/authorize/example4d.json new file mode 100644 index 000000000..133354dc5 --- /dev/null +++ b/cedar-lean/Cli/json-inputs/authorize/example4d.json @@ -0,0 +1,1285 @@ +{ + "request": { + "principal": { + "Known": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + }, + "action": { + "Known": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource": { + "Known": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "vacation.jpg" + } + }, + "context": { + "expr_kind": { + "Record": { + "authenticated": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": null, + "data": null + } + } + }, + "source_info": null, + "data": null + } + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": "Any", + "resource_constraint": { + "constraint": "Any" + }, + "non_head_constraints": { + "expr_kind": { + "And": { + "left": { + "expr_kind": { + "HasAttr": { + "expr": { + "expr_kind": { + "Var": "resource" + }, + "source_info": { + "start": 337, + "end": 345 + }, + "data": null + }, + "attr": "account" + } + }, + "source_info": { + "start": 337, + "end": 357 + }, + "data": null + }, + "right": { + "expr_kind": { + "BinaryApp": { + "op": "Eq", + "arg1": { + "expr_kind": { + "Var": "principal" + }, + "source_info": { + "start": 361, + "end": 370 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "resource" + }, + "source_info": { + "start": 374, + "end": 382 + }, + "data": null + }, + "attr": "account" + } + }, + "source_info": { + "start": 374, + "end": 396 + }, + "data": null + }, + "attr": "owner" + } + }, + "source_info": { + "start": 374, + "end": 396 + }, + "data": null + } + } + }, + "source_info": { + "start": 361, + "end": 396 + }, + "data": null + } + } + }, + "source_info": { + "start": 337, + "end": 396 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "entities": { + "entities": [ + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "ahmad" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "ahmad" + }, + "attrs": { + "department": { + "expr_kind": { + "Lit": { + "String": "HardwareEngineering" + } + }, + "source_info": null, + "data": null + }, + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 4 + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "stacey" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "stacey" + }, + "attrs": { + "department": { + "expr_kind": { + "Lit": { + "String": "Sales" + } + }, + "source_info": null, + "data": null + }, + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 6 + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "prototype_v0.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "prototype_v0.jpg" + }, + "attrs": { + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "ahmad" + } + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "device_prototypes" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + }, + "attrs": { + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + "attrs": { + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + }, + "attrs": { + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "stacey" + } + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + "attrs": { + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 5 + } + }, + "source_info": null, + "data": null + }, + "department": { + "expr_kind": { + "Lit": { + "String": "HardwareEngineering" + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + }, + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "giuseppe" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "giuseppe" + }, + "attrs": { + "department": { + "expr_kind": { + "Lit": { + "String": "CustomerSupport" + } + }, + "source_info": null, + "data": null + }, + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 7 + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "alice_w2.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "alice_w2.jpg" + }, + "attrs": { + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "sales_projections.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "sales_projections.jpg" + }, + "attrs": { + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [ + { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "giuseppe" + } + } + }, + "source_info": null, + "data": null + } + ] + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + } + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "ahmad" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "ahmad" + }, + "attrs": { + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "ahmad" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "device_prototypes" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "device_prototypes" + }, + "attrs": { + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "alice_vacation" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "alice_vacation" + }, + "attrs": { + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "vacation.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "vacation.jpg" + }, + "attrs": { + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "alice_vacation" + }, + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + ] + } + ] + ] + } +} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/authorize/example4e.json b/cedar-lean/Cli/json-inputs/authorize/example4e.json new file mode 100644 index 000000000..58b660690 --- /dev/null +++ b/cedar-lean/Cli/json-inputs/authorize/example4e.json @@ -0,0 +1,1286 @@ +{ + "request": { + "principal": { + "Known": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + }, + "action": { + "Known": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource": { + "Known": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "vacation.jpg" + } + }, + "context": { + "expr_kind": { + "Record": { + "authenticated": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": null, + "data": null + } + } + }, + "source_info": null, + "data": null + } + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": "Any" + }, + "non_head_constraints": { + "expr_kind": { + "BinaryApp": { + "op": "Eq", + "arg1": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "principal" + }, + "source_info": { + "start": 337, + "end": 346 + }, + "data": null + }, + "attr": "department" + } + }, + "source_info": { + "start": 337, + "end": 357 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "resource" + }, + "source_info": { + "start": 361, + "end": 369 + }, + "data": null + }, + "attr": "account" + } + }, + "source_info": { + "start": 361, + "end": 394 + }, + "data": null + }, + "attr": "owner" + } + }, + "source_info": { + "start": 361, + "end": 394 + }, + "data": null + }, + "attr": "department" + } + }, + "source_info": { + "start": 361, + "end": 394 + }, + "data": null + } + } + }, + "source_info": { + "start": 337, + "end": 394 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "entities": { + "entities": [ + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + }, + "attrs": { + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "stacey" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "stacey" + }, + "attrs": { + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 6 + } + }, + "source_info": null, + "data": null + }, + "department": { + "expr_kind": { + "Lit": { + "String": "Sales" + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "device_prototypes" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "device_prototypes" + }, + "attrs": { + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "prototype_v0.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "prototype_v0.jpg" + }, + "attrs": { + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "ahmad" + } + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "device_prototypes" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + "attrs": { + "department": { + "expr_kind": { + "Lit": { + "String": "HardwareEngineering" + } + }, + "source_info": null, + "data": null + }, + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 5 + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + }, + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "alice_vacation" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "alice_vacation" + }, + "attrs": { + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + "attrs": { + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "ahmad" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "ahmad" + }, + "attrs": { + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 4 + } + }, + "source_info": null, + "data": null + }, + "department": { + "expr_kind": { + "Lit": { + "String": "HardwareEngineering" + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "vacation.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "vacation.jpg" + }, + "attrs": { + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + }, + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "alice_vacation" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "ahmad" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "ahmad" + }, + "attrs": { + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "ahmad" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "alice_w2.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "alice_w2.jpg" + }, + "attrs": { + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + }, + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "giuseppe" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "giuseppe" + }, + "attrs": { + "department": { + "expr_kind": { + "Lit": { + "String": "CustomerSupport" + } + }, + "source_info": null, + "data": null + }, + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 7 + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "sales_projections.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "sales_projections.jpg" + }, + "attrs": { + "admins": { + "expr_kind": { + "Set": [ + { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "giuseppe" + } + } + }, + "source_info": null, + "data": null + } + ] + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + }, + "attrs": { + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "stacey" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "attrs": {}, + "ancestors": [] + } + ] + ] + } +} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/authorize/example4f.json b/cedar-lean/Cli/json-inputs/authorize/example4f.json new file mode 100644 index 000000000..5d420aa4d --- /dev/null +++ b/cedar-lean/Cli/json-inputs/authorize/example4f.json @@ -0,0 +1,1340 @@ +{ + "request": { + "principal": { + "Known": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + }, + "action": { + "Known": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource": { + "Known": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "vacation.jpg" + } + }, + "context": { + "expr_kind": { + "Record": { + "authenticated": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": null, + "data": null + } + } + }, + "source_info": null, + "data": null + } + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": "Any", + "resource_constraint": { + "constraint": "Any" + }, + "non_head_constraints": { + "expr_kind": { + "Or": { + "left": { + "expr_kind": { + "And": { + "left": { + "expr_kind": { + "HasAttr": { + "expr": { + "expr_kind": { + "Var": "resource" + }, + "source_info": { + "start": 364, + "end": 372 + }, + "data": null + }, + "attr": "account" + } + }, + "source_info": { + "start": 364, + "end": 384 + }, + "data": null + }, + "right": { + "expr_kind": { + "BinaryApp": { + "op": "Eq", + "arg1": { + "expr_kind": { + "Var": "principal" + }, + "source_info": { + "start": 388, + "end": 397 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "resource" + }, + "source_info": { + "start": 401, + "end": 409 + }, + "data": null + }, + "attr": "account" + } + }, + "source_info": { + "start": 401, + "end": 423 + }, + "data": null + }, + "attr": "owner" + } + }, + "source_info": { + "start": 401, + "end": 423 + }, + "data": null + } + } + }, + "source_info": { + "start": 388, + "end": 423 + }, + "data": null + } + } + }, + "source_info": { + "start": 364, + "end": 423 + }, + "data": null + }, + "right": { + "expr_kind": { + "BinaryApp": { + "op": "Contains", + "arg1": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "resource" + }, + "source_info": { + "start": 430, + "end": 438 + }, + "data": null + }, + "attr": "admins" + } + }, + "source_info": { + "start": 430, + "end": 465 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "Var": "principal" + }, + "source_info": { + "start": 455, + "end": 464 + }, + "data": null + } + } + }, + "source_info": { + "start": 430, + "end": 465 + }, + "data": null + } + } + }, + "source_info": { + "start": 363, + "end": 465 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "entities": { + "entities": [ + [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "sales_projections.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "sales_projections.jpg" + }, + "attrs": { + "admins": { + "expr_kind": { + "Set": [ + { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "giuseppe" + } + } + }, + "source_info": null, + "data": null + } + ] + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "alice_w2.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "alice_w2.jpg" + }, + "attrs": { + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "ahmad" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "ahmad" + }, + "attrs": { + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 4 + } + }, + "source_info": null, + "data": null + }, + "department": { + "expr_kind": { + "Lit": { + "String": "HardwareEngineering" + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + "attrs": { + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 5 + } + }, + "source_info": null, + "data": null + }, + "department": { + "expr_kind": { + "Lit": { + "String": "HardwareEngineering" + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + }, + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "alice_vacation" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "alice_vacation" + }, + "attrs": { + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + }, + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + "attrs": { + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "vacation.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "vacation.jpg" + }, + "attrs": { + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + }, + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "alice_vacation" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + }, + "attrs": { + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "stacey" + } + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "stacey" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "stacey" + }, + "attrs": { + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 6 + } + }, + "source_info": null, + "data": null + }, + "department": { + "expr_kind": { + "Lit": { + "String": "Sales" + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "giuseppe" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "giuseppe" + }, + "attrs": { + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 7 + } + }, + "source_info": null, + "data": null + }, + "department": { + "expr_kind": { + "Lit": { + "String": "CustomerSupport" + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "prototype_v0.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "prototype_v0.jpg" + }, + "attrs": { + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "ahmad" + } + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "device_prototypes" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + }, + "attrs": { + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "device_prototypes" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "device_prototypes" + }, + "attrs": { + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "ahmad" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "ahmad" + }, + "attrs": { + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "ahmad" + } + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + } + ] + } + ] + ] + } +} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/authorize/example5b.json b/cedar-lean/Cli/json-inputs/authorize/example5b.json new file mode 100644 index 000000000..a56102eea --- /dev/null +++ b/cedar-lean/Cli/json-inputs/authorize/example5b.json @@ -0,0 +1,1585 @@ +{ + "request": { + "principal": { + "Known": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "ahmad" + } + }, + "action": { + "Known": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + } + }, + "resource": { + "Known": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "alice_vacation" + } + }, + "context": { + "expr_kind": { + "Record": { + "authenticated": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": null, + "data": null + }, + "photo": { + "expr_kind": { + "Record": { + "filesize_mb": { + "expr_kind": { + "Lit": { + "Long": 1 + } + }, + "source_info": null, + "data": null + }, + "filetype": { + "expr_kind": { + "Lit": { + "String": "PNG" + } + }, + "source_info": null, + "data": null + } + } + }, + "source_info": null, + "data": null + } + } + }, + "source_info": null, + "data": null + } + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + } + }, + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Or": { + "left": { + "expr_kind": { + "And": { + "left": { + "expr_kind": { + "BinaryApp": { + "op": "Contains", + "arg1": { + "expr_kind": { + "Set": [ + { + "expr_kind": { + "Lit": { + "String": "JPEG" + } + }, + "source_info": { + "start": 322, + "end": 328 + }, + "data": null + }, + { + "expr_kind": { + "Lit": { + "String": "PNG" + } + }, + "source_info": { + "start": 330, + "end": 335 + }, + "data": null + } + ] + }, + "source_info": { + "start": 321, + "end": 336 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 346, + "end": 353 + }, + "data": null + }, + "attr": "photo" + } + }, + "source_info": { + "start": 346, + "end": 368 + }, + "data": null + }, + "attr": "filetype" + } + }, + "source_info": { + "start": 346, + "end": 368 + }, + "data": null + } + } + }, + "source_info": { + "start": 321, + "end": 369 + }, + "data": null + }, + "right": { + "expr_kind": { + "BinaryApp": { + "op": "LessEq", + "arg1": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 376, + "end": 383 + }, + "data": null + }, + "attr": "photo" + } + }, + "source_info": { + "start": 376, + "end": 401 + }, + "data": null + }, + "attr": "filesize_mb" + } + }, + "source_info": { + "start": 376, + "end": 401 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "Lit": { + "Long": 1 + } + }, + "source_info": { + "start": 405, + "end": 406 + }, + "data": null + } + } + }, + "source_info": { + "start": 376, + "end": 406 + }, + "data": null + } + } + }, + "source_info": { + "start": 321, + "end": 406 + }, + "data": null + }, + "right": { + "expr_kind": { + "And": { + "left": { + "expr_kind": { + "And": { + "left": { + "expr_kind": { + "BinaryApp": { + "op": "Eq", + "arg1": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 414, + "end": 421 + }, + "data": null + }, + "attr": "photo" + } + }, + "source_info": { + "start": 414, + "end": 436 + }, + "data": null + }, + "attr": "filetype" + } + }, + "source_info": { + "start": 414, + "end": 436 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "Lit": { + "String": "RAW" + } + }, + "source_info": { + "start": 440, + "end": 445 + }, + "data": null + } + } + }, + "source_info": { + "start": 414, + "end": 445 + }, + "data": null + }, + "right": { + "expr_kind": { + "BinaryApp": { + "op": "LessEq", + "arg1": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 452, + "end": 459 + }, + "data": null + }, + "attr": "photo" + } + }, + "source_info": { + "start": 452, + "end": 477 + }, + "data": null + }, + "attr": "filesize_mb" + } + }, + "source_info": { + "start": 452, + "end": 477 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "Lit": { + "Long": 100 + } + }, + "source_info": { + "start": 481, + "end": 484 + }, + "data": null + } + } + }, + "source_info": { + "start": 452, + "end": 484 + }, + "data": null + } + } + }, + "source_info": { + "start": 414, + "end": 523 + }, + "data": null + }, + "right": { + "expr_kind": { + "BinaryApp": { + "op": "In", + "arg1": { + "expr_kind": { + "Var": "principal" + }, + "source_info": { + "start": 491, + "end": 500 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + } + } + }, + "source_info": { + "start": 504, + "end": 523 + }, + "data": null + } + } + }, + "source_info": { + "start": 491, + "end": 523 + }, + "data": null + } + } + }, + "source_info": { + "start": 414, + "end": 523 + }, + "data": null + } + } + }, + "source_info": { + "start": 320, + "end": 524 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "entities": { + "entities": [ + [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "giuseppe" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "giuseppe" + }, + "attrs": { + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 7 + } + }, + "source_info": null, + "data": null + }, + "department": { + "expr_kind": { + "Lit": { + "String": "CustomerSupport" + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "vacation.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "vacation.jpg" + }, + "attrs": { + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "alice_vacation" + }, + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + }, + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "ahmad" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "ahmad" + }, + "attrs": { + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "ahmad" + } + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + "attrs": { + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 5 + } + }, + "source_info": null, + "data": null + }, + "department": { + "expr_kind": { + "Lit": { + "String": "HardwareEngineering" + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + }, + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + }, + "attrs": { + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "stacey" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "alice_vacation" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "alice_vacation" + }, + "attrs": { + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + }, + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + "attrs": { + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "device_prototypes" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "device_prototypes" + }, + "attrs": { + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "stacey" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "stacey" + }, + "attrs": { + "department": { + "expr_kind": { + "Lit": { + "String": "Sales" + } + }, + "source_info": null, + "data": null + }, + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 6 + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "ahmad" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "ahmad" + }, + "attrs": { + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 4 + } + }, + "source_info": null, + "data": null + }, + "department": { + "expr_kind": { + "Lit": { + "String": "HardwareEngineering" + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "prototype_v0.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "prototype_v0.jpg" + }, + "attrs": { + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "ahmad" + } + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "device_prototypes" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "sales_projections.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "sales_projections.jpg" + }, + "attrs": { + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [ + { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "giuseppe" + } + } + }, + "source_info": null, + "data": null + } + ] + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + } + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + }, + "attrs": { + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "alice_w2.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "alice_w2.jpg" + }, + "attrs": { + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + }, + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "attrs": {}, + "ancestors": [] + } + ] + ] + } +} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/authorize/ip1.json b/cedar-lean/Cli/json-inputs/authorize/ip1.json new file mode 100644 index 000000000..44ff6b6ba --- /dev/null +++ b/cedar-lean/Cli/json-inputs/authorize/ip1.json @@ -0,0 +1,756 @@ +{ + "request": { + "principal": { + "Known": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + }, + "action": { + "Known": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource": { + "Known": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + } + }, + "context": { + "expr_kind": { + "Record": { + "authenticated": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": null, + "data": null + }, + "confidence_score": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "decimal", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "0.6" + } + }, + "source_info": null, + "data": null + } + ] + } + }, + "source_info": null, + "data": null + }, + "source_ip": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "ip", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "222.222.222.222" + } + }, + "source_info": null, + "data": null + } + ] + } + }, + "source_info": null, + "data": null + } + } + }, + "source_info": null, + "data": null + } + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "BinaryApp": { + "op": "Eq", + "arg1": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 102, + "end": 109 + }, + "data": null + }, + "attr": "source_ip" + } + }, + "source_info": { + "start": 102, + "end": 119 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "ip", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "222.222.222.222" + } + }, + "source_info": { + "start": 126, + "end": 143 + }, + "data": null + } + ] + } + }, + "source_info": { + "start": 123, + "end": 144 + }, + "data": null + } + } + }, + "source_info": { + "start": 102, + "end": 144 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "entities": { + "entities": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "passportscan.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "passportscan.jpg" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Video", + "path": [] + } + }, + "eid": "surf.mp4" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Video", + "path": [] + } + }, + "eid": "surf.mp4" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "selfie.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "selfie.jpg" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Administrator", + "path": [] + } + }, + "eid": "ahmad" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Administrator", + "path": [] + } + }, + "eid": "ahmad" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "tim" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "tim" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "bob" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "bob" + }, + "attrs": {}, + "ancestors": [] + } + ] + ] + } +} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/authorize/ip2.json b/cedar-lean/Cli/json-inputs/authorize/ip2.json new file mode 100644 index 000000000..e043e4d51 --- /dev/null +++ b/cedar-lean/Cli/json-inputs/authorize/ip2.json @@ -0,0 +1,806 @@ +{ + "request": { + "principal": { + "Known": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + }, + "action": { + "Known": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource": { + "Known": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + } + }, + "context": { + "expr_kind": { + "Record": { + "authenticated": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": null, + "data": null + }, + "confidence_score": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "decimal", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "0.6" + } + }, + "source_info": null, + "data": null + } + ] + } + }, + "source_info": null, + "data": null + }, + "source_ip": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "ip", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "222.222.222.222" + } + }, + "source_info": null, + "data": null + } + ] + } + }, + "source_info": null, + "data": null + } + } + }, + "source_info": null, + "data": null + } + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "And": { + "left": { + "expr_kind": { + "UnaryApp": { + "op": "Not", + "arg": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "isLoopback", + "path": [] + }, + "args": [ + { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 104, + "end": 111 + }, + "data": null + }, + "attr": "source_ip" + } + }, + "source_info": { + "start": 104, + "end": 134 + }, + "data": null + } + ] + } + }, + "source_info": { + "start": 104, + "end": 134 + }, + "data": null + } + } + }, + "source_info": { + "start": 102, + "end": 135 + }, + "data": null + }, + "right": { + "expr_kind": { + "UnaryApp": { + "op": "Not", + "arg": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "isMulticast", + "path": [] + }, + "args": [ + { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 141, + "end": 148 + }, + "data": null + }, + "attr": "source_ip" + } + }, + "source_info": { + "start": 141, + "end": 172 + }, + "data": null + } + ] + } + }, + "source_info": { + "start": 141, + "end": 172 + }, + "data": null + } + } + }, + "source_info": { + "start": 139, + "end": 173 + }, + "data": null + } + } + }, + "source_info": { + "start": 102, + "end": 173 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "entities": { + "entities": [ + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "passportscan.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "passportscan.jpg" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "bob" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "bob" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Video", + "path": [] + } + }, + "eid": "surf.mp4" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Video", + "path": [] + } + }, + "eid": "surf.mp4" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Administrator", + "path": [] + } + }, + "eid": "ahmad" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Administrator", + "path": [] + } + }, + "eid": "ahmad" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "selfie.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "selfie.jpg" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "tim" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "tim" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + } + ] + } + ] + ] + } +} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/authorize/ip3.json b/cedar-lean/Cli/json-inputs/authorize/ip3.json new file mode 100644 index 000000000..312b6af05 --- /dev/null +++ b/cedar-lean/Cli/json-inputs/authorize/ip3.json @@ -0,0 +1,761 @@ +{ + "request": { + "principal": { + "Known": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + }, + "action": { + "Known": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource": { + "Known": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + } + }, + "context": { + "expr_kind": { + "Record": { + "authenticated": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": null, + "data": null + }, + "confidence_score": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "decimal", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "0.6" + } + }, + "source_info": null, + "data": null + } + ] + } + }, + "source_info": null, + "data": null + }, + "source_ip": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "ip", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "222.222.222.222" + } + }, + "source_info": null, + "data": null + } + ] + } + }, + "source_info": null, + "data": null + } + } + }, + "source_info": null, + "data": null + } + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "isInRange", + "path": [] + }, + "args": [ + { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 102, + "end": 109 + }, + "data": null + }, + "attr": "source_ip" + } + }, + "source_info": { + "start": 102, + "end": 153 + }, + "data": null + }, + { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "ip", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "222.222.222.0/24" + } + }, + "source_info": { + "start": 133, + "end": 151 + }, + "data": null + } + ] + } + }, + "source_info": { + "start": 130, + "end": 152 + }, + "data": null + } + ] + } + }, + "source_info": { + "start": 102, + "end": 153 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "entities": { + "entities": [ + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "selfie.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "selfie.jpg" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Video", + "path": [] + } + }, + "eid": "surf.mp4" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Video", + "path": [] + } + }, + "eid": "surf.mp4" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "tim" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "tim" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Administrator", + "path": [] + } + }, + "eid": "ahmad" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Administrator", + "path": [] + } + }, + "eid": "ahmad" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "passportscan.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "passportscan.jpg" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "bob" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "bob" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + }, + "attrs": {}, + "ancestors": [] + } + ] + ] + } +} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/authorize/multi1.json b/cedar-lean/Cli/json-inputs/authorize/multi1.json new file mode 100644 index 000000000..85e04533d --- /dev/null +++ b/cedar-lean/Cli/json-inputs/authorize/multi1.json @@ -0,0 +1,791 @@ +{ + "request": { + "principal": { + "Known": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + }, + "action": { + "Known": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource": { + "Known": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + } + }, + "context": { + "expr_kind": { + "Record": { + "authenticated": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": null, + "data": null + }, + "confidence_score": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "decimal", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "0.6" + } + }, + "source_info": null, + "data": null + } + ] + } + }, + "source_info": null, + "data": null + }, + "source_ip": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "ip", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "123.123.123.123" + } + }, + "source_info": null, + "data": null + } + ] + } + }, + "source_info": null, + "data": null + } + } + }, + "source_info": null, + "data": null + } + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + } + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 96, + "end": 202 + }, + "data": null + } + }, + "policy1": { + "id": "policy1", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "bob" + } + } + } + }, + "action_constraint": { + "In": [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + } + ] + }, + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 204, + "end": 318 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + }, + "policy1": { + "template_id": "policy1", + "link_id": null, + "values": {} + } + } + }, + "entities": { + "entities": [ + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "bob" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "bob" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + }, + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "selfie.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "selfie.jpg" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Administrator", + "path": [] + } + }, + "eid": "ahmad" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Administrator", + "path": [] + } + }, + "eid": "ahmad" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Video", + "path": [] + } + }, + "eid": "surf.mp4" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Video", + "path": [] + } + }, + "eid": "surf.mp4" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "tim" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "tim" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "passportscan.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "passportscan.jpg" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ] + ] + } +} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/authorize/multi2.json b/cedar-lean/Cli/json-inputs/authorize/multi2.json new file mode 100644 index 000000000..7975f870d --- /dev/null +++ b/cedar-lean/Cli/json-inputs/authorize/multi2.json @@ -0,0 +1,768 @@ +{ + "request": { + "principal": { + "Known": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + }, + "action": { + "Known": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource": { + "Known": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + } + }, + "context": { + "expr_kind": { + "Record": { + "authenticated": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": null, + "data": null + }, + "confidence_score": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "decimal", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "0.6" + } + }, + "source_info": null, + "data": null + } + ] + } + }, + "source_info": null, + "data": null + }, + "source_ip": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "ip", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "123.123.123.123" + } + }, + "source_info": null, + "data": null + } + ] + } + }, + "source_info": null, + "data": null + } + } + }, + "source_info": null, + "data": null + } + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 121, + "end": 210 + }, + "data": null + } + }, + "policy1": { + "id": "policy1", + "annotations": {}, + "effect": "forbid", + "principal_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "bob" + } + } + } + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 226, + "end": 330 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + }, + "policy1": { + "template_id": "policy1", + "link_id": null, + "values": {} + } + } + }, + "entities": { + "entities": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "selfie.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "selfie.jpg" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "passportscan.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "passportscan.jpg" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "tim" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "tim" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Video", + "path": [] + } + }, + "eid": "surf.mp4" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Video", + "path": [] + } + }, + "eid": "surf.mp4" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "bob" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "bob" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Administrator", + "path": [] + } + }, + "eid": "ahmad" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Administrator", + "path": [] + } + }, + "eid": "ahmad" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "attrs": {}, + "ancestors": [] + } + ] + ] + } +} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/authorize/multi3.json b/cedar-lean/Cli/json-inputs/authorize/multi3.json new file mode 100644 index 000000000..d23d9b8e4 --- /dev/null +++ b/cedar-lean/Cli/json-inputs/authorize/multi3.json @@ -0,0 +1,1439 @@ +{ + "request": { + "principal": { + "Known": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + }, + "action": { + "Known": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource": { + "Known": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "vacation.jpg" + } + }, + "context": { + "expr_kind": { + "Record": { + "authenticated": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": null, + "data": null + }, + "confidence_score": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "decimal", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "0.6" + } + }, + "source_info": null, + "data": null + } + ] + } + }, + "source_info": null, + "data": null + }, + "source_ip": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "ip", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "123.123.123.123" + } + }, + "source_info": null, + "data": null + } + ] + } + }, + "source_info": null, + "data": null + } + } + }, + "source_info": null, + "data": null + } + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + } + } + } + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 145, + "end": 258 + }, + "data": null + } + }, + "policy1": { + "id": "policy1", + "annotations": {}, + "effect": "forbid", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": "Any", + "resource_constraint": { + "constraint": "Any" + }, + "non_head_constraints": { + "expr_kind": { + "And": { + "left": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "resource" + }, + "source_info": { + "start": 398, + "end": 406 + }, + "data": null + }, + "attr": "private" + } + }, + "source_info": { + "start": 398, + "end": 414 + }, + "data": null + }, + "right": { + "expr_kind": { + "UnaryApp": { + "op": "Not", + "arg": { + "expr_kind": { + "And": { + "left": { + "expr_kind": { + "HasAttr": { + "expr": { + "expr_kind": { + "Var": "resource" + }, + "source_info": { + "start": 426, + "end": 434 + }, + "data": null + }, + "attr": "account" + } + }, + "source_info": { + "start": 426, + "end": 446 + }, + "data": null + }, + "right": { + "expr_kind": { + "BinaryApp": { + "op": "Eq", + "arg1": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "resource" + }, + "source_info": { + "start": 450, + "end": 458 + }, + "data": null + }, + "attr": "account" + } + }, + "source_info": { + "start": 450, + "end": 472 + }, + "data": null + }, + "attr": "owner" + } + }, + "source_info": { + "start": 450, + "end": 472 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "Var": "principal" + }, + "source_info": { + "start": 476, + "end": 485 + }, + "data": null + } + } + }, + "source_info": { + "start": 450, + "end": 485 + }, + "data": null + } + } + }, + "source_info": { + "start": 426, + "end": 485 + }, + "data": null + } + } + }, + "source_info": { + "start": 417, + "end": 487 + }, + "data": null + } + } + }, + "source_info": { + "start": 354, + "end": 488 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + }, + "policy1": { + "template_id": "policy1", + "link_id": null, + "values": {} + } + } + }, + "entities": { + "entities": [ + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + }, + "attrs": { + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "stacey" + } + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "giuseppe" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "giuseppe" + }, + "attrs": { + "department": { + "expr_kind": { + "Lit": { + "String": "CustomerSupport" + } + }, + "source_info": null, + "data": null + }, + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 7 + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "alice_w2.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "alice_w2.jpg" + }, + "attrs": { + "private": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + "attrs": { + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "stacey" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "stacey" + }, + "attrs": { + "department": { + "expr_kind": { + "Lit": { + "String": "Sales" + } + }, + "source_info": null, + "data": null + }, + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 6 + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "device_prototypes" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "device_prototypes" + }, + "attrs": { + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "prototype_v0.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "prototype_v0.jpg" + }, + "attrs": { + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "ahmad" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "device_prototypes" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + "attrs": { + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 5 + } + }, + "source_info": null, + "data": null + }, + "department": { + "expr_kind": { + "Lit": { + "String": "HardwareEngineering" + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + }, + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "vacation.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "vacation.jpg" + }, + "attrs": { + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + }, + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "alice_vacation" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "alice_vacation" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "alice_vacation" + }, + "attrs": { + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "ahmad" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "ahmad" + }, + "attrs": { + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "ahmad" + } + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "ahmad" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "ahmad" + }, + "attrs": { + "department": { + "expr_kind": { + "Lit": { + "String": "HardwareEngineering" + } + }, + "source_info": null, + "data": null + }, + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 4 + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "sales_projections.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "sales_projections.jpg" + }, + "attrs": { + "admins": { + "expr_kind": { + "Set": [ + { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "giuseppe" + } + } + }, + "source_info": null, + "data": null + } + ] + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + }, + "attrs": { + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + } + ] + } + ] + ] + } +} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/authorize/multi4.json b/cedar-lean/Cli/json-inputs/authorize/multi4.json new file mode 100644 index 000000000..127d60bfd --- /dev/null +++ b/cedar-lean/Cli/json-inputs/authorize/multi4.json @@ -0,0 +1,1519 @@ +{ + "request": { + "principal": { + "Known": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "stacey" + } + }, + "action": { + "Known": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource": { + "Known": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "vacation.jpg" + } + }, + "context": { + "expr_kind": { + "Record": { + "authenticated": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": null, + "data": null + } + } + }, + "source_info": null, + "data": null + } + }, + "policies": { + "templates": { + "policy3": { + "id": "policy3", + "annotations": {}, + "effect": "forbid", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": "Any", + "resource_constraint": { + "constraint": "Any" + }, + "non_head_constraints": { + "expr_kind": { + "UnaryApp": { + "op": "Not", + "arg": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 751, + "end": 758 + }, + "data": null + }, + "attr": "authenticated" + } + }, + "source_info": { + "start": 751, + "end": 772 + }, + "data": null + } + } + }, + "source_info": { + "start": 750, + "end": 772 + }, + "data": null + } + }, + "policy1": { + "id": "policy1", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": "Any", + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "alice_vacation" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "BinaryApp": { + "op": "Eq", + "arg1": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "principal" + }, + "source_info": { + "start": 401, + "end": 410 + }, + "data": null + }, + "attr": "department" + } + }, + "source_info": { + "start": 401, + "end": 421 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "Lit": { + "String": "Sales" + } + }, + "source_info": { + "start": 425, + "end": 432 + }, + "data": null + } + } + }, + "source_info": { + "start": 401, + "end": 432 + }, + "data": null + } + }, + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + } + } + } + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 140, + "end": 253 + }, + "data": null + } + }, + "policy2": { + "id": "policy2", + "annotations": {}, + "effect": "forbid", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": "Any", + "resource_constraint": { + "constraint": "Any" + }, + "non_head_constraints": { + "expr_kind": { + "And": { + "left": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "resource" + }, + "source_info": { + "start": 548, + "end": 556 + }, + "data": null + }, + "attr": "private" + } + }, + "source_info": { + "start": 548, + "end": 564 + }, + "data": null + }, + "right": { + "expr_kind": { + "UnaryApp": { + "op": "Not", + "arg": { + "expr_kind": { + "And": { + "left": { + "expr_kind": { + "HasAttr": { + "expr": { + "expr_kind": { + "Var": "resource" + }, + "source_info": { + "start": 576, + "end": 584 + }, + "data": null + }, + "attr": "account" + } + }, + "source_info": { + "start": 576, + "end": 596 + }, + "data": null + }, + "right": { + "expr_kind": { + "BinaryApp": { + "op": "Eq", + "arg1": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "resource" + }, + "source_info": { + "start": 600, + "end": 608 + }, + "data": null + }, + "attr": "account" + } + }, + "source_info": { + "start": 600, + "end": 622 + }, + "data": null + }, + "attr": "owner" + } + }, + "source_info": { + "start": 600, + "end": 622 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "Var": "principal" + }, + "source_info": { + "start": 626, + "end": 635 + }, + "data": null + } + } + }, + "source_info": { + "start": 600, + "end": 635 + }, + "data": null + } + } + }, + "source_info": { + "start": 576, + "end": 635 + }, + "data": null + } + } + }, + "source_info": { + "start": 567, + "end": 637 + }, + "data": null + } + } + }, + "source_info": { + "start": 504, + "end": 638 + }, + "data": null + } + } + }, + "links": { + "policy1": { + "template_id": "policy1", + "link_id": null, + "values": {} + }, + "policy2": { + "template_id": "policy2", + "link_id": null, + "values": {} + }, + "policy3": { + "template_id": "policy3", + "link_id": null, + "values": {} + }, + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "entities": { + "entities": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + "attrs": { + "department": { + "expr_kind": { + "Lit": { + "String": "HardwareEngineering" + } + }, + "source_info": null, + "data": null + }, + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 5 + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + }, + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "vacation.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "vacation.jpg" + }, + "attrs": { + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "alice_vacation" + }, + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "ahmad" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "ahmad" + }, + "attrs": { + "department": { + "expr_kind": { + "Lit": { + "String": "HardwareEngineering" + } + }, + "source_info": null, + "data": null + }, + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 4 + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "sales_projections.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "sales_projections.jpg" + }, + "attrs": { + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [ + { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "giuseppe" + } + } + }, + "source_info": null, + "data": null + } + ] + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "ahmad" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "ahmad" + }, + "attrs": { + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "ahmad" + } + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + }, + "attrs": { + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "stacey" + } + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "stacey" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "stacey" + }, + "attrs": { + "department": { + "expr_kind": { + "Lit": { + "String": "Sales" + } + }, + "source_info": null, + "data": null + }, + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 6 + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "prototype_v0.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "prototype_v0.jpg" + }, + "attrs": { + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "ahmad" + } + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "device_prototypes" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "device_prototypes" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "device_prototypes" + }, + "attrs": { + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "giuseppe" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "giuseppe" + }, + "attrs": { + "department": { + "expr_kind": { + "Lit": { + "String": "CustomerSupport" + } + }, + "source_info": null, + "data": null + }, + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 7 + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "alice_vacation" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "alice_vacation" + }, + "attrs": { + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + }, + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + }, + "attrs": { + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + "attrs": { + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "alice_w2.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "alice_w2.jpg" + }, + "attrs": { + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "attrs": {}, + "ancestors": [] + } + ] + ] + } +} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/validate/decimal1.json b/cedar-lean/Cli/json-inputs/validate/decimal1.json new file mode 100644 index 000000000..607ff0440 --- /dev/null +++ b/cedar-lean/Cli/json-inputs/validate/decimal1.json @@ -0,0 +1,883 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": { + "account": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "Account", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": { + "account": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "Account", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": { + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "owner": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [ + { + "id": "Account", + "path": [] + }, + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": { + "owner": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": { + "department": { + "attrType": { + "Primitive": { + "primitiveType": "String" + } + }, + "isRequired": true + }, + "jobLevel": { + "attrType": { + "Primitive": { + "primitiveType": "Long" + } + }, + "isRequired": true + } + } + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "photo": { + "attrType": { + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "filesize_mb": { + "attrType": { + "Primitive": { + "primitiveType": "Long" + } + }, + "isRequired": true + }, + "filetype": { + "attrType": { + "Primitive": { + "primitiveType": "String" + } + }, + "isRequired": true + } + } + }, + "open_attributes": "ClosedAttributes" + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "greaterThan", + "path": [] + }, + "args": [ + { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 102, + "end": 109 + }, + "data": null + }, + "attr": "confidence_score" + } + }, + "source_info": { + "start": 102, + "end": 155 + }, + "data": null + }, + { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "decimal", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "0.75" + } + }, + "source_info": { + "start": 147, + "end": 153 + }, + "data": null + } + ] + } + }, + "source_info": { + "start": 139, + "end": 154 + }, + "data": null + } + ] + } + }, + "source_info": { + "start": 102, + "end": 155 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/validate/decimal2.json b/cedar-lean/Cli/json-inputs/validate/decimal2.json new file mode 100644 index 000000000..628ab2a0c --- /dev/null +++ b/cedar-lean/Cli/json-inputs/validate/decimal2.json @@ -0,0 +1,962 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Album", + "path": [] + } + ], + "attributes": { + "attrs": { + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "owner": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": { + "department": { + "attrType": { + "Primitive": { + "primitiveType": "String" + } + }, + "isRequired": true + }, + "jobLevel": { + "attrType": { + "Primitive": { + "primitiveType": "Long" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": { + "account": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "Account", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + }, + { + "id": "Account", + "path": [] + } + ], + "attributes": { + "attrs": { + "owner": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": { + "account": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "Account", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "photo": { + "attrType": { + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "filesize_mb": { + "attrType": { + "Primitive": { + "primitiveType": "Long" + } + }, + "isRequired": true + }, + "filetype": { + "attrType": { + "Primitive": { + "primitiveType": "String" + } + }, + "isRequired": true + } + } + }, + "open_attributes": "ClosedAttributes" + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "And": { + "left": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "greaterThanOrEqual", + "path": [] + }, + "args": [ + { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 104, + "end": 111 + }, + "data": null + }, + "attr": "confidence_score" + } + }, + "source_info": { + "start": 104, + "end": 163 + }, + "data": null + }, + { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "decimal", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "0.4" + } + }, + "source_info": { + "start": 156, + "end": 161 + }, + "data": null + } + ] + } + }, + "source_info": { + "start": 148, + "end": 162 + }, + "data": null + } + ] + } + }, + "source_info": { + "start": 104, + "end": 163 + }, + "data": null + }, + "right": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "lessThanOrEqual", + "path": [] + }, + "args": [ + { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 169, + "end": 176 + }, + "data": null + }, + "attr": "confidence_score" + } + }, + "source_info": { + "start": 169, + "end": 225 + }, + "data": null + }, + { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "decimal", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "0.5" + } + }, + "source_info": { + "start": 218, + "end": 223 + }, + "data": null + } + ] + } + }, + "source_info": { + "start": 210, + "end": 224 + }, + "data": null + } + ] + } + }, + "source_info": { + "start": 169, + "end": 225 + }, + "data": null + } + } + }, + "source_info": { + "start": 104, + "end": 225 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/validate/example1a.json b/cedar-lean/Cli/json-inputs/validate/example1a.json new file mode 100644 index 000000000..490192515 --- /dev/null +++ b/cedar-lean/Cli/json-inputs/validate/example1a.json @@ -0,0 +1,802 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Video", + "path": [] + }, + { + "id": "Album", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Video", + "path": [] + }, + { + "name": { + "id": "Video", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Video", + "path": [] + }, + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "Administrator", + "path": [] + } + }, + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Video", + "path": [] + } + }, + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + } + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 56, + "end": 168 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/validate/example2a.json b/cedar-lean/Cli/json-inputs/validate/example2a.json new file mode 100644 index 000000000..4a3344580 --- /dev/null +++ b/cedar-lean/Cli/json-inputs/validate/example2a.json @@ -0,0 +1,802 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Album", + "path": [] + }, + { + "id": "Video", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Video", + "path": [] + }, + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Video", + "path": [] + }, + { + "name": { + "id": "Video", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "Administrator", + "path": [] + } + }, + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + }, + { + "Specified": { + "id": "Video", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + } + } + } + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 63, + "end": 187 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/validate/example2b.json b/cedar-lean/Cli/json-inputs/validate/example2b.json new file mode 100644 index 000000000..bc1272881 --- /dev/null +++ b/cedar-lean/Cli/json-inputs/validate/example2b.json @@ -0,0 +1,802 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Video", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Album", + "path": [] + }, + { + "id": "Video", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Video", + "path": [] + }, + { + "name": { + "id": "Video", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + }, + { + "Specified": { + "id": "Administrator", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Video", + "path": [] + } + }, + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + } + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 68, + "end": 174 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/validate/example2c.json b/cedar-lean/Cli/json-inputs/validate/example2c.json new file mode 100644 index 000000000..2143a969e --- /dev/null +++ b/cedar-lean/Cli/json-inputs/validate/example2c.json @@ -0,0 +1,822 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Video", + "path": [] + }, + { + "id": "Photo", + "path": [] + }, + { + "id": "Album", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Video", + "path": [] + }, + { + "name": { + "id": "Video", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + }, + { + "id": "Video", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + }, + { + "Specified": { + "id": "Administrator", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + }, + { + "Specified": { + "id": "Video", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + } + }, + "action_constraint": { + "In": [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + } + ] + }, + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 89, + "end": 232 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/validate/example3a.json b/cedar-lean/Cli/json-inputs/validate/example3a.json new file mode 100644 index 000000000..347c97905 --- /dev/null +++ b/cedar-lean/Cli/json-inputs/validate/example3a.json @@ -0,0 +1,790 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Video", + "path": [] + }, + { + "name": { + "id": "Video", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Video", + "path": [] + }, + { + "id": "Album", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Video", + "path": [] + }, + { + "id": "Album", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + }, + { + "Specified": { + "id": "Administrator", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + }, + { + "Specified": { + "id": "Video", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 63, + "end": 152 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/validate/example3b.json b/cedar-lean/Cli/json-inputs/validate/example3b.json new file mode 100644 index 000000000..0aa07de3f --- /dev/null +++ b/cedar-lean/Cli/json-inputs/validate/example3b.json @@ -0,0 +1,822 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Video", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Video", + "path": [] + }, + { + "name": { + "id": "Video", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + }, + { + "id": "Video", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + }, + { + "Specified": { + "id": "Administrator", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + }, + { + "Specified": { + "id": "Video", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + } + }, + "action_constraint": { + "In": [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + ] + }, + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 86, + "end": 231 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/validate/example3c.json b/cedar-lean/Cli/json-inputs/validate/example3c.json new file mode 100644 index 000000000..e2fcdcb94 --- /dev/null +++ b/cedar-lean/Cli/json-inputs/validate/example3c.json @@ -0,0 +1,792 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "Video", + "path": [] + }, + { + "name": { + "id": "Video", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Video", + "path": [] + }, + { + "id": "Album", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Album", + "path": [] + }, + { + "id": "Video", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "Administrator", + "path": [] + } + }, + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Video", + "path": [] + } + }, + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + } + }, + "action_constraint": "Any", + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 85, + "end": 173 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/validate/example4a.json b/cedar-lean/Cli/json-inputs/validate/example4a.json new file mode 100644 index 000000000..5e8686723 --- /dev/null +++ b/cedar-lean/Cli/json-inputs/validate/example4a.json @@ -0,0 +1,919 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": { + "account": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "Account", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Album", + "path": [] + } + ], + "attributes": { + "attrs": { + "account": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "Account", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": { + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "owner": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": { + "department": { + "attrType": { + "Primitive": { + "primitiveType": "String" + } + }, + "isRequired": true + }, + "jobLevel": { + "attrType": { + "Primitive": { + "primitiveType": "Long" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Album", + "path": [] + }, + { + "id": "Account", + "path": [] + } + ], + "attributes": { + "attrs": { + "owner": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + }, + "isRequired": true + } + } + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "photo": { + "attrType": { + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "filesize_mb": { + "attrType": { + "Primitive": { + "primitiveType": "Long" + } + }, + "isRequired": true + }, + "filetype": { + "attrType": { + "Primitive": { + "primitiveType": "String" + } + }, + "isRequired": true + } + } + }, + "open_attributes": "ClosedAttributes" + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": { + "In": [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + ] + }, + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "device_prototypes" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "And": { + "left": { + "expr_kind": { + "BinaryApp": { + "op": "Eq", + "arg1": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "principal" + }, + "source_info": { + "start": 257, + "end": 266 + }, + "data": null + }, + "attr": "department" + } + }, + "source_info": { + "start": 257, + "end": 277 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "Lit": { + "String": "HardwareEngineering" + } + }, + "source_info": { + "start": 281, + "end": 302 + }, + "data": null + } + } + }, + "source_info": { + "start": 257, + "end": 302 + }, + "data": null + }, + "right": { + "expr_kind": { + "UnaryApp": { + "op": "Not", + "arg": { + "expr_kind": { + "BinaryApp": { + "op": "Less", + "arg1": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "principal" + }, + "source_info": { + "start": 306, + "end": 315 + }, + "data": null + }, + "attr": "jobLevel" + } + }, + "source_info": { + "start": 306, + "end": 324 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "Lit": { + "Long": 5 + } + }, + "source_info": { + "start": 328, + "end": 329 + }, + "data": null + } + } + }, + "source_info": { + "start": 306, + "end": 329 + }, + "data": null + } + } + }, + "source_info": { + "start": 306, + "end": 329 + }, + "data": null + } + } + }, + "source_info": { + "start": 257, + "end": 329 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/validate/example4d.json b/cedar-lean/Cli/json-inputs/validate/example4d.json new file mode 100644 index 000000000..0dfc2670a --- /dev/null +++ b/cedar-lean/Cli/json-inputs/validate/example4d.json @@ -0,0 +1,860 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": { + "department": { + "attrType": { + "Primitive": { + "primitiveType": "String" + } + }, + "isRequired": true + }, + "jobLevel": { + "attrType": { + "Primitive": { + "primitiveType": "Long" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Account", + "path": [] + }, + { + "id": "Album", + "path": [] + } + ], + "attributes": { + "attrs": { + "owner": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Album", + "path": [] + } + ], + "attributes": { + "attrs": { + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "owner": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": { + "account": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "Account", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Album", + "path": [] + } + ], + "attributes": { + "attrs": { + "account": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "Account", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "photo": { + "attrType": { + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "filesize_mb": { + "attrType": { + "Primitive": { + "primitiveType": "Long" + } + }, + "isRequired": true + }, + "filetype": { + "attrType": { + "Primitive": { + "primitiveType": "String" + } + }, + "isRequired": true + } + } + }, + "open_attributes": "ClosedAttributes" + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": "Any", + "resource_constraint": { + "constraint": "Any" + }, + "non_head_constraints": { + "expr_kind": { + "And": { + "left": { + "expr_kind": { + "HasAttr": { + "expr": { + "expr_kind": { + "Var": "resource" + }, + "source_info": { + "start": 337, + "end": 345 + }, + "data": null + }, + "attr": "account" + } + }, + "source_info": { + "start": 337, + "end": 357 + }, + "data": null + }, + "right": { + "expr_kind": { + "BinaryApp": { + "op": "Eq", + "arg1": { + "expr_kind": { + "Var": "principal" + }, + "source_info": { + "start": 361, + "end": 370 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "resource" + }, + "source_info": { + "start": 374, + "end": 382 + }, + "data": null + }, + "attr": "account" + } + }, + "source_info": { + "start": 374, + "end": 396 + }, + "data": null + }, + "attr": "owner" + } + }, + "source_info": { + "start": 374, + "end": 396 + }, + "data": null + } + } + }, + "source_info": { + "start": 361, + "end": 396 + }, + "data": null + } + } + }, + "source_info": { + "start": 337, + "end": 396 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/validate/example4e.json b/cedar-lean/Cli/json-inputs/validate/example4e.json new file mode 100644 index 000000000..72d052bdc --- /dev/null +++ b/cedar-lean/Cli/json-inputs/validate/example4e.json @@ -0,0 +1,861 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": { + "account": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "Account", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + }, + { + "id": "Account", + "path": [] + } + ], + "attributes": { + "attrs": { + "owner": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": { + "department": { + "attrType": { + "Primitive": { + "primitiveType": "String" + } + }, + "isRequired": true + }, + "jobLevel": { + "attrType": { + "Primitive": { + "primitiveType": "Long" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": { + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "owner": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": { + "account": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "Account", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "photo": { + "attrType": { + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "filesize_mb": { + "attrType": { + "Primitive": { + "primitiveType": "Long" + } + }, + "isRequired": true + }, + "filetype": { + "attrType": { + "Primitive": { + "primitiveType": "String" + } + }, + "isRequired": true + } + } + }, + "open_attributes": "ClosedAttributes" + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": "Any" + }, + "non_head_constraints": { + "expr_kind": { + "BinaryApp": { + "op": "Eq", + "arg1": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "principal" + }, + "source_info": { + "start": 337, + "end": 346 + }, + "data": null + }, + "attr": "department" + } + }, + "source_info": { + "start": 337, + "end": 357 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "resource" + }, + "source_info": { + "start": 361, + "end": 369 + }, + "data": null + }, + "attr": "account" + } + }, + "source_info": { + "start": 361, + "end": 394 + }, + "data": null + }, + "attr": "owner" + } + }, + "source_info": { + "start": 361, + "end": 394 + }, + "data": null + }, + "attr": "department" + } + }, + "source_info": { + "start": 361, + "end": 394 + }, + "data": null + } + } + }, + "source_info": { + "start": 337, + "end": 394 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/validate/example4f.json b/cedar-lean/Cli/json-inputs/validate/example4f.json new file mode 100644 index 000000000..e4bf679c6 --- /dev/null +++ b/cedar-lean/Cli/json-inputs/validate/example4f.json @@ -0,0 +1,915 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [ + { + "id": "Account", + "path": [] + }, + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": { + "owner": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": { + "account": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "Account", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Album", + "path": [] + } + ], + "attributes": { + "attrs": { + "account": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "Account", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": { + "department": { + "attrType": { + "Primitive": { + "primitiveType": "String" + } + }, + "isRequired": true + }, + "jobLevel": { + "attrType": { + "Primitive": { + "primitiveType": "Long" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Album", + "path": [] + } + ], + "attributes": { + "attrs": { + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "owner": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "photo": { + "attrType": { + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "filesize_mb": { + "attrType": { + "Primitive": { + "primitiveType": "Long" + } + }, + "isRequired": true + }, + "filetype": { + "attrType": { + "Primitive": { + "primitiveType": "String" + } + }, + "isRequired": true + } + } + }, + "open_attributes": "ClosedAttributes" + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": "Any", + "resource_constraint": { + "constraint": "Any" + }, + "non_head_constraints": { + "expr_kind": { + "Or": { + "left": { + "expr_kind": { + "And": { + "left": { + "expr_kind": { + "HasAttr": { + "expr": { + "expr_kind": { + "Var": "resource" + }, + "source_info": { + "start": 364, + "end": 372 + }, + "data": null + }, + "attr": "account" + } + }, + "source_info": { + "start": 364, + "end": 384 + }, + "data": null + }, + "right": { + "expr_kind": { + "BinaryApp": { + "op": "Eq", + "arg1": { + "expr_kind": { + "Var": "principal" + }, + "source_info": { + "start": 388, + "end": 397 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "resource" + }, + "source_info": { + "start": 401, + "end": 409 + }, + "data": null + }, + "attr": "account" + } + }, + "source_info": { + "start": 401, + "end": 423 + }, + "data": null + }, + "attr": "owner" + } + }, + "source_info": { + "start": 401, + "end": 423 + }, + "data": null + } + } + }, + "source_info": { + "start": 388, + "end": 423 + }, + "data": null + } + } + }, + "source_info": { + "start": 364, + "end": 423 + }, + "data": null + }, + "right": { + "expr_kind": { + "BinaryApp": { + "op": "Contains", + "arg1": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "resource" + }, + "source_info": { + "start": 430, + "end": 438 + }, + "data": null + }, + "attr": "admins" + } + }, + "source_info": { + "start": 430, + "end": 465 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "Var": "principal" + }, + "source_info": { + "start": 455, + "end": 464 + }, + "data": null + } + } + }, + "source_info": { + "start": 430, + "end": 465 + }, + "data": null + } + } + }, + "source_info": { + "start": 363, + "end": 465 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/validate/example5b.json b/cedar-lean/Cli/json-inputs/validate/example5b.json new file mode 100644 index 000000000..6c329a052 --- /dev/null +++ b/cedar-lean/Cli/json-inputs/validate/example5b.json @@ -0,0 +1,1134 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Album", + "path": [] + }, + { + "id": "Account", + "path": [] + } + ], + "attributes": { + "attrs": { + "owner": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": { + "department": { + "attrType": { + "Primitive": { + "primitiveType": "String" + } + }, + "isRequired": true + }, + "jobLevel": { + "attrType": { + "Primitive": { + "primitiveType": "Long" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": { + "account": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "Account", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": { + "account": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "Account", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": { + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "owner": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "photo": { + "attrType": { + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "filesize_mb": { + "attrType": { + "Primitive": { + "primitiveType": "Long" + } + }, + "isRequired": true + }, + "filetype": { + "attrType": { + "Primitive": { + "primitiveType": "String" + } + }, + "isRequired": true + } + } + }, + "open_attributes": "ClosedAttributes" + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + } + }, + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Or": { + "left": { + "expr_kind": { + "And": { + "left": { + "expr_kind": { + "BinaryApp": { + "op": "Contains", + "arg1": { + "expr_kind": { + "Set": [ + { + "expr_kind": { + "Lit": { + "String": "JPEG" + } + }, + "source_info": { + "start": 322, + "end": 328 + }, + "data": null + }, + { + "expr_kind": { + "Lit": { + "String": "PNG" + } + }, + "source_info": { + "start": 330, + "end": 335 + }, + "data": null + } + ] + }, + "source_info": { + "start": 321, + "end": 336 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 346, + "end": 353 + }, + "data": null + }, + "attr": "photo" + } + }, + "source_info": { + "start": 346, + "end": 368 + }, + "data": null + }, + "attr": "filetype" + } + }, + "source_info": { + "start": 346, + "end": 368 + }, + "data": null + } + } + }, + "source_info": { + "start": 321, + "end": 369 + }, + "data": null + }, + "right": { + "expr_kind": { + "BinaryApp": { + "op": "LessEq", + "arg1": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 376, + "end": 383 + }, + "data": null + }, + "attr": "photo" + } + }, + "source_info": { + "start": 376, + "end": 401 + }, + "data": null + }, + "attr": "filesize_mb" + } + }, + "source_info": { + "start": 376, + "end": 401 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "Lit": { + "Long": 1 + } + }, + "source_info": { + "start": 405, + "end": 406 + }, + "data": null + } + } + }, + "source_info": { + "start": 376, + "end": 406 + }, + "data": null + } + } + }, + "source_info": { + "start": 321, + "end": 406 + }, + "data": null + }, + "right": { + "expr_kind": { + "And": { + "left": { + "expr_kind": { + "And": { + "left": { + "expr_kind": { + "BinaryApp": { + "op": "Eq", + "arg1": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 414, + "end": 421 + }, + "data": null + }, + "attr": "photo" + } + }, + "source_info": { + "start": 414, + "end": 436 + }, + "data": null + }, + "attr": "filetype" + } + }, + "source_info": { + "start": 414, + "end": 436 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "Lit": { + "String": "RAW" + } + }, + "source_info": { + "start": 440, + "end": 445 + }, + "data": null + } + } + }, + "source_info": { + "start": 414, + "end": 445 + }, + "data": null + }, + "right": { + "expr_kind": { + "BinaryApp": { + "op": "LessEq", + "arg1": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 452, + "end": 459 + }, + "data": null + }, + "attr": "photo" + } + }, + "source_info": { + "start": 452, + "end": 477 + }, + "data": null + }, + "attr": "filesize_mb" + } + }, + "source_info": { + "start": 452, + "end": 477 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "Lit": { + "Long": 100 + } + }, + "source_info": { + "start": 481, + "end": 484 + }, + "data": null + } + } + }, + "source_info": { + "start": 452, + "end": 484 + }, + "data": null + } + } + }, + "source_info": { + "start": 414, + "end": 523 + }, + "data": null + }, + "right": { + "expr_kind": { + "BinaryApp": { + "op": "In", + "arg1": { + "expr_kind": { + "Var": "principal" + }, + "source_info": { + "start": 491, + "end": 500 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + } + } + }, + "source_info": { + "start": 504, + "end": 523 + }, + "data": null + } + } + }, + "source_info": { + "start": 491, + "end": 523 + }, + "data": null + } + } + }, + "source_info": { + "start": 414, + "end": 523 + }, + "data": null + } + } + }, + "source_info": { + "start": 320, + "end": 524 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/validate/ip1.json b/cedar-lean/Cli/json-inputs/validate/ip1.json new file mode 100644 index 000000000..f4f2b06c0 --- /dev/null +++ b/cedar-lean/Cli/json-inputs/validate/ip1.json @@ -0,0 +1,841 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Video", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Video", + "path": [] + }, + { + "name": { + "id": "Video", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Album", + "path": [] + }, + { + "id": "Video", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "Administrator", + "path": [] + } + }, + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Video", + "path": [] + } + }, + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "BinaryApp": { + "op": "Eq", + "arg1": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 102, + "end": 109 + }, + "data": null + }, + "attr": "source_ip" + } + }, + "source_info": { + "start": 102, + "end": 119 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "ip", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "222.222.222.222" + } + }, + "source_info": { + "start": 126, + "end": 143 + }, + "data": null + } + ] + } + }, + "source_info": { + "start": 123, + "end": 144 + }, + "data": null + } + } + }, + "source_info": { + "start": 102, + "end": 144 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/validate/ip2.json b/cedar-lean/Cli/json-inputs/validate/ip2.json new file mode 100644 index 000000000..df51e7cd2 --- /dev/null +++ b/cedar-lean/Cli/json-inputs/validate/ip2.json @@ -0,0 +1,891 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Video", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Video", + "path": [] + }, + { + "id": "Album", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Video", + "path": [] + }, + { + "name": { + "id": "Video", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + }, + { + "Specified": { + "id": "Administrator", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + }, + { + "Specified": { + "id": "Video", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "And": { + "left": { + "expr_kind": { + "UnaryApp": { + "op": "Not", + "arg": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "isLoopback", + "path": [] + }, + "args": [ + { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 104, + "end": 111 + }, + "data": null + }, + "attr": "source_ip" + } + }, + "source_info": { + "start": 104, + "end": 134 + }, + "data": null + } + ] + } + }, + "source_info": { + "start": 104, + "end": 134 + }, + "data": null + } + } + }, + "source_info": { + "start": 102, + "end": 135 + }, + "data": null + }, + "right": { + "expr_kind": { + "UnaryApp": { + "op": "Not", + "arg": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "isMulticast", + "path": [] + }, + "args": [ + { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 141, + "end": 148 + }, + "data": null + }, + "attr": "source_ip" + } + }, + "source_info": { + "start": 141, + "end": 172 + }, + "data": null + } + ] + } + }, + "source_info": { + "start": 141, + "end": 172 + }, + "data": null + } + } + }, + "source_info": { + "start": 139, + "end": 173 + }, + "data": null + } + } + }, + "source_info": { + "start": 102, + "end": 173 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/validate/ip3.json b/cedar-lean/Cli/json-inputs/validate/ip3.json new file mode 100644 index 000000000..56cbf856a --- /dev/null +++ b/cedar-lean/Cli/json-inputs/validate/ip3.json @@ -0,0 +1,846 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "Video", + "path": [] + }, + { + "name": { + "id": "Video", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Video", + "path": [] + }, + { + "id": "Photo", + "path": [] + }, + { + "id": "Album", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Video", + "path": [] + }, + { + "id": "Photo", + "path": [] + }, + { + "id": "Album", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + }, + { + "Specified": { + "id": "Administrator", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Video", + "path": [] + } + }, + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "VacationPhoto94.jpg" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "isInRange", + "path": [] + }, + "args": [ + { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 102, + "end": 109 + }, + "data": null + }, + "attr": "source_ip" + } + }, + "source_info": { + "start": 102, + "end": 153 + }, + "data": null + }, + { + "expr_kind": { + "ExtensionFunctionApp": { + "fn_name": { + "id": "ip", + "path": [] + }, + "args": [ + { + "expr_kind": { + "Lit": { + "String": "222.222.222.0/24" + } + }, + "source_info": { + "start": 133, + "end": 151 + }, + "data": null + } + ] + } + }, + "source_info": { + "start": 130, + "end": 152 + }, + "data": null + } + ] + } + }, + "source_info": { + "start": 102, + "end": 153 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/validate/multi1.json b/cedar-lean/Cli/json-inputs/validate/multi1.json new file mode 100644 index 000000000..a6323545d --- /dev/null +++ b/cedar-lean/Cli/json-inputs/validate/multi1.json @@ -0,0 +1,876 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Video", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Video", + "path": [] + }, + { + "id": "Photo", + "path": [] + }, + { + "id": "Album", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Video", + "path": [] + }, + { + "name": { + "id": "Video", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "Administrator", + "path": [] + } + }, + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + }, + { + "Specified": { + "id": "Video", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy1": { + "id": "policy1", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "bob" + } + } + } + }, + "action_constraint": { + "In": [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + } + ] + }, + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 204, + "end": 318 + }, + "data": null + } + }, + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + } + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 96, + "end": 202 + }, + "data": null + } + } + }, + "links": { + "policy1": { + "template_id": "policy1", + "link_id": null, + "values": {} + }, + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/validate/multi2.json b/cedar-lean/Cli/json-inputs/validate/multi2.json new file mode 100644 index 000000000..06b040763 --- /dev/null +++ b/cedar-lean/Cli/json-inputs/validate/multi2.json @@ -0,0 +1,853 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "Video", + "path": [] + }, + { + "name": { + "id": "Video", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Video", + "path": [] + }, + { + "id": "Album", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Album", + "path": [] + }, + { + "id": "Video", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "Administrator", + "path": [] + } + }, + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Video", + "path": [] + } + }, + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 121, + "end": 210 + }, + "data": null + } + }, + "policy1": { + "id": "policy1", + "annotations": {}, + "effect": "forbid", + "principal_constraint": { + "constraint": { + "Eq": { + "EUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "bob" + } + } + } + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 226, + "end": 330 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + }, + "policy1": { + "template_id": "policy1", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/validate/multi3.json b/cedar-lean/Cli/json-inputs/validate/multi3.json new file mode 100644 index 000000000..3d27a3b68 --- /dev/null +++ b/cedar-lean/Cli/json-inputs/validate/multi3.json @@ -0,0 +1,990 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": { + "account": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "Account", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": { + "department": { + "attrType": { + "Primitive": { + "primitiveType": "String" + } + }, + "isRequired": true + }, + "jobLevel": { + "attrType": { + "Primitive": { + "primitiveType": "Long" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": { + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "owner": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": { + "account": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "Account", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Account", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": { + "owner": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + }, + "isRequired": true + } + } + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "photo": { + "attrType": { + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "filesize_mb": { + "attrType": { + "Primitive": { + "primitiveType": "Long" + } + }, + "isRequired": true + }, + "filetype": { + "attrType": { + "Primitive": { + "primitiveType": "String" + } + }, + "isRequired": true + } + } + }, + "open_attributes": "ClosedAttributes" + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy1": { + "id": "policy1", + "annotations": {}, + "effect": "forbid", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": "Any", + "resource_constraint": { + "constraint": "Any" + }, + "non_head_constraints": { + "expr_kind": { + "And": { + "left": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "resource" + }, + "source_info": { + "start": 398, + "end": 406 + }, + "data": null + }, + "attr": "private" + } + }, + "source_info": { + "start": 398, + "end": 414 + }, + "data": null + }, + "right": { + "expr_kind": { + "UnaryApp": { + "op": "Not", + "arg": { + "expr_kind": { + "And": { + "left": { + "expr_kind": { + "HasAttr": { + "expr": { + "expr_kind": { + "Var": "resource" + }, + "source_info": { + "start": 426, + "end": 434 + }, + "data": null + }, + "attr": "account" + } + }, + "source_info": { + "start": 426, + "end": 446 + }, + "data": null + }, + "right": { + "expr_kind": { + "BinaryApp": { + "op": "Eq", + "arg1": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "resource" + }, + "source_info": { + "start": 450, + "end": 458 + }, + "data": null + }, + "attr": "account" + } + }, + "source_info": { + "start": 450, + "end": 472 + }, + "data": null + }, + "attr": "owner" + } + }, + "source_info": { + "start": 450, + "end": 472 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "Var": "principal" + }, + "source_info": { + "start": 476, + "end": 485 + }, + "data": null + } + } + }, + "source_info": { + "start": 450, + "end": 485 + }, + "data": null + } + } + }, + "source_info": { + "start": 426, + "end": 485 + }, + "data": null + } + } + }, + "source_info": { + "start": 417, + "end": 487 + }, + "data": null + } + } + }, + "source_info": { + "start": 354, + "end": 488 + }, + "data": null + } + }, + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + } + } + } + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 145, + "end": 258 + }, + "data": null + } + } + }, + "links": { + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + }, + "policy1": { + "template_id": "policy1", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/validate/multi4.json b/cedar-lean/Cli/json-inputs/validate/multi4.json new file mode 100644 index 000000000..62cafffd9 --- /dev/null +++ b/cedar-lean/Cli/json-inputs/validate/multi4.json @@ -0,0 +1,1094 @@ +{ + "schema": { + "entityTypes": [ + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Album", + "path": [] + } + ], + "attributes": { + "attrs": { + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "owner": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "AccountGroup", + "path": [] + }, + { + "name": { + "id": "AccountGroup", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Account", + "path": [] + }, + { + "id": "Album", + "path": [] + } + ], + "attributes": { + "attrs": { + "owner": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Photo", + "path": [] + }, + { + "name": { + "id": "Photo", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": { + "account": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "Account", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "UserGroup", + "path": [] + }, + { + "name": { + "id": "UserGroup", + "path": [] + }, + "descendants": [ + { + "id": "User", + "path": [] + } + ], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "User", + "path": [] + }, + { + "name": { + "id": "User", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": { + "department": { + "attrType": { + "Primitive": { + "primitiveType": "String" + } + }, + "isRequired": true + }, + "jobLevel": { + "attrType": { + "Primitive": { + "primitiveType": "Long" + } + }, + "isRequired": true + } + } + } + } + ], + [ + { + "id": "Administrator", + "path": [] + }, + { + "name": { + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + } + } + ], + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], + "attributes": { + "attrs": { + "account": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "Account", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + } + } + ] + ], + "actionIds": [ + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "delete" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listPhotos" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Account", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Album", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "photo": { + "attrType": { + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "filesize_mb": { + "attrType": { + "Primitive": { + "primitiveType": "Long" + } + }, + "isRequired": true + }, + "filetype": { + "attrType": { + "Primitive": { + "primitiveType": "String" + } + }, + "isRequired": true + } + } + }, + "open_attributes": "ClosedAttributes" + } + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + { + "name": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "comment" + }, + "appliesTo": { + "principalApplySpec": [ + { + "Specified": { + "id": "User", + "path": [] + } + } + ], + "resourceApplySpec": [ + { + "Specified": { + "id": "Photo", + "path": [] + } + } + ] + }, + "descendants": [], + "context": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "attribute_types": { + "attrs": {} + }, + "attributes": {} + } + ] + ] + }, + "policies": { + "templates": { + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + } + } + } + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 140, + "end": 253 + }, + "data": null + } + }, + "policy3": { + "id": "policy3", + "annotations": {}, + "effect": "forbid", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": "Any", + "resource_constraint": { + "constraint": "Any" + }, + "non_head_constraints": { + "expr_kind": { + "UnaryApp": { + "op": "Not", + "arg": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 751, + "end": 758 + }, + "data": null + }, + "attr": "authenticated" + } + }, + "source_info": { + "start": 751, + "end": 772 + }, + "data": null + } + } + }, + "source_info": { + "start": 750, + "end": 772 + }, + "data": null + } + }, + "policy2": { + "id": "policy2", + "annotations": {}, + "effect": "forbid", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": "Any", + "resource_constraint": { + "constraint": "Any" + }, + "non_head_constraints": { + "expr_kind": { + "And": { + "left": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "resource" + }, + "source_info": { + "start": 548, + "end": 556 + }, + "data": null + }, + "attr": "private" + } + }, + "source_info": { + "start": 548, + "end": 564 + }, + "data": null + }, + "right": { + "expr_kind": { + "UnaryApp": { + "op": "Not", + "arg": { + "expr_kind": { + "And": { + "left": { + "expr_kind": { + "HasAttr": { + "expr": { + "expr_kind": { + "Var": "resource" + }, + "source_info": { + "start": 576, + "end": 584 + }, + "data": null + }, + "attr": "account" + } + }, + "source_info": { + "start": 576, + "end": 596 + }, + "data": null + }, + "right": { + "expr_kind": { + "BinaryApp": { + "op": "Eq", + "arg1": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "resource" + }, + "source_info": { + "start": 600, + "end": 608 + }, + "data": null + }, + "attr": "account" + } + }, + "source_info": { + "start": 600, + "end": 622 + }, + "data": null + }, + "attr": "owner" + } + }, + "source_info": { + "start": 600, + "end": 622 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "Var": "principal" + }, + "source_info": { + "start": 626, + "end": 635 + }, + "data": null + } + } + }, + "source_info": { + "start": 600, + "end": 635 + }, + "data": null + } + } + }, + "source_info": { + "start": 576, + "end": 635 + }, + "data": null + } + } + }, + "source_info": { + "start": 567, + "end": 637 + }, + "data": null + } + } + }, + "source_info": { + "start": 504, + "end": 638 + }, + "data": null + } + }, + "policy1": { + "id": "policy1", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": "Any", + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "alice_vacation" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "BinaryApp": { + "op": "Eq", + "arg1": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "principal" + }, + "source_info": { + "start": 401, + "end": 410 + }, + "data": null + }, + "attr": "department" + } + }, + "source_info": { + "start": 401, + "end": 421 + }, + "data": null + }, + "arg2": { + "expr_kind": { + "Lit": { + "String": "Sales" + } + }, + "source_info": { + "start": 425, + "end": 432 + }, + "data": null + } + } + }, + "source_info": { + "start": 401, + "end": 432 + }, + "data": null + } + } + }, + "links": { + "policy1": { + "template_id": "policy1", + "link_id": null, + "values": {} + }, + "policy3": { + "template_id": "policy3", + "link_id": null, + "values": {} + }, + "policy2": { + "template_id": "policy2", + "link_id": null, + "values": {} + }, + "policy0": { + "template_id": "policy0", + "link_id": null, + "values": {} + } + } + }, + "mode": "Strict" +} \ No newline at end of file From 3b3e0c8f35190bfa6f87939cf7814a286a9d517d Mon Sep 17 00:00:00 2001 From: Kesha Hietala Date: Tue, 21 Nov 2023 15:41:47 +0000 Subject: [PATCH 31/57] wip --- cedar-drt/src/lean_impl.rs | 11 ++++---- cedar-drt/tests/integration_tests.rs | 40 ++++++++++++++-------------- 2 files changed, 25 insertions(+), 26 deletions(-) diff --git a/cedar-drt/src/lean_impl.rs b/cedar-drt/src/lean_impl.rs index b219711e7..25a765557 100644 --- a/cedar-drt/src/lean_impl.rs +++ b/cedar-drt/src/lean_impl.rs @@ -171,8 +171,6 @@ impl LeanDefinitionalEngine { mode: cedar_policy_validator::ValidationMode::default(), // == Strict }) .expect("Failed to serialize schema or policies"); - println!("{request}"); - assert!(false); let cstring = CString::new(request).expect("CString::new failed"); let s = unsafe { lean_mk_string(cstring.as_ptr() as *const u8) }; return s; @@ -180,11 +178,12 @@ impl LeanDefinitionalEngine { fn deserialize_validation_response(response: *mut lean_object) -> ValidationInterfaceResponse { let response_string = lean_obj_to_string(response); - let resp: ValResponseDef = - serde_json::from_str(&response_string).expect("could not convert string to json"); - let errors = resp.errors.mk.l.into_iter().collect(); + print!("{response_string}"); + // let resp: ValResponseDef = + // serde_json::from_str(&response_string).expect("could not convert string to json"); + // let errors = resp.errors.mk.l.into_iter().collect(); ValidationInterfaceResponse { - validation_errors: errors, + validation_errors: Vec::new(), parse_errors: Vec::new(), } } diff --git a/cedar-drt/tests/integration_tests.rs b/cedar-drt/tests/integration_tests.rs index 51f94e4d5..0161a081d 100644 --- a/cedar-drt/tests/integration_tests.rs +++ b/cedar-drt/tests/integration_tests.rs @@ -35,26 +35,26 @@ fn run_integration_tests(custom_impl: &dyn CustomCedarImpl) { // currently runs (last updated 2023-09-25). let test_jsons = vec![ "decimal/1.json", - "decimal/2.json", - "example_use_cases_doc/1a.json", - "example_use_cases_doc/2a.json", - "example_use_cases_doc/2b.json", - "example_use_cases_doc/2c.json", - "example_use_cases_doc/3a.json", - "example_use_cases_doc/3b.json", - "example_use_cases_doc/3c.json", - "example_use_cases_doc/4a.json", - "example_use_cases_doc/4d.json", - "example_use_cases_doc/4e.json", - "example_use_cases_doc/4f.json", - "example_use_cases_doc/5b.json", - "ip/1.json", - "ip/2.json", - "ip/3.json", - "multi/1.json", - "multi/2.json", - "multi/3.json", - "multi/4.json", + // "decimal/2.json", + // "example_use_cases_doc/1a.json", + // "example_use_cases_doc/2a.json", + // "example_use_cases_doc/2b.json", + // "example_use_cases_doc/2c.json", + // "example_use_cases_doc/3a.json", + // "example_use_cases_doc/3b.json", + // "example_use_cases_doc/3c.json", + // "example_use_cases_doc/4a.json", + // "example_use_cases_doc/4d.json", + // "example_use_cases_doc/4e.json", + // "example_use_cases_doc/4f.json", + // "example_use_cases_doc/5b.json", + // "ip/1.json", + // "ip/2.json", + // "ip/3.json", + // "multi/1.json", + // "multi/2.json", + // "multi/3.json", + // "multi/4.json", ] .into_iter() .map(|p| integration_tests_folder.join(p)); From 3dc359fc4740d218f2b2997ef2467ee42014fabb Mon Sep 17 00:00:00 2001 From: Kesha Hietala Date: Tue, 21 Nov 2023 15:48:22 +0000 Subject: [PATCH 32/57] update submodule --- cedar | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cedar b/cedar index 35b7f79fb..13e3eeda7 160000 --- a/cedar +++ b/cedar @@ -1 +1 @@ -Subproject commit 35b7f79fb92219dfc68dd24dbc265441102b694a +Subproject commit 13e3eeda734988b92b5760246d78c4204dd91e5b From 78ab68c27f3a3168d7123f672b1ebfc80a308475 Mon Sep 17 00:00:00 2001 From: Kesha Hietala Date: Tue, 21 Nov 2023 15:56:32 +0000 Subject: [PATCH 33/57] fix bad merge --- cedar-drt/fuzz/fuzz_targets/rbac-authorizer.rs | 2 +- cedar-drt/fuzz/fuzz_targets/rbac.rs | 2 +- cedar-drt/src/lean_impl.rs | 7 +++---- cedar-lean/Cedar/Spec/Response.lean | 3 --- 4 files changed, 5 insertions(+), 9 deletions(-) diff --git a/cedar-drt/fuzz/fuzz_targets/rbac-authorizer.rs b/cedar-drt/fuzz/fuzz_targets/rbac-authorizer.rs index d1e053b76..c5409f4a8 100644 --- a/cedar-drt/fuzz/fuzz_targets/rbac-authorizer.rs +++ b/cedar-drt/fuzz/fuzz_targets/rbac-authorizer.rs @@ -113,7 +113,7 @@ fuzz_target!(|input: AuthorizerInputAbstractEvaluator| { // the result of the call to is_authorized. let lean_def_engine = LeanDefinitionalEngine::new().expect("failed to create definitional engine"); - let res = run_auth_test(&lean_def_engine, &request, &policyset, &entities); + let res = run_auth_test(&lean_def_engine, request, &policyset, &entities); // Check the following property: there should be an error reported iff we // had either PermitError or ForbidError diff --git a/cedar-drt/fuzz/fuzz_targets/rbac.rs b/cedar-drt/fuzz/fuzz_targets/rbac.rs index 92d116970..f26885b65 100644 --- a/cedar-drt/fuzz/fuzz_targets/rbac.rs +++ b/cedar-drt/fuzz/fuzz_targets/rbac.rs @@ -205,7 +205,7 @@ fuzz_target!(|input: FuzzTargetInput| { for rbac_request in input.requests.into_iter() { let request = ast::Request::from(rbac_request); let (_, dur) = - time_function(|| run_auth_test(&lean_def_engine, &request, &policyset, &entities)); + time_function(|| run_auth_test(&lean_def_engine, request, &policyset, &entities)); info!("{}{}", TOTAL_MSG, dur.as_nanos()); } } diff --git a/cedar-drt/src/lean_impl.rs b/cedar-drt/src/lean_impl.rs index 25a765557..bedc8fdc1 100644 --- a/cedar-drt/src/lean_impl.rs +++ b/cedar-drt/src/lean_impl.rs @@ -26,7 +26,6 @@ use std::{collections::HashSet, env, ffi::CString}; use crate::cedar_test_impl::*; use cedar_policy::frontend::is_authorized::InterfaceResponse; use cedar_policy::integration_testing::{CustomCedarImpl, IntegrationTestValidationResult}; -use cedar_policy::Diagnostics; pub use cedar_policy::Response; use cedar_policy_core::ast::{Expr, Value}; pub use cedar_policy_core::*; @@ -204,16 +203,16 @@ impl LeanDefinitionalEngine { impl CedarTestImplementation for LeanDefinitionalEngine { fn is_authorized( &self, - request: &ast::Request, + request: ast::Request, policies: &ast::PolicySet, entities: &Entities, ) -> InterfaceResponse { - self.is_authorized(request, policies, entities) + self.is_authorized(&request, policies, entities) } fn interpret( &self, - _request: &ast::Request, + _request: ast::Request, _entities: &Entities, _expr: &Expr, _expected: Option, diff --git a/cedar-lean/Cedar/Spec/Response.lean b/cedar-lean/Cedar/Spec/Response.lean index 646739f4e..c85b72fce 100644 --- a/cedar-lean/Cedar/Spec/Response.lean +++ b/cedar-lean/Cedar/Spec/Response.lean @@ -38,9 +38,6 @@ deriving Repr, DecidableEq ----- Derivations ----- -deriving instance Repr, DecidableEq, Lean.ToJson for Decision -deriving instance Repr, DecidableEq, Lean.ToJson for Response - deriving instance Lean.ToJson for Decision deriving instance Lean.ToJson for Response From 7f5d0c125df47aa30d2aa67ef770db08776434f6 Mon Sep 17 00:00:00 2001 From: Kesha Hietala Date: Tue, 21 Nov 2023 17:54:35 +0000 Subject: [PATCH 34/57] validation tests are working --- cedar-drt/Makefile | 2 +- cedar-drt/src/lean_impl.rs | 21 +++++++----- cedar-drt/tests/integration_tests.rs | 40 +++++++++++----------- cedar-lean/Cedar/Validation/Types.lean | 16 --------- cedar-lean/Cedar/Validation/Validator.lean | 18 +++++++++- 5 files changed, 51 insertions(+), 46 deletions(-) diff --git a/cedar-drt/Makefile b/cedar-drt/Makefile index a3928c73b..bd7c33d17 100644 --- a/cedar-drt/Makefile +++ b/cedar-drt/Makefile @@ -8,6 +8,6 @@ all: test: all DYLD_LIBRARY_PATH=`lean --print-libdir`:${DYLD_LIBRARY_PATH} \ - LD_LIBRARY_PATH=`lean --print-libdir`:${LD_LIBRARY_PATH} \ + LD_LIBRARY_PATH=`lean --print-libdir`:`lean --print-prefix`/lib/glibc/libm.so:${LD_LIBRARY_PATH} \ LEAN_LIB_DIR=`lean --print-libdir` \ cargo test \ No newline at end of file diff --git a/cedar-drt/src/lean_impl.rs b/cedar-drt/src/lean_impl.rs index bedc8fdc1..997812292 100644 --- a/cedar-drt/src/lean_impl.rs +++ b/cedar-drt/src/lean_impl.rs @@ -76,8 +76,11 @@ struct ResponseDef { } #[derive(Serialize, Deserialize)] -struct ValResponseDef { - errors: SetDef, +enum ValResponseDef { + #[serde(rename = "ok")] + Ok, + #[serde(rename = "error")] + Error(String), } #[derive(Debug)] @@ -127,7 +130,7 @@ impl LeanDefinitionalEngine { fn deserialize_authorization_response(response: *mut lean_object) -> InterfaceResponse { let response_string = lean_obj_to_string(response); let resp: ResponseDef = - serde_json::from_str(&response_string).expect("could not convert string to json"); + serde_json::from_str(&response_string).expect("could not deserialize json"); let dec: authorizer::Decision = if resp.decision == "allow" { authorizer::Decision::Allow } else if resp.decision == "deny" { @@ -177,12 +180,14 @@ impl LeanDefinitionalEngine { fn deserialize_validation_response(response: *mut lean_object) -> ValidationInterfaceResponse { let response_string = lean_obj_to_string(response); - print!("{response_string}"); - // let resp: ValResponseDef = - // serde_json::from_str(&response_string).expect("could not convert string to json"); - // let errors = resp.errors.mk.l.into_iter().collect(); + let resp: ValResponseDef = + serde_json::from_str(&response_string).expect("could not deserialize json"); + let validation_errors = match resp { + ValResponseDef::Ok => Vec::new(), + ValResponseDef::Error(err) => vec![err], + }; ValidationInterfaceResponse { - validation_errors: Vec::new(), + validation_errors, parse_errors: Vec::new(), } } diff --git a/cedar-drt/tests/integration_tests.rs b/cedar-drt/tests/integration_tests.rs index 0161a081d..51f94e4d5 100644 --- a/cedar-drt/tests/integration_tests.rs +++ b/cedar-drt/tests/integration_tests.rs @@ -35,26 +35,26 @@ fn run_integration_tests(custom_impl: &dyn CustomCedarImpl) { // currently runs (last updated 2023-09-25). let test_jsons = vec![ "decimal/1.json", - // "decimal/2.json", - // "example_use_cases_doc/1a.json", - // "example_use_cases_doc/2a.json", - // "example_use_cases_doc/2b.json", - // "example_use_cases_doc/2c.json", - // "example_use_cases_doc/3a.json", - // "example_use_cases_doc/3b.json", - // "example_use_cases_doc/3c.json", - // "example_use_cases_doc/4a.json", - // "example_use_cases_doc/4d.json", - // "example_use_cases_doc/4e.json", - // "example_use_cases_doc/4f.json", - // "example_use_cases_doc/5b.json", - // "ip/1.json", - // "ip/2.json", - // "ip/3.json", - // "multi/1.json", - // "multi/2.json", - // "multi/3.json", - // "multi/4.json", + "decimal/2.json", + "example_use_cases_doc/1a.json", + "example_use_cases_doc/2a.json", + "example_use_cases_doc/2b.json", + "example_use_cases_doc/2c.json", + "example_use_cases_doc/3a.json", + "example_use_cases_doc/3b.json", + "example_use_cases_doc/3c.json", + "example_use_cases_doc/4a.json", + "example_use_cases_doc/4d.json", + "example_use_cases_doc/4e.json", + "example_use_cases_doc/4f.json", + "example_use_cases_doc/5b.json", + "ip/1.json", + "ip/2.json", + "ip/3.json", + "multi/1.json", + "multi/2.json", + "multi/3.json", + "multi/4.json", ] .into_iter() .map(|p| integration_tests_folder.join(p)); diff --git a/cedar-lean/Cedar/Validation/Types.lean b/cedar-lean/Cedar/Validation/Types.lean index ab542b663..2acbe2fe7 100644 --- a/cedar-lean/Cedar/Validation/Types.lean +++ b/cedar-lean/Cedar/Validation/Types.lean @@ -200,20 +200,4 @@ deriving instance Inhabited for Qualified deriving instance Inhabited for ExtType deriving instance Inhabited for CedarType -/- -Lossy serialization of errors to Json. This serialization provides some extra -information to DRT without having to derive `Lean.ToJson` for `Expr` and `CedarType`. --/ -def typeErrorToJson : TypeError → Lean.Json - | .lubErr _ _ => "lubErr" - | .unexpectedType _ => "unexpectedType" - | .attrNotFound _ _ => "attrNotFound" - | .unknownEntity _ => "unknownEntity" - | .extensionErr _ => "extensionErr" - | .emptySetErr => "emptySetErr" - | .incompatibleSetTypes _ => "incompatibleSetTypes" - -instance : Lean.ToJson TypeError where - toJson := typeErrorToJson - end Cedar.Validation diff --git a/cedar-lean/Cedar/Validation/Validator.lean b/cedar-lean/Cedar/Validation/Validator.lean index 2fba0f778..070b47a71 100644 --- a/cedar-lean/Cedar/Validation/Validator.lean +++ b/cedar-lean/Cedar/Validation/Validator.lean @@ -150,7 +150,23 @@ deriving instance Repr for Schema deriving instance Repr for ValidationError deriving instance Lean.ToJson for Except -deriving instance Lean.ToJson for ValidationError + +/- +Lossy serialization of errors to Json. This serialization provides some extra +information to DRT without having to derive `Lean.ToJson` for `Expr` and `CedarType`. +-/ +def validationErrorToJson : ValidationError → Lean.Json + | .typeError _ (.lubErr _ _) => "lubErr" + | .typeError _ (.unexpectedType _) => "unexpectedType" + | .typeError _ (.attrNotFound _ _) => "attrNotFound" + | .typeError _ (.unknownEntity _) => "unknownEntity" + | .typeError _ (.extensionErr _) => "extensionErr" + | .typeError _ .emptySetErr => "emptySetErr" + | .typeError _ (.incompatibleSetTypes _) => "incompatibleSetTypes" + | .impossiblePolicy _ => "impossiblePolicy" + +instance : Lean.ToJson ValidationError where + toJson := validationErrorToJson instance : Lean.ToJson Unit where toJson := λ _ => Lean.Json.null From 590859d0fca7b786d403adb1e2abd4d81e6acc0b Mon Sep 17 00:00:00 2001 From: Kesha Hietala Date: Tue, 21 Nov 2023 19:38:19 +0000 Subject: [PATCH 35/57] cleanup --- cedar-drt/fuzz/src/lib.rs | 4 +- cedar-lean/Cedar/Thm/Soundness.lean | 36 +- cedar-lean/Cedar/Validation/Validator.lean | 4 +- cedar-lean/DiffTest/Main.lean | 7 - cedar-lean/DiffTest/Parser.lean | 6 +- cedar-lean/DiffTest/example.json | 717 --------------------- 6 files changed, 10 insertions(+), 764 deletions(-) delete mode 100644 cedar-lean/DiffTest/example.json diff --git a/cedar-drt/fuzz/src/lib.rs b/cedar-drt/fuzz/src/lib.rs index 38b7e9b40..0719762a7 100644 --- a/cedar-drt/fuzz/src/lib.rs +++ b/cedar-drt/fuzz/src/lib.rs @@ -179,7 +179,7 @@ fn test_run_auth_test() { let java_def_engine = JavaDefinitionalEngine::new().expect("failed to create definitional engine"); - let principal = ast::EntityUIDEntry::Concrete(std::sync::Arc::new( + let principal = ast::EntityUIDEntry::Known(std::sync::Arc::new( EntityUID::with_eid_and_type("User", "alice").unwrap(), )); let action = ast::EntityUIDEntry::Known(std::sync::Arc::new( @@ -245,5 +245,5 @@ fn test_run_auth_test() { Extensions::all_available(), ) .unwrap(); - run_auth_test(&java_def_engine, &query, &policies, &entities); + run_auth_test(&java_def_engine, query, &policies, &entities); } diff --git a/cedar-lean/Cedar/Thm/Soundness.lean b/cedar-lean/Cedar/Thm/Soundness.lean index 0a682edf4..40a7b5b3b 100644 --- a/cedar-lean/Cedar/Thm/Soundness.lean +++ b/cedar-lean/Cedar/Thm/Soundness.lean @@ -19,7 +19,7 @@ import Cedar.Thm.Lemmas.Typechecker import Mathlib.Data.List.Basic /-! -This file defines the top-level soundness property for the valdator. +This file defines the top-level soundness property for the validator. todo: fill in `sorry`s. Some invariants may need to be adjusted. The current definitions are an informed guess based on the corresponding Dafny proof. @@ -46,42 +46,12 @@ theorem typecheck_policy_is_sound (policy : Policy) (env : Environment) (t : Ced typecheckPolicy policy env = .ok t → EvaluatesToBool policy request entities := by - intro h₀ h₁ - unfold typecheckPolicy at h₁ - cases h₂ : (typeOf (Policy.toExpr policy) ∅ env) <;> - rw [h₂] at h₁ <;> - simp at h₁ - case ok res => - cases h₃ : (res.fst ⊑ CedarType.bool BoolType.anyBool) <;> - rw [h₃] at h₁ <;> - simp at h₁ - clear h₁ t - have h₁ : GuardedCapabilitiesInvariant policy.toExpr res.2 request entities ∧ ∃ (v : Value), EvaluatesTo policy.toExpr request entities v ∧ InstanceOfType v res.1 := by - apply type_of_is_sound (env:=env) (c₁:=∅) - apply empty_capabilities_invariant - apply h₀ - apply h₂ - cases h₁ with - | intro _ h₁ => - cases h₁ with - | intro v h₁ => - cases h₁ with - | intro h₁ h₄ => - have h₅ : ∃ b, v = .prim (.bool b) := by - apply instance_of_type_bool_is_bool - apply h₄ - apply h₃ - cases h₅ with - | intro b h₅ => - unfold EvaluatesToBool - exists b - rewrite [← h₅] - apply h₁ + sorry def RequestMatchesSchema (schema : Schema) (request : Request) : Prop := match schema.acts.find? request.action with | some entry => - request.principal.ty ∈ entry.appliesToPricipal ∧ + request.principal.ty ∈ entry.appliesToPrincipal ∧ request.resource.ty ∈ entry.appliesToResource ∧ InstanceOfType request.context (.record entry.context) | _ => False diff --git a/cedar-lean/Cedar/Validation/Validator.lean b/cedar-lean/Cedar/Validation/Validator.lean index 070b47a71..ebe15eac8 100644 --- a/cedar-lean/Cedar/Validation/Validator.lean +++ b/cedar-lean/Cedar/Validation/Validator.lean @@ -26,7 +26,7 @@ open Cedar.Data ----- Definitions ----- structure SchemaActionEntry where - appliesToPricipal : Set EntityType + appliesToPrincipal : Set EntityType appliesToResource : Set EntityType ancestors : Set EntityUID context : RecordType @@ -42,7 +42,7 @@ For a given action, compute the cross-product of the applicable principal and resource types. -/ def SchemaActionEntry.toRequestTypes (action : EntityUID) (entry : SchemaActionEntry) : List RequestType := - entry.appliesToPricipal.toList.foldl (fun acc principal => + entry.appliesToPrincipal.toList.foldl (fun acc principal => let reqtys : List RequestType := entry.appliesToResource.toList.map (fun resource => { diff --git a/cedar-lean/DiffTest/Main.lean b/cedar-lean/DiffTest/Main.lean index bd647100f..52284d767 100644 --- a/cedar-lean/DiffTest/Main.lean +++ b/cedar-lean/DiffTest/Main.lean @@ -50,11 +50,4 @@ open Cedar.Validation let response := validate policies schema toString (Lean.toJson response) -def test : IO Unit := do - let input ← IO.FS.readFile "DiffTest/example.json" - IO.println (isAuthorizedDRT input) - --- result should be "allow" due to policy0 -#eval test - end DiffTest diff --git a/cedar-lean/DiffTest/Parser.lean b/cedar-lean/DiffTest/Parser.lean index 4ac07d7de..82d8ca863 100644 --- a/cedar-lean/DiffTest/Parser.lean +++ b/cedar-lean/DiffTest/Parser.lean @@ -350,7 +350,7 @@ structure JsonEntityTypeStoreEntry where abbrev JsonEntityTypeStore := Map EntityType JsonEntityTypeStoreEntry structure JsonSchemaActionEntry where - appliesToPricipal : Set EntityType + appliesToPrincipal : Set EntityType appliesToResource : Set EntityType descendants : Set EntityUID context : RecordType @@ -375,7 +375,7 @@ def invertJsonSchemaActionStore (acts : JsonSchemaActionStore) : SchemaActionSto Map.mk (List.map (λ (k,v) => (k, { - appliesToPricipal := v.appliesToPricipal, + appliesToPrincipal := v.appliesToPrincipal, appliesToResource := v.appliesToResource, ancestors := ancestorMap.find! k, context := v.context @@ -436,7 +436,7 @@ partial def jsonToSchemaActionEntry (json : Lean.Json) : JsonSchemaActionEntry : let descendants := jsonToArray (getJsonField json "descendants") let context := getJsonField (getJsonField json "context") "attrs" { - appliesToPricipal := Set.mk (List.map jsonToEntityType appliesToPrincipal.toList), + appliesToPrincipal := Set.mk (List.map jsonToEntityType appliesToPrincipal.toList), appliesToResource := Set.mk (List.map jsonToEntityType appliesToResource.toList), descendants := Set.mk (List.map jsonToEuid descendants.toList), context := jsonToRecordType context diff --git a/cedar-lean/DiffTest/example.json b/cedar-lean/DiffTest/example.json deleted file mode 100644 index c27df389b..000000000 --- a/cedar-lean/DiffTest/example.json +++ /dev/null @@ -1,717 +0,0 @@ -{ - "request": { - "principal": { - "Concrete": { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - }, - "action": { - "Concrete": { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource": { - "Concrete": { - "ty": { - "Concrete": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - } - }, - "context": { - "expr_kind": { - "Record": { - "authenticated": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": null, - "data": null - }, - "confidence_score": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "decimal", - "path": [] - }, - "args": [ - { - "expr_kind": { - "Lit": { - "String": "0.6" - } - }, - "source_info": null, - "data": null - } - ] - } - }, - "source_info": null, - "data": null - }, - "source_ip": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "ip", - "path": [] - }, - "args": [ - { - "expr_kind": { - "Lit": { - "String": "123.123.123.123" - } - }, - "source_info": null, - "data": null - } - ] - } - }, - "source_info": null, - "data": null - } - } - }, - "source_info": null, - "data": null - } - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": { - "Eq": { - "EUID": { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - } - } - }, - "action_constraint": { - "Eq": { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource_constraint": { - "constraint": { - "Eq": { - "EUID": { - "ty": { - "Concrete": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": { - "start": 56, - "end": 168 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "entities": { - "entities": [ - [ - { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Concrete": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "jane_friends" - } - ] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Administrator", - "path": [] - } - }, - "eid": "ahmad" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Administrator", - "path": [] - } - }, - "eid": "ahmad" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Photo", - "path": [] - } - }, - "eid": "selfie.jpg" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Photo", - "path": [] - } - }, - "eid": "selfie.jpg" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "bob" - } - ] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - } - ] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "bob" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "bob" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "jane_friends" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "jane_friends" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "bob" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "bob" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Video", - "path": [] - } - }, - "eid": "surf.mp4" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Video", - "path": [] - } - }, - "eid": "surf.mp4" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - }, - { - "ty": { - "Concrete": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - } - ] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Photo", - "path": [] - } - }, - "eid": "passportscan.jpg" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Photo", - "path": [] - } - }, - "eid": "passportscan.jpg" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - } - ] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - }, - { - "ty": { - "Concrete": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - } - ] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "tim" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "User", - "path": [] - } - }, - "eid": "tim" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Concrete": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "jane_friends" - } - ] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "uid": { - "ty": { - "Concrete": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "attrs": {}, - "ancestors": [] - } - ] - ] - } -} \ No newline at end of file From 655efabb8941236257b235f52db29451044cdfa0 Mon Sep 17 00:00:00 2001 From: Kesha Hietala Date: Tue, 21 Nov 2023 17:45:39 -0500 Subject: [PATCH 36/57] more cleanup --- cedar-lean/Cedar/Spec/Expr.lean | 11 ++--- cedar-lean/Cedar/Spec/Ext.lean | 3 +- cedar-lean/Cedar/Spec/ExtFun.lean | 3 +- cedar-lean/Cedar/Spec/Value.lean | 9 +--- cedar-lean/Cedar/Validation/Types.lean | 24 +++-------- cedar-lean/Cedar/Validation/Validator.lean | 4 +- cedar-lean/Cli/Main.lean | 50 ++++++---------------- cedar-lean/DiffTest/Main.lean | 6 ++- 8 files changed, 32 insertions(+), 78 deletions(-) diff --git a/cedar-lean/Cedar/Spec/Expr.lean b/cedar-lean/Cedar/Spec/Expr.lean index e32fbea75..6558682a2 100644 --- a/cedar-lean/Cedar/Spec/Expr.lean +++ b/cedar-lean/Cedar/Spec/Expr.lean @@ -66,16 +66,11 @@ inductive Expr where ----- Derivations ----- -deriving instance Repr, DecidableEq for Var -deriving instance Repr, DecidableEq for UnaryOp -deriving instance Repr, DecidableEq for BinaryOp +deriving instance Repr, DecidableEq, Inhabited for Var +deriving instance Repr, DecidableEq, Inhabited for UnaryOp +deriving instance Repr, DecidableEq, Inhabited for BinaryOp deriving instance Repr, Inhabited for Expr -deriving instance Inhabited for Var -deriving instance Inhabited for UnaryOp -deriving instance Inhabited for BinaryOp -deriving instance Inhabited for Expr - mutual -- We should be able to get rid of this manual deriviation eventually. diff --git a/cedar-lean/Cedar/Spec/Ext.lean b/cedar-lean/Cedar/Spec/Ext.lean index 95a6ce854..169cbe55b 100644 --- a/cedar-lean/Cedar/Spec/Ext.lean +++ b/cedar-lean/Cedar/Spec/Ext.lean @@ -39,8 +39,7 @@ def Ext.lt : Ext → Ext → Bool ----- Derivations ----- -deriving instance Repr, DecidableEq for Ext -deriving instance Inhabited for Ext +deriving instance Repr, DecidableEq, Inhabited for Ext instance : LT Ext where lt := fun x y => Ext.lt x y diff --git a/cedar-lean/Cedar/Spec/ExtFun.lean b/cedar-lean/Cedar/Spec/ExtFun.lean index 6cedc9c4a..f99b67c74 100644 --- a/cedar-lean/Cedar/Spec/ExtFun.lean +++ b/cedar-lean/Cedar/Spec/ExtFun.lean @@ -64,7 +64,6 @@ def call : ExtFun → List Value → Result Value ----- Derivations ----- -deriving instance Repr, DecidableEq for ExtFun -deriving instance Inhabited for ExtFun +deriving instance Repr, DecidableEq, Inhabited for ExtFun end Cedar.Spec diff --git a/cedar-lean/Cedar/Spec/Value.lean b/cedar-lean/Cedar/Spec/Value.lean index 03b696942..eb87cf7c8 100644 --- a/cedar-lean/Cedar/Spec/Value.lean +++ b/cedar-lean/Cedar/Spec/Value.lean @@ -131,14 +131,11 @@ instance : Coe Value (Result (Data.Set Value)) where deriving instance Repr, DecidableEq, BEq for Except deriving instance Repr, DecidableEq for Error -deriving instance Repr, DecidableEq, Inhabited for Name +deriving instance Repr, DecidableEq, Inhabited, Lean.ToJson for Name deriving instance Repr, DecidableEq, Inhabited for EntityType deriving instance Repr, DecidableEq, Inhabited for EntityUID deriving instance Repr, DecidableEq, Inhabited for Prim -deriving instance Repr for Value - - -deriving instance Lean.ToJson for Name +deriving instance Repr, Inhabited for Value mutual @@ -304,6 +301,4 @@ instance : LT Value where instance Value.decLt (n m : Value) : Decidable (n < m) := if h : Value.lt n m then isTrue h else isFalse h -deriving instance Inhabited for Value - end Cedar.Spec diff --git a/cedar-lean/Cedar/Validation/Types.lean b/cedar-lean/Cedar/Validation/Types.lean index 2acbe2fe7..bef03369b 100644 --- a/cedar-lean/Cedar/Validation/Types.lean +++ b/cedar-lean/Cedar/Validation/Types.lean @@ -110,17 +110,10 @@ def ActionStore.descendentOf (as : ActionStore) (uid₁ uid₂ : EntityUID) : B ----- Derivations ----- -deriving instance Repr for BoolType -deriving instance Repr for ExtType -deriving instance Repr for Qualified -deriving instance Repr for CedarType -deriving instance Repr for TypeError - -deriving instance Repr for EntityTypeStoreEntry -deriving instance Repr for ActionStoreEntry - -deriving instance DecidableEq for BoolType -deriving instance DecidableEq for ExtType +deriving instance Repr, DecidableEq for BoolType +deriving instance Repr, DecidableEq, Inhabited for ExtType +deriving instance Repr, DecidableEq, Inhabited for Qualified +deriving instance Repr, Inhabited for CedarType mutual @@ -193,11 +186,8 @@ end instance : DecidableEq CedarType := decCedarType -deriving instance DecidableEq for Qualified -deriving instance DecidableEq for TypeError - -deriving instance Inhabited for Qualified -deriving instance Inhabited for ExtType -deriving instance Inhabited for CedarType +deriving instance Repr, DecidableEq for TypeError +deriving instance Repr for EntityTypeStoreEntry +deriving instance Repr for ActionStoreEntry end Cedar.Validation diff --git a/cedar-lean/Cedar/Validation/Validator.lean b/cedar-lean/Cedar/Validation/Validator.lean index ebe15eac8..615bcf569 100644 --- a/cedar-lean/Cedar/Validation/Validator.lean +++ b/cedar-lean/Cedar/Validation/Validator.lean @@ -149,8 +149,6 @@ deriving instance Repr for SchemaActionEntry deriving instance Repr for Schema deriving instance Repr for ValidationError -deriving instance Lean.ToJson for Except - /- Lossy serialization of errors to Json. This serialization provides some extra information to DRT without having to derive `Lean.ToJson` for `Expr` and `CedarType`. @@ -168,6 +166,8 @@ def validationErrorToJson : ValidationError → Lean.Json instance : Lean.ToJson ValidationError where toJson := validationErrorToJson +-- Used to serialize `ValidationResult` +deriving instance Lean.ToJson for Except instance : Lean.ToJson Unit where toJson := λ _ => Lean.Json.null diff --git a/cedar-lean/Cli/Main.lean b/cedar-lean/Cli/Main.lean index 378e3463e..628b5d4a1 100644 --- a/cedar-lean/Cli/Main.lean +++ b/cedar-lean/Cli/Main.lean @@ -16,29 +16,14 @@ import Lean.Data.Json.FromToJson -import Cedar.Spec -import Cedar.Validation +import DiffTest.Main import DiffTest.Parser +/-! This file provides a basic command line interface for authorization + and validation. It uses the interface functions defined in `Difftest`. -/ -/-! This file defines the public interfaces for the Lean implementation. - The input and output are stringified JSON objects. -/ - -open Cedar.Spec -open Cedar.Validation -open Cedar.Data open DiffTest -def fileStream (filename : System.FilePath) : IO (Option IO.FS.Stream) := do - let fileExists ← filename.pathExists - if not fileExists then - let stderr ← IO.getStderr - stderr.putStrLn s!"File not found: {filename}" - pure none - else - let handle ← IO.FS.Handle.mk filename IO.FS.Mode.read - pure (some (IO.FS.Stream.ofHandle handle)) - def readFile (filename : String) : IO String := IO.FS.readFile filename @@ -50,24 +35,13 @@ def main (args : List String) : IO Unit := | 2 => do let command := args.get! 0 let filename := args.get! 1 - let req ← readFile filename - let json := Lean.Json.parse req - match json with - | .error e => panic! s!"Failed to parse input: {e}" - | .ok json => - match command with - | "authorize" => - let request := jsonToRequest (getJsonField json "request") - let entities := jsonToEntities (getJsonField json "entities") - let policies := jsonToPolicies (getJsonField json "policies") - let response := isAuthorized request entities policies - let json := Lean.toJson response - IO.println (toString json) - | "validate" => - let policies := jsonToPolicies (getJsonField json "policies") - let schema := jsonToSchema (getJsonField json "schema") - let response := validate policies schema - let json := Lean.toJson response - IO.println (toString json) - | _ => printUsage s!"Invalid command `{command}` (expected `authorize` or `validate`)" + let request ← readFile filename + match command with + | "authorize" => + let response := isAuthorizedDRT request + IO.println response + | "validate" => + let response := validateDRT request + IO.println response + | _ => printUsage s!"Invalid command `{command}` (expected `authorize` or `validate`)" | n => printUsage s!"Incorrect number of arguments (expected 2, but got {n})" diff --git a/cedar-lean/DiffTest/Main.lean b/cedar-lean/DiffTest/Main.lean index 52284d767..26efd94ef 100644 --- a/cedar-lean/DiffTest/Main.lean +++ b/cedar-lean/DiffTest/Main.lean @@ -38,7 +38,8 @@ open Cedar.Validation let entities := jsonToEntities (getJsonField json "entities") let policies := jsonToPolicies (getJsonField json "policies") let response := isAuthorized request entities policies - toString (Lean.toJson response) + let json := Lean.toJson response + toString json @[export validateDRT] def validateDRT (req : String) : String := let json := Lean.Json.parse req @@ -48,6 +49,7 @@ open Cedar.Validation let policies := jsonToPolicies (getJsonField json "policies") let schema := jsonToSchema (getJsonField json "schema") let response := validate policies schema - toString (Lean.toJson response) + let json := Lean.toJson response + toString json end DiffTest From e547ea3debc74b82a5c5828c33b6fbbc1e6104f1 Mon Sep 17 00:00:00 2001 From: Kesha Hietala Date: Wed, 29 Nov 2023 10:46:06 -0500 Subject: [PATCH 37/57] pulling in Lean changes from main --- cedar | 2 +- cedar-lean/.gitignore | 1 - cedar-lean/Cedar/Spec/Ext/Decimal.lean | 6 +- cedar-lean/Cedar/Spec/Response.lean | 6 +- cedar-lean/Cedar/Validation/Subtyping.lean | 21 +- cedar-lean/Cedar/Validation/Typechecker.lean | 25 +- cedar-lean/Cedar/Validation/Types.lean | 7 +- .../Cli/json-inputs/authorize/decimal1.json | 1332 --------------- .../Cli/json-inputs/authorize/decimal2.json | 822 +++++----- .../Cli/json-inputs/authorize/example1a.json | 717 -------- .../Cli/json-inputs/authorize/example2a.json | 276 ++-- .../Cli/json-inputs/authorize/example2b.json | 717 -------- .../Cli/json-inputs/authorize/example2c.json | 260 +-- .../Cli/json-inputs/authorize/example3a.json | 705 -------- .../Cli/json-inputs/authorize/example3b.json | 737 --------- .../Cli/json-inputs/authorize/example3c.json | 707 -------- .../Cli/json-inputs/authorize/example4a.json | 1344 --------------- .../Cli/json-inputs/authorize/example4d.json | 1285 --------------- .../Cli/json-inputs/authorize/example4e.json | 1286 --------------- .../Cli/json-inputs/authorize/example4f.json | 1340 --------------- .../Cli/json-inputs/authorize/example5b.json | 780 ++++----- cedar-lean/Cli/json-inputs/authorize/ip1.json | 756 --------- cedar-lean/Cli/json-inputs/authorize/ip2.json | 806 --------- cedar-lean/Cli/json-inputs/authorize/ip3.json | 248 +-- .../Cli/json-inputs/authorize/multi1.json | 320 ++-- .../Cli/json-inputs/authorize/multi2.json | 768 --------- .../Cli/json-inputs/authorize/multi3.json | 1439 ----------------- .../Cli/json-inputs/authorize/multi4.json | 930 +++++------ .../Cli/json-inputs/validate/decimal1.json | 883 ---------- .../Cli/json-inputs/validate/decimal2.json | 412 +++-- .../Cli/json-inputs/validate/example1a.json | 802 --------- .../Cli/json-inputs/validate/example2a.json | 583 ++++--- .../Cli/json-inputs/validate/example2b.json | 802 --------- .../Cli/json-inputs/validate/example2c.json | 579 ++++--- .../Cli/json-inputs/validate/example3a.json | 790 --------- .../Cli/json-inputs/validate/example3b.json | 822 ---------- .../Cli/json-inputs/validate/example3c.json | 792 --------- .../Cli/json-inputs/validate/example4a.json | 919 ----------- .../Cli/json-inputs/validate/example4d.json | 860 ---------- .../Cli/json-inputs/validate/example4e.json | 861 ---------- .../Cli/json-inputs/validate/example4f.json | 915 ----------- .../Cli/json-inputs/validate/example5b.json | 414 +++-- cedar-lean/Cli/json-inputs/validate/ip1.json | 841 ---------- cedar-lean/Cli/json-inputs/validate/ip2.json | 891 ---------- cedar-lean/Cli/json-inputs/validate/ip3.json | 609 +++---- .../Cli/json-inputs/validate/multi1.json | 539 +++--- .../Cli/json-inputs/validate/multi2.json | 853 ---------- .../Cli/json-inputs/validate/multi3.json | 990 ------------ .../Cli/json-inputs/validate/multi4.json | 490 +++--- cedar-lean/DiffTest.lean | 19 - cedar-lean/DiffTest/Parser.lean | 6 +- cedar-lean/README.md | 35 +- cedar-lean/lakefile.lean | 4 +- 53 files changed, 3882 insertions(+), 29472 deletions(-) delete mode 100644 cedar-lean/Cli/json-inputs/authorize/decimal1.json delete mode 100644 cedar-lean/Cli/json-inputs/authorize/example1a.json delete mode 100644 cedar-lean/Cli/json-inputs/authorize/example2b.json delete mode 100644 cedar-lean/Cli/json-inputs/authorize/example3a.json delete mode 100644 cedar-lean/Cli/json-inputs/authorize/example3b.json delete mode 100644 cedar-lean/Cli/json-inputs/authorize/example3c.json delete mode 100644 cedar-lean/Cli/json-inputs/authorize/example4a.json delete mode 100644 cedar-lean/Cli/json-inputs/authorize/example4d.json delete mode 100644 cedar-lean/Cli/json-inputs/authorize/example4e.json delete mode 100644 cedar-lean/Cli/json-inputs/authorize/example4f.json delete mode 100644 cedar-lean/Cli/json-inputs/authorize/ip1.json delete mode 100644 cedar-lean/Cli/json-inputs/authorize/ip2.json delete mode 100644 cedar-lean/Cli/json-inputs/authorize/multi2.json delete mode 100644 cedar-lean/Cli/json-inputs/authorize/multi3.json delete mode 100644 cedar-lean/Cli/json-inputs/validate/decimal1.json delete mode 100644 cedar-lean/Cli/json-inputs/validate/example1a.json delete mode 100644 cedar-lean/Cli/json-inputs/validate/example2b.json delete mode 100644 cedar-lean/Cli/json-inputs/validate/example3a.json delete mode 100644 cedar-lean/Cli/json-inputs/validate/example3b.json delete mode 100644 cedar-lean/Cli/json-inputs/validate/example3c.json delete mode 100644 cedar-lean/Cli/json-inputs/validate/example4a.json delete mode 100644 cedar-lean/Cli/json-inputs/validate/example4d.json delete mode 100644 cedar-lean/Cli/json-inputs/validate/example4e.json delete mode 100644 cedar-lean/Cli/json-inputs/validate/example4f.json delete mode 100644 cedar-lean/Cli/json-inputs/validate/ip1.json delete mode 100644 cedar-lean/Cli/json-inputs/validate/ip2.json delete mode 100644 cedar-lean/Cli/json-inputs/validate/multi2.json delete mode 100644 cedar-lean/Cli/json-inputs/validate/multi3.json delete mode 100644 cedar-lean/DiffTest.lean diff --git a/cedar b/cedar index 13e3eeda7..a9d2ed5a5 160000 --- a/cedar +++ b/cedar @@ -1 +1 @@ -Subproject commit 13e3eeda734988b92b5760246d78c4204dd91e5b +Subproject commit a9d2ed5a59052df73ebe1a89e2b5827ac1664925 diff --git a/cedar-lean/.gitignore b/cedar-lean/.gitignore index bd043b696..f1d686650 100644 --- a/cedar-lean/.gitignore +++ b/cedar-lean/.gitignore @@ -5,4 +5,3 @@ !lake-manifest.json *.olean -!/diff_test_jsons/*.json \ No newline at end of file diff --git a/cedar-lean/Cedar/Spec/Ext/Decimal.lean b/cedar-lean/Cedar/Spec/Ext/Decimal.lean index 1e9162d6f..c295bb82f 100644 --- a/cedar-lean/Cedar/Spec/Ext/Decimal.lean +++ b/cedar-lean/Cedar/Spec/Ext/Decimal.lean @@ -65,9 +65,6 @@ def le (d₁ d₂ : Decimal) : Bool := d₁.1 ≤ d₂.1 ----- Derivations ----- -instance : Inhabited Decimal where - default := Subtype.mk 0 (by simp) - instance : LT Decimal where lt := fun d₁ d₂ => Decimal.lt d₁ d₂ @@ -80,6 +77,9 @@ if h : Decimal.lt d₁ d₂ then isTrue h else isFalse h instance decLe (d₁ d₂ : Decimal) : Decidable (d₁ ≤ d₂) := if h : Decimal.le d₁ d₂ then isTrue h else isFalse h +instance : Inhabited Decimal where + default := Subtype.mk 0 (by simp) + end Decimal end Cedar.Spec.Ext diff --git a/cedar-lean/Cedar/Spec/Response.lean b/cedar-lean/Cedar/Spec/Response.lean index c85b72fce..77d0c6d27 100644 --- a/cedar-lean/Cedar/Spec/Response.lean +++ b/cedar-lean/Cedar/Spec/Response.lean @@ -29,16 +29,14 @@ open Cedar.Data inductive Decision where | allow | deny -deriving Repr, DecidableEq structure Response where decision : Decision policies : Set PolicyID -deriving Repr, DecidableEq ----- Derivations ----- -deriving instance Lean.ToJson for Decision -deriving instance Lean.ToJson for Response +deriving instance Repr, DecidableEq, Lean.ToJson for Decision +deriving instance Repr, DecidableEq, Lean.ToJson for Response end Cedar.Spec diff --git a/cedar-lean/Cedar/Validation/Subtyping.lean b/cedar-lean/Cedar/Validation/Subtyping.lean index 8b5ea1090..f20e95141 100644 --- a/cedar-lean/Cedar/Validation/Subtyping.lean +++ b/cedar-lean/Cedar/Validation/Subtyping.lean @@ -46,18 +46,15 @@ mutual def lub? (ty₁ ty₂ : CedarType) : Option CedarType := - if ty₁ == ty₂ - then .some ty₁ - else - match ty₁, ty₂ with - | .bool b₁, .bool b₂ => .some (.bool (lubBool b₁ b₂)) - | .set s₁, .set s₂ => do - let lub ← lub? s₁ s₂ - .some (.set lub) - | .record (.mk r₁), .record (.mk r₂) => do - let lub ← lubRecordType r₁ r₂ - .some (.record (Map.mk lub)) - | _, _ => .none + match ty₁, ty₂ with + | .bool b₁, .bool b₂ => .some (.bool (lubBool b₁ b₂)) + | .set s₁, .set s₂ => do + let lub ← lub? s₁ s₂ + .some (.set lub) + | .record (.mk r₁), .record (.mk r₂) => do + let lub ← lubRecordType r₁ r₂ + .some (.record (Map.mk lub)) + | _, _ => if ty₁ = ty₂ then .some ty₁ else .none end def subty (ty₁ ty₂ : CedarType) : Bool := diff --git a/cedar-lean/Cedar/Validation/Typechecker.lean b/cedar-lean/Cedar/Validation/Typechecker.lean index b9a7e4c31..ffc160e0f 100644 --- a/cedar-lean/Cedar/Validation/Typechecker.lean +++ b/cedar-lean/Cedar/Validation/Typechecker.lean @@ -64,7 +64,7 @@ def typeOfIf (r₁ : CedarType × Capabilities) (r₂ r₃ : ResultType) : Resul match r₁ with | (.bool .tt, c₁) => do let (ty₂, c₂) ← r₂ - ok ty₂ (c₁.union c₂) + ok ty₂ (c₁ ∪ c₂) | (.bool .ff, _) => r₃ | (.bool .anyBool, c₁) => do let (ty₂, c₂) ← r₂ @@ -89,12 +89,16 @@ def typeOfAnd (r₁ : CedarType × Capabilities) (r₂ : ResultType) : ResultTyp def typeOfOr (r₁ : CedarType × Capabilities) (r₂ : ResultType) : ResultType := match r₁ with | (.bool .tt, _) => ok (.bool .tt) - | (.bool .ff, _) => r₂ - | (.bool ty₁, c₁) => do + | (.bool .ff, _) => do + let (ty₂, c₂) ← r₂ + match ty₂ with + | .bool _ => ok ty₂ c₂ + | _ => err (.unexpectedType ty₂) + | (.bool _, c₁) => do let (ty₂, c₂) ← r₂ match ty₂ with | .bool .tt => ok (.bool .tt) - | .bool .ff => ok (.bool ty₁) c₁ + | .bool .ff => ok (.bool .anyBool) c₁ | .bool _ => ok (.bool .anyBool) (c₁ ∩ c₂) | _ => err (.unexpectedType ty₂) | (ty₁, _) => err (.unexpectedType ty₁) @@ -174,21 +178,20 @@ def typeOfBinaryApp (op₂ : BinaryOp) (ty₁ ty₂ : CedarType) (x₁ x₂ : Ex | .containsAny, .set ty₃, .set ty₄ => ifLubThenBool ty₃ ty₄ | _, _, _ => err (.unexpectedType ty₁) -def hasAttrInRecord (rty : RecordType) (x : Expr) (a : Attr) (c : Capabilities) : ResultType := +def hasAttrInRecord (rty : RecordType) (x : Expr) (a : Attr) (c : Capabilities) (knownToExist : Bool) : ResultType := match rty.find? a with - | .some (.required _) => ok (.bool .tt) - | .some (.optional _) => - if (x, a) ∈ c + | .some qty => + if (x, a) ∈ c || (qty.isRequired && knownToExist) then ok (.bool .tt) else ok (.bool .anyBool) (Capabilities.singleton x a) - | .none => ok (.bool .ff) + | .none => ok (.bool .ff) def typeOfHasAttr (ty : CedarType) (x : Expr) (a : Attr) (c : Capabilities) (env : Environment) : ResultType := match ty with - | .record rty => hasAttrInRecord rty x a c + | .record rty => hasAttrInRecord rty x a c true | .entity ety => match env.ets.attrs? ety with - | .some rty => hasAttrInRecord rty x a c + | .some rty => hasAttrInRecord rty x a c false | .none => err (.unknownEntity ety) | _ => err (.unexpectedType ty) diff --git a/cedar-lean/Cedar/Validation/Types.lean b/cedar-lean/Cedar/Validation/Types.lean index bef03369b..0dce04cec 100644 --- a/cedar-lean/Cedar/Validation/Types.lean +++ b/cedar-lean/Cedar/Validation/Types.lean @@ -114,6 +114,9 @@ deriving instance Repr, DecidableEq for BoolType deriving instance Repr, DecidableEq, Inhabited for ExtType deriving instance Repr, DecidableEq, Inhabited for Qualified deriving instance Repr, Inhabited for CedarType +deriving instance Repr for TypeError +deriving instance Repr for EntityTypeStoreEntry +deriving instance Repr for ActionStoreEntry mutual @@ -186,8 +189,6 @@ end instance : DecidableEq CedarType := decCedarType -deriving instance Repr, DecidableEq for TypeError -deriving instance Repr for EntityTypeStoreEntry -deriving instance Repr for ActionStoreEntry +deriving instance DecidableEq for TypeError end Cedar.Validation diff --git a/cedar-lean/Cli/json-inputs/authorize/decimal1.json b/cedar-lean/Cli/json-inputs/authorize/decimal1.json deleted file mode 100644 index 8c888c389..000000000 --- a/cedar-lean/Cli/json-inputs/authorize/decimal1.json +++ /dev/null @@ -1,1332 +0,0 @@ -{ - "request": { - "principal": { - "Known": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - }, - "action": { - "Known": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource": { - "Known": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - } - }, - "context": { - "expr_kind": { - "Record": { - "authenticated": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "confidence_score": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "decimal", - "path": [] - }, - "args": [ - { - "expr_kind": { - "Lit": { - "String": "0.8" - } - }, - "source_info": null, - "data": null - } - ] - } - }, - "source_info": null, - "data": null - }, - "source_ip": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "ip", - "path": [] - }, - "args": [ - { - "expr_kind": { - "Lit": { - "String": "123.123.123.123" - } - }, - "source_info": null, - "data": null - } - ] - } - }, - "source_info": null, - "data": null - } - } - }, - "source_info": null, - "data": null - } - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": "Any" - }, - "action_constraint": { - "Eq": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource_constraint": { - "constraint": { - "Eq": { - "EUID": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "greaterThan", - "path": [] - }, - "args": [ - { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "context" - }, - "source_info": { - "start": 102, - "end": 109 - }, - "data": null - }, - "attr": "confidence_score" - } - }, - "source_info": { - "start": 102, - "end": 155 - }, - "data": null - }, - { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "decimal", - "path": [] - }, - "args": [ - { - "expr_kind": { - "Lit": { - "String": "0.75" - } - }, - "source_info": { - "start": 147, - "end": 153 - }, - "data": null - } - ] - } - }, - "source_info": { - "start": 139, - "end": 154 - }, - "data": null - } - ] - } - }, - "source_info": { - "start": 102, - "end": 155 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "entities": { - "entities": [ - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - }, - "attrs": { - "owner": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "prototype_v0.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "prototype_v0.jpg" - }, - "attrs": { - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "ahmad" - } - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "device_prototypes" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "stacey" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "stacey" - }, - "attrs": { - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "owner": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "stacey" - } - } - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "giuseppe" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "giuseppe" - }, - "attrs": { - "jobLevel": { - "expr_kind": { - "Lit": { - "Long": 7 - } - }, - "source_info": null, - "data": null - }, - "department": { - "expr_kind": { - "Lit": { - "String": "CustomerSupport" - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "AVTeam" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "alice_friends" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "alice_friends" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "sales_projections.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "sales_projections.jpg" - }, - "attrs": { - "admins": { - "expr_kind": { - "Set": [ - { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "giuseppe" - } - } - }, - "source_info": null, - "data": null - } - ] - }, - "source_info": null, - "data": null - }, - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "stacey" - } - } - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "stacey" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "device_prototypes" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "device_prototypes" - }, - "attrs": { - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - }, - "attrs": { - "owner": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "stacey" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "stacey" - }, - "attrs": { - "department": { - "expr_kind": { - "Lit": { - "String": "Sales" - } - }, - "source_info": null, - "data": null - }, - "jobLevel": { - "expr_kind": { - "Lit": { - "Long": 6 - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "alice_friends" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "alice_vacation" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "alice_vacation" - }, - "attrs": { - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - }, - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "ahmad" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "ahmad" - }, - "attrs": { - "department": { - "expr_kind": { - "Lit": { - "String": "HardwareEngineering" - } - }, - "source_info": null, - "data": null - }, - "jobLevel": { - "expr_kind": { - "Lit": { - "Long": 4 - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "ahmad" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "ahmad" - }, - "attrs": { - "owner": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "ahmad" - } - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "vacation.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "vacation.jpg" - }, - "attrs": { - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - }, - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - }, - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "alice_vacation" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "AVTeam" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "AVTeam" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "alice_w2.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "alice_w2.jpg" - }, - "attrs": { - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - }, - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - }, - "attrs": { - "jobLevel": { - "expr_kind": { - "Lit": { - "Long": 5 - } - }, - "source_info": null, - "data": null - }, - "department": { - "expr_kind": { - "Lit": { - "String": "HardwareEngineering" - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "AVTeam" - }, - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "alice_friends" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "attrs": {}, - "ancestors": [] - } - ] - ] - } -} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/authorize/decimal2.json b/cedar-lean/Cli/json-inputs/authorize/decimal2.json index 18af5d916..c7c0f5561 100644 --- a/cedar-lean/Cli/json-inputs/authorize/decimal2.json +++ b/cedar-lean/Cli/json-inputs/authorize/decimal2.json @@ -291,54 +291,6 @@ }, "entities": { "entities": [ - [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "alice_friends" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "alice_friends" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "attrs": {}, - "ancestors": [] - } - ], [ { "ty": { @@ -347,7 +299,7 @@ "path": [] } }, - "eid": "prototype_v0.jpg" + "eid": "vacation.jpg" }, { "uid": { @@ -357,44 +309,53 @@ "path": [] } }, - "eid": "prototype_v0.jpg" + "eid": "vacation.jpg" }, "attrs": { - "private": { + "account": { "expr_kind": { "Lit": { - "Bool": false + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } } }, "source_info": null, "data": null }, - "admins": { + "private": { "expr_kind": { - "Set": [] + "Lit": { + "Bool": false + } }, "source_info": null, "data": null }, - "account": { + "admins": { "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "ahmad" - } - } + "Set": [] }, "source_info": null, "data": null } }, "ancestors": [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, { "ty": { "Specified": { @@ -402,7 +363,16 @@ "path": [] } }, - "eid": "device_prototypes" + "eid": "alice_vacation" + }, + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" } ] } @@ -411,53 +381,58 @@ { "ty": { "Specified": { - "id": "User", + "id": "Account", "path": [] } }, - "eid": "giuseppe" + "eid": "stacey" }, { "uid": { "ty": { "Specified": { - "id": "User", + "id": "Account", "path": [] } }, - "eid": "giuseppe" + "eid": "stacey" }, "attrs": { - "jobLevel": { + "owner": { "expr_kind": { "Lit": { - "Long": 7 + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "stacey" + } } }, "source_info": null, "data": null }, - "department": { + "private": { "expr_kind": { "Lit": { - "String": "CustomerSupport" + "Bool": false } }, "source_info": null, "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } + }, + "admins": { + "expr_kind": { + "Set": [] }, - "eid": "AVTeam" + "source_info": null, + "data": null } - ] + }, + "ancestors": [] } ], [ @@ -468,7 +443,7 @@ "path": [] } }, - "eid": "edit" + "eid": "listPhotos" }, { "uid": { @@ -478,7 +453,7 @@ "path": [] } }, - "eid": "edit" + "eid": "listPhotos" }, "attrs": {}, "ancestors": [] @@ -488,68 +463,24 @@ { "ty": { "Specified": { - "id": "Account", + "id": "Action", "path": [] } }, - "eid": "alice" + "eid": "edit" }, { "uid": { "ty": { "Specified": { - "id": "Account", + "id": "Action", "path": [] } }, - "eid": "alice" - }, - "attrs": { - "owner": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - } + "eid": "edit" }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - } - ] + "attrs": {}, + "ancestors": [] } ], [ @@ -560,7 +491,7 @@ "path": [] } }, - "eid": "ahmad" + "eid": "giuseppe" }, { "uid": { @@ -570,29 +501,39 @@ "path": [] } }, - "eid": "ahmad" + "eid": "giuseppe" }, "attrs": { - "jobLevel": { + "department": { "expr_kind": { "Lit": { - "Long": 4 + "String": "CustomerSupport" } }, "source_info": null, "data": null }, - "department": { + "jobLevel": { "expr_kind": { "Lit": { - "String": "HardwareEngineering" + "Long": 7 } }, "source_info": null, "data": null } }, - "ancestors": [] + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + } + ] } ], [ @@ -603,7 +544,7 @@ "path": [] } }, - "eid": "addPhoto" + "eid": "listAlbums" }, { "uid": { @@ -613,7 +554,7 @@ "path": [] } }, - "eid": "addPhoto" + "eid": "listAlbums" }, "attrs": {}, "ancestors": [] @@ -627,7 +568,7 @@ "path": [] } }, - "eid": "delete" + "eid": "view" }, { "uid": { @@ -637,7 +578,7 @@ "path": [] } }, - "eid": "delete" + "eid": "view" }, "attrs": {}, "ancestors": [] @@ -647,51 +588,51 @@ { "ty": { "Specified": { - "id": "Account", + "id": "Photo", "path": [] } }, - "eid": "ahmad" + "eid": "alice_w2.jpg" }, { "uid": { "ty": { "Specified": { - "id": "Account", + "id": "Photo", "path": [] } }, - "eid": "ahmad" + "eid": "alice_w2.jpg" }, "attrs": { - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "owner": { + "account": { "expr_kind": { "Lit": { "EntityUID": { "ty": { "Specified": { - "id": "User", + "id": "Account", "path": [] } }, - "eid": "ahmad" + "eid": "alice" } } }, "source_info": null, "data": null }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, "private": { "expr_kind": { "Lit": { - "Bool": false + "Bool": true } }, "source_info": null, @@ -707,6 +648,15 @@ } }, "eid": "GeronimoTeam" + }, + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" } ] } @@ -715,21 +665,21 @@ { "ty": { "Specified": { - "id": "Photo", + "id": "Album", "path": [] } }, - "eid": "vacation.jpg" + "eid": "device_prototypes" }, { "uid": { "ty": { "Specified": { - "id": "Photo", + "id": "Album", "path": [] } }, - "eid": "vacation.jpg" + "eid": "device_prototypes" }, "attrs": { "private": { @@ -741,13 +691,6 @@ "source_info": null, "data": null }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, "account": { "expr_kind": { "Lit": { @@ -764,37 +707,16 @@ }, "source_info": null, "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - }, - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "alice_vacation" }, - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } + "admins": { + "expr_kind": { + "Set": [] }, - "eid": "alice" + "source_info": null, + "data": null } - ] + }, + "ancestors": [] } ], [ @@ -829,7 +751,7 @@ "path": [] } }, - "eid": "view" + "eid": "comment" }, { "uid": { @@ -839,7 +761,7 @@ "path": [] } }, - "eid": "view" + "eid": "comment" }, "attrs": {}, "ancestors": [] @@ -849,21 +771,21 @@ { "ty": { "Specified": { - "id": "Account", + "id": "AccountGroup", "path": [] } }, - "eid": "stacey" + "eid": "GeronimoTeam" }, { "uid": { "ty": { "Specified": { - "id": "Account", + "id": "AccountGroup", "path": [] } }, - "eid": "stacey" + "eid": "GeronimoTeam" }, "attrs": { "owner": { @@ -876,31 +798,92 @@ "path": [] } }, - "eid": "stacey" + "eid": "alice" } } }, "source_info": null, "data": null + } + }, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } }, - "admins": { + "eid": "alice_friends" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "stacey" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "stacey" + }, + "attrs": { + "jobLevel": { "expr_kind": { - "Set": [] + "Lit": { + "Long": 6 + } }, "source_info": null, "data": null }, - "private": { + "department": { "expr_kind": { "Lit": { - "Bool": false + "String": "Sales" } }, "source_info": null, "data": null } }, - "ancestors": [] + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + } + ] } ], [ @@ -911,7 +894,7 @@ "path": [] } }, - "eid": "listAlbums" + "eid": "addPhoto" }, { "uid": { @@ -921,7 +904,7 @@ "path": [] } }, - "eid": "listAlbums" + "eid": "addPhoto" }, "attrs": {}, "ancestors": [] @@ -931,24 +914,163 @@ { "ty": { "Specified": { - "id": "Action", + "id": "Album", "path": [] } }, - "eid": "listPhotos" + "eid": "alice_vacation" }, { "uid": { "ty": { "Specified": { - "id": "Action", + "id": "Album", "path": [] } }, - "eid": "listPhotos" + "eid": "alice_vacation" }, - "attrs": {}, - "ancestors": [] + "attrs": { + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + }, + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + ] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "sales_projections.jpg" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Photo", + "path": [] + } + }, + "eid": "sales_projections.jpg" + }, + "attrs": { + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + } + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [ + { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "giuseppe" + } + } + }, + "source_info": null, + "data": null + } + ] + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + } + ] } ], [ @@ -959,7 +1081,7 @@ "path": [] } }, - "eid": "stacey" + "eid": "alice" }, { "uid": { @@ -969,22 +1091,22 @@ "path": [] } }, - "eid": "stacey" + "eid": "alice" }, "attrs": { - "department": { + "jobLevel": { "expr_kind": { "Lit": { - "String": "Sales" + "Long": 5 } }, "source_info": null, "data": null }, - "jobLevel": { + "department": { "expr_kind": { "Lit": { - "Long": 6 + "String": "HardwareEngineering" } }, "source_info": null, @@ -992,6 +1114,15 @@ } }, "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + }, { "ty": { "Specified": { @@ -1008,30 +1139,30 @@ { "ty": { "Specified": { - "id": "Album", + "id": "Account", "path": [] } }, - "eid": "device_prototypes" + "eid": "alice" }, { "uid": { "ty": { "Specified": { - "id": "Album", + "id": "Account", "path": [] } }, - "eid": "device_prototypes" + "eid": "alice" }, "attrs": { - "account": { + "owner": { "expr_kind": { "Lit": { "EntityUID": { "ty": { "Specified": { - "id": "Account", + "id": "User", "path": [] } }, @@ -1059,42 +1190,53 @@ "data": null } }, - "ancestors": [] + "ancestors": [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + } + ] } ], [ { "ty": { "Specified": { - "id": "AccountGroup", + "id": "User", "path": [] } }, - "eid": "GeronimoTeam" + "eid": "ahmad" }, { "uid": { "ty": { "Specified": { - "id": "AccountGroup", + "id": "User", "path": [] } }, - "eid": "GeronimoTeam" + "eid": "ahmad" }, "attrs": { - "owner": { + "jobLevel": { "expr_kind": { "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } + "Long": 4 + } + }, + "source_info": null, + "data": null + }, + "department": { + "expr_kind": { + "Lit": { + "String": "HardwareEngineering" } }, "source_info": null, @@ -1112,7 +1254,7 @@ "path": [] } }, - "eid": "sales_projections.jpg" + "eid": "prototype_v0.jpg" }, { "uid": { @@ -1122,30 +1264,12 @@ "path": [] } }, - "eid": "sales_projections.jpg" + "eid": "prototype_v0.jpg" }, "attrs": { "admins": { "expr_kind": { - "Set": [ - { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "giuseppe" - } - } - }, - "source_info": null, - "data": null - } - ] + "Set": [] }, "source_info": null, "data": null @@ -1160,7 +1284,7 @@ "path": [] } }, - "eid": "stacey" + "eid": "ahmad" } } }, @@ -1181,73 +1305,11 @@ { "ty": { "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "stacey" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - }, - "attrs": { - "jobLevel": { - "expr_kind": { - "Lit": { - "Long": 5 - } - }, - "source_info": null, - "data": null - }, - "department": { - "expr_kind": { - "Lit": { - "String": "HardwareEngineering" - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "AVTeam" - }, - { - "ty": { - "Specified": { - "id": "UserGroup", + "id": "Album", "path": [] } }, - "eid": "alice_friends" + "eid": "device_prototypes" } ] } @@ -1256,98 +1318,45 @@ { "ty": { "Specified": { - "id": "Photo", + "id": "Action", "path": [] } }, - "eid": "alice_w2.jpg" + "eid": "delete" }, { "uid": { "ty": { "Specified": { - "id": "Photo", + "id": "Action", "path": [] } }, - "eid": "alice_w2.jpg" - }, - "attrs": { - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": null, - "data": null - }, - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - } + "eid": "delete" }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - }, - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - ] + "attrs": {}, + "ancestors": [] } ], [ { "ty": { "Specified": { - "id": "Album", + "id": "Account", "path": [] } }, - "eid": "alice_vacation" + "eid": "ahmad" }, { "uid": { "ty": { "Specified": { - "id": "Album", + "id": "Account", "path": [] } }, - "eid": "alice_vacation" + "eid": "ahmad" }, "attrs": { "admins": { @@ -1357,17 +1366,17 @@ "source_info": null, "data": null }, - "account": { + "owner": { "expr_kind": { "Lit": { "EntityUID": { "ty": { "Specified": { - "id": "Account", + "id": "User", "path": [] } }, - "eid": "alice" + "eid": "ahmad" } } }, @@ -1393,15 +1402,6 @@ } }, "eid": "GeronimoTeam" - }, - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" } ] } diff --git a/cedar-lean/Cli/json-inputs/authorize/example1a.json b/cedar-lean/Cli/json-inputs/authorize/example1a.json deleted file mode 100644 index f2096d5ce..000000000 --- a/cedar-lean/Cli/json-inputs/authorize/example1a.json +++ /dev/null @@ -1,717 +0,0 @@ -{ - "request": { - "principal": { - "Known": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - }, - "action": { - "Known": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource": { - "Known": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - } - }, - "context": { - "expr_kind": { - "Record": { - "authenticated": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": null, - "data": null - }, - "confidence_score": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "decimal", - "path": [] - }, - "args": [ - { - "expr_kind": { - "Lit": { - "String": "0.6" - } - }, - "source_info": null, - "data": null - } - ] - } - }, - "source_info": null, - "data": null - }, - "source_ip": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "ip", - "path": [] - }, - "args": [ - { - "expr_kind": { - "Lit": { - "String": "123.123.123.123" - } - }, - "source_info": null, - "data": null - } - ] - } - }, - "source_info": null, - "data": null - } - } - }, - "source_info": null, - "data": null - } - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": { - "Eq": { - "EUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - } - } - }, - "action_constraint": { - "Eq": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource_constraint": { - "constraint": { - "Eq": { - "EUID": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": { - "start": 56, - "end": 168 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "entities": { - "entities": [ - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "bob" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "bob" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Administrator", - "path": [] - } - }, - "eid": "ahmad" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Administrator", - "path": [] - } - }, - "eid": "ahmad" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "bob" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "bob" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Video", - "path": [] - } - }, - "eid": "surf.mp4" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Video", - "path": [] - } - }, - "eid": "surf.mp4" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - }, - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "jane_friends" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "jane_friends" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "passportscan.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "passportscan.jpg" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "selfie.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "selfie.jpg" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "bob" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "tim" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "tim" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "jane_friends" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - }, - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "jane_friends" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "attrs": {}, - "ancestors": [] - } - ] - ] - } -} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/authorize/example2a.json b/cedar-lean/Cli/json-inputs/authorize/example2a.json index fa6bed243..152c8d5a4 100644 --- a/cedar-lean/Cli/json-inputs/authorize/example2a.json +++ b/cedar-lean/Cli/json-inputs/authorize/example2a.json @@ -172,64 +172,69 @@ { "ty": { "Specified": { - "id": "Photo", + "id": "Action", "path": [] } }, - "eid": "VacationPhoto94.jpg" + "eid": "edit" }, { "uid": { "ty": { "Specified": { - "id": "Photo", + "id": "Action", "path": [] } }, - "eid": "VacationPhoto94.jpg" + "eid": "edit" }, "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - }, - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] } - ] + }, + "eid": "listAlbums" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "attrs": {}, + "ancestors": [] } ], [ { "ty": { "Specified": { - "id": "UserGroup", + "id": "User", "path": [] } }, - "eid": "jane_friends" + "eid": "bob" }, { "uid": { "ty": { "Specified": { - "id": "UserGroup", + "id": "User", "path": [] } }, - "eid": "jane_friends" + "eid": "bob" }, "attrs": {}, "ancestors": [] @@ -243,7 +248,7 @@ "path": [] } }, - "eid": "selfie.jpg" + "eid": "passportscan.jpg" }, { "uid": { @@ -253,7 +258,7 @@ "path": [] } }, - "eid": "selfie.jpg" + "eid": "passportscan.jpg" }, "attrs": {}, "ancestors": [ @@ -264,7 +269,7 @@ "path": [] } }, - "eid": "bob" + "eid": "jane" } ] } @@ -297,7 +302,7 @@ { "ty": { "Specified": { - "id": "User", + "id": "Account", "path": [] } }, @@ -307,7 +312,7 @@ "uid": { "ty": { "Specified": { - "id": "User", + "id": "Account", "path": [] } }, @@ -325,7 +330,7 @@ "path": [] } }, - "eid": "delete" + "eid": "comment" }, { "uid": { @@ -335,7 +340,7 @@ "path": [] } }, - "eid": "delete" + "eid": "comment" }, "attrs": {}, "ancestors": [] @@ -345,24 +350,34 @@ { "ty": { "Specified": { - "id": "Action", + "id": "Photo", "path": [] } }, - "eid": "view" + "eid": "selfie.jpg" }, { "uid": { "ty": { "Specified": { - "id": "Action", + "id": "Photo", "path": [] } }, - "eid": "view" + "eid": "selfie.jpg" }, "attrs": {}, - "ancestors": [] + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + } + ] } ], [ @@ -397,7 +412,7 @@ "path": [] } }, - "eid": "listPhotos" + "eid": "delete" }, { "uid": { @@ -407,46 +422,12 @@ "path": [] } }, - "eid": "listPhotos" + "eid": "delete" }, "attrs": {}, "ancestors": [] } ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "tim" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "tim" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "jane_friends" - } - ] - } - ], [ { "ty": { @@ -455,7 +436,7 @@ "path": [] } }, - "eid": "edit" + "eid": "view" }, { "uid": { @@ -465,7 +446,7 @@ "path": [] } }, - "eid": "edit" + "eid": "view" }, "attrs": {}, "ancestors": [] @@ -475,69 +456,55 @@ { "ty": { "Specified": { - "id": "Action", + "id": "Album", "path": [] } }, - "eid": "comment" + "eid": "jane_vacation" }, { "uid": { "ty": { "Specified": { - "id": "Action", + "id": "Album", "path": [] } }, - "eid": "comment" + "eid": "jane_vacation" }, "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" } - }, - "eid": "bob" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "bob" - }, - "attrs": {}, - "ancestors": [] + ] } ], [ { "ty": { "Specified": { - "id": "Action", + "id": "UserGroup", "path": [] } }, - "eid": "addPhoto" + "eid": "jane_friends" }, { "uid": { "ty": { "Specified": { - "id": "Action", + "id": "UserGroup", "path": [] } }, - "eid": "addPhoto" + "eid": "jane_friends" }, "attrs": {}, "ancestors": [] @@ -547,32 +514,32 @@ { "ty": { "Specified": { - "id": "Album", + "id": "User", "path": [] } }, - "eid": "jane_vacation" + "eid": "alice" }, { "uid": { "ty": { "Specified": { - "id": "Album", + "id": "User", "path": [] } }, - "eid": "jane_vacation" + "eid": "alice" }, "attrs": {}, "ancestors": [ { "ty": { "Specified": { - "id": "Account", + "id": "UserGroup", "path": [] } }, - "eid": "jane" + "eid": "jane_friends" } ] } @@ -585,7 +552,7 @@ "path": [] } }, - "eid": "alice" + "eid": "tim" }, { "uid": { @@ -595,7 +562,7 @@ "path": [] } }, - "eid": "alice" + "eid": "tim" }, "attrs": {}, "ancestors": [ @@ -615,21 +582,21 @@ { "ty": { "Specified": { - "id": "Video", + "id": "Photo", "path": [] } }, - "eid": "surf.mp4" + "eid": "VacationPhoto94.jpg" }, { "uid": { "ty": { "Specified": { - "id": "Video", + "id": "Photo", "path": [] } }, - "eid": "surf.mp4" + "eid": "VacationPhoto94.jpg" }, "attrs": {}, "ancestors": [ @@ -658,34 +625,24 @@ { "ty": { "Specified": { - "id": "Photo", + "id": "Action", "path": [] } }, - "eid": "passportscan.jpg" + "eid": "addPhoto" }, { "uid": { "ty": { "Specified": { - "id": "Photo", + "id": "Action", "path": [] } }, - "eid": "passportscan.jpg" + "eid": "addPhoto" }, "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - } - ] + "ancestors": [] } ], [ @@ -696,7 +653,7 @@ "path": [] } }, - "eid": "listAlbums" + "eid": "listPhotos" }, { "uid": { @@ -706,11 +663,54 @@ "path": [] } }, - "eid": "listAlbums" + "eid": "listPhotos" }, "attrs": {}, "ancestors": [] } + ], + [ + { + "ty": { + "Specified": { + "id": "Video", + "path": [] + } + }, + "eid": "surf.mp4" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Video", + "path": [] + } + }, + "eid": "surf.mp4" + }, + "attrs": {}, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] + } ] ] } diff --git a/cedar-lean/Cli/json-inputs/authorize/example2b.json b/cedar-lean/Cli/json-inputs/authorize/example2b.json deleted file mode 100644 index e726ec89f..000000000 --- a/cedar-lean/Cli/json-inputs/authorize/example2b.json +++ /dev/null @@ -1,717 +0,0 @@ -{ - "request": { - "principal": { - "Known": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - }, - "action": { - "Known": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource": { - "Known": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - } - }, - "context": { - "expr_kind": { - "Record": { - "authenticated": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": null, - "data": null - }, - "confidence_score": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "decimal", - "path": [] - }, - "args": [ - { - "expr_kind": { - "Lit": { - "String": "0.6" - } - }, - "source_info": null, - "data": null - } - ] - } - }, - "source_info": null, - "data": null - }, - "source_ip": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "ip", - "path": [] - }, - "args": [ - { - "expr_kind": { - "Lit": { - "String": "123.123.123.123" - } - }, - "source_info": null, - "data": null - } - ] - } - }, - "source_info": null, - "data": null - } - } - }, - "source_info": null, - "data": null - } - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": { - "Eq": { - "EUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - } - } - }, - "action_constraint": { - "Eq": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource_constraint": { - "constraint": { - "In": { - "EUID": { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": { - "start": 68, - "end": 174 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "entities": { - "entities": [ - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "tim" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "tim" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "jane_friends" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "bob" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "bob" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "bob" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "bob" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "jane_friends" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Administrator", - "path": [] - } - }, - "eid": "ahmad" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Administrator", - "path": [] - } - }, - "eid": "ahmad" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "jane_friends" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "jane_friends" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - }, - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "passportscan.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "passportscan.jpg" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "selfie.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "selfie.jpg" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "bob" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Video", - "path": [] - } - }, - "eid": "surf.mp4" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Video", - "path": [] - } - }, - "eid": "surf.mp4" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - }, - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - } - ] - } - ] - ] - } -} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/authorize/example2c.json b/cedar-lean/Cli/json-inputs/authorize/example2c.json index f1f307b5a..b224e4e77 100644 --- a/cedar-lean/Cli/json-inputs/authorize/example2c.json +++ b/cedar-lean/Cli/json-inputs/authorize/example2c.json @@ -192,21 +192,21 @@ { "ty": { "Specified": { - "id": "Account", + "id": "Action", "path": [] } }, - "eid": "jane" + "eid": "edit" }, { "uid": { "ty": { "Specified": { - "id": "Account", + "id": "Action", "path": [] } }, - "eid": "jane" + "eid": "edit" }, "attrs": {}, "ancestors": [] @@ -216,90 +216,99 @@ { "ty": { "Specified": { - "id": "Photo", + "id": "UserGroup", "path": [] } }, - "eid": "passportscan.jpg" + "eid": "jane_friends" }, { "uid": { "ty": { "Specified": { - "id": "Photo", + "id": "UserGroup", "path": [] } }, - "eid": "passportscan.jpg" + "eid": "jane_friends" }, "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - } - ] + "ancestors": [] } ], [ { "ty": { "Specified": { - "id": "Administrator", + "id": "Photo", "path": [] } }, - "eid": "ahmad" + "eid": "selfie.jpg" }, { "uid": { "ty": { "Specified": { - "id": "Administrator", + "id": "Photo", "path": [] } }, - "eid": "ahmad" + "eid": "selfie.jpg" }, "attrs": {}, - "ancestors": [] + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + } + ] } ], [ { "ty": { "Specified": { - "id": "User", + "id": "Photo", "path": [] } }, - "eid": "alice" + "eid": "VacationPhoto94.jpg" }, { "uid": { "ty": { "Specified": { - "id": "User", + "id": "Photo", "path": [] } }, - "eid": "alice" + "eid": "VacationPhoto94.jpg" }, "attrs": {}, "ancestors": [ { "ty": { "Specified": { - "id": "UserGroup", + "id": "Album", "path": [] } }, - "eid": "jane_friends" + "eid": "jane_vacation" + }, + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" } ] } @@ -308,7 +317,7 @@ { "ty": { "Specified": { - "id": "Account", + "id": "User", "path": [] } }, @@ -318,7 +327,7 @@ "uid": { "ty": { "Specified": { - "id": "Account", + "id": "User", "path": [] } }, @@ -332,45 +341,55 @@ { "ty": { "Specified": { - "id": "Action", + "id": "User", "path": [] } }, - "eid": "view" + "eid": "alice" }, { "uid": { "ty": { "Specified": { - "id": "Action", + "id": "User", "path": [] } }, - "eid": "view" + "eid": "alice" }, "attrs": {}, - "ancestors": [] + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + } + ] } ], [ { "ty": { "Specified": { - "id": "Action", + "id": "Account", "path": [] } }, - "eid": "listAlbums" + "eid": "bob" }, { "uid": { "ty": { "Specified": { - "id": "Action", + "id": "Account", "path": [] } }, - "eid": "listAlbums" + "eid": "bob" }, "attrs": {}, "ancestors": [] @@ -380,21 +399,21 @@ { "ty": { "Specified": { - "id": "Action", + "id": "Administrator", "path": [] } }, - "eid": "comment" + "eid": "ahmad" }, { "uid": { "ty": { "Specified": { - "id": "Action", + "id": "Administrator", "path": [] } }, - "eid": "comment" + "eid": "ahmad" }, "attrs": {}, "ancestors": [] @@ -404,34 +423,24 @@ { "ty": { "Specified": { - "id": "Photo", + "id": "Account", "path": [] } }, - "eid": "selfie.jpg" + "eid": "jane" }, { "uid": { "ty": { "Specified": { - "id": "Photo", + "id": "Account", "path": [] } }, - "eid": "selfie.jpg" + "eid": "jane" }, "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "bob" - } - ] + "ancestors": [] } ], [ @@ -476,7 +485,7 @@ "path": [] } }, - "eid": "addPhoto" + "eid": "listAlbums" }, { "uid": { @@ -486,7 +495,7 @@ "path": [] } }, - "eid": "addPhoto" + "eid": "listAlbums" }, "attrs": {}, "ancestors": [] @@ -496,45 +505,64 @@ { "ty": { "Specified": { - "id": "User", + "id": "Video", "path": [] } }, - "eid": "bob" + "eid": "surf.mp4" }, { "uid": { "ty": { "Specified": { - "id": "User", + "id": "Video", "path": [] } }, - "eid": "bob" + "eid": "surf.mp4" }, "attrs": {}, - "ancestors": [] + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "jane" + } + ] } ], [ { "ty": { "Specified": { - "id": "UserGroup", + "id": "Action", "path": [] } }, - "eid": "jane_friends" + "eid": "view" }, { "uid": { "ty": { "Specified": { - "id": "UserGroup", + "id": "Action", "path": [] } }, - "eid": "jane_friends" + "eid": "view" }, "attrs": {}, "ancestors": [] @@ -544,24 +572,34 @@ { "ty": { "Specified": { - "id": "Action", + "id": "User", "path": [] } }, - "eid": "delete" + "eid": "tim" }, { "uid": { "ty": { "Specified": { - "id": "Action", + "id": "User", "path": [] } }, - "eid": "delete" + "eid": "tim" }, "attrs": {}, - "ancestors": [] + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + } + ] } ], [ @@ -572,7 +610,7 @@ "path": [] } }, - "eid": "listPhotos" + "eid": "comment" }, { "uid": { @@ -582,7 +620,7 @@ "path": [] } }, - "eid": "listPhotos" + "eid": "comment" }, "attrs": {}, "ancestors": [] @@ -596,7 +634,7 @@ "path": [] } }, - "eid": "edit" + "eid": "listPhotos" }, { "uid": { @@ -606,7 +644,7 @@ "path": [] } }, - "eid": "edit" + "eid": "listPhotos" }, "attrs": {}, "ancestors": [] @@ -616,77 +654,48 @@ { "ty": { "Specified": { - "id": "User", + "id": "Action", "path": [] } }, - "eid": "tim" + "eid": "delete" }, { "uid": { "ty": { "Specified": { - "id": "User", + "id": "Action", "path": [] } }, - "eid": "tim" + "eid": "delete" }, "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "jane_friends" - } - ] + "ancestors": [] } ], [ { "ty": { "Specified": { - "id": "Video", + "id": "Action", "path": [] } }, - "eid": "surf.mp4" + "eid": "addPhoto" }, { "uid": { "ty": { "Specified": { - "id": "Video", + "id": "Action", "path": [] } }, - "eid": "surf.mp4" + "eid": "addPhoto" }, "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - }, - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - } - ] + "ancestors": [] } ], [ @@ -697,7 +706,7 @@ "path": [] } }, - "eid": "VacationPhoto94.jpg" + "eid": "passportscan.jpg" }, { "uid": { @@ -707,19 +716,10 @@ "path": [] } }, - "eid": "VacationPhoto94.jpg" + "eid": "passportscan.jpg" }, "attrs": {}, "ancestors": [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - }, { "ty": { "Specified": { diff --git a/cedar-lean/Cli/json-inputs/authorize/example3a.json b/cedar-lean/Cli/json-inputs/authorize/example3a.json deleted file mode 100644 index acabaf5a3..000000000 --- a/cedar-lean/Cli/json-inputs/authorize/example3a.json +++ /dev/null @@ -1,705 +0,0 @@ -{ - "request": { - "principal": { - "Known": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - }, - "action": { - "Known": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource": { - "Known": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - } - }, - "context": { - "expr_kind": { - "Record": { - "authenticated": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": null, - "data": null - }, - "confidence_score": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "decimal", - "path": [] - }, - "args": [ - { - "expr_kind": { - "Lit": { - "String": "0.6" - } - }, - "source_info": null, - "data": null - } - ] - } - }, - "source_info": null, - "data": null - }, - "source_ip": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "ip", - "path": [] - }, - "args": [ - { - "expr_kind": { - "Lit": { - "String": "123.123.123.123" - } - }, - "source_info": null, - "data": null - } - ] - } - }, - "source_info": null, - "data": null - } - } - }, - "source_info": null, - "data": null - } - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": "Any" - }, - "action_constraint": { - "Eq": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource_constraint": { - "constraint": { - "In": { - "EUID": { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": { - "start": 63, - "end": 152 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "entities": { - "entities": [ - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "bob" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "bob" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "jane_friends" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Administrator", - "path": [] - } - }, - "eid": "ahmad" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Administrator", - "path": [] - } - }, - "eid": "ahmad" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - }, - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Video", - "path": [] - } - }, - "eid": "surf.mp4" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Video", - "path": [] - } - }, - "eid": "surf.mp4" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - }, - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "jane_friends" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "jane_friends" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "tim" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "tim" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "jane_friends" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "selfie.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "selfie.jpg" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "bob" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "passportscan.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "passportscan.jpg" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "bob" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "bob" - }, - "attrs": {}, - "ancestors": [] - } - ] - ] - } -} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/authorize/example3b.json b/cedar-lean/Cli/json-inputs/authorize/example3b.json deleted file mode 100644 index d8c71260d..000000000 --- a/cedar-lean/Cli/json-inputs/authorize/example3b.json +++ /dev/null @@ -1,737 +0,0 @@ -{ - "request": { - "principal": { - "Known": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - }, - "action": { - "Known": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource": { - "Known": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - } - }, - "context": { - "expr_kind": { - "Record": { - "authenticated": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": null, - "data": null - }, - "confidence_score": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "decimal", - "path": [] - }, - "args": [ - { - "expr_kind": { - "Lit": { - "String": "0.6" - } - }, - "source_info": null, - "data": null - } - ] - } - }, - "source_info": null, - "data": null - }, - "source_ip": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "ip", - "path": [] - }, - "args": [ - { - "expr_kind": { - "Lit": { - "String": "123.123.123.123" - } - }, - "source_info": null, - "data": null - } - ] - } - }, - "source_info": null, - "data": null - } - } - }, - "source_info": null, - "data": null - } - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": { - "Eq": { - "EUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - } - } - }, - "action_constraint": { - "In": [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - ] - }, - "resource_constraint": { - "constraint": { - "In": { - "EUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": { - "start": 86, - "end": 231 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "entities": { - "entities": [ - [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "bob" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "bob" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Administrator", - "path": [] - } - }, - "eid": "ahmad" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Administrator", - "path": [] - } - }, - "eid": "ahmad" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Video", - "path": [] - } - }, - "eid": "surf.mp4" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Video", - "path": [] - } - }, - "eid": "surf.mp4" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - }, - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "jane_friends" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "tim" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "tim" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "jane_friends" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "passportscan.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "passportscan.jpg" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "bob" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "bob" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "selfie.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "selfie.jpg" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "bob" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "jane_friends" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "jane_friends" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - }, - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - } - ] - } - ] - ] - } -} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/authorize/example3c.json b/cedar-lean/Cli/json-inputs/authorize/example3c.json deleted file mode 100644 index c1e51a49a..000000000 --- a/cedar-lean/Cli/json-inputs/authorize/example3c.json +++ /dev/null @@ -1,707 +0,0 @@ -{ - "request": { - "principal": { - "Known": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - }, - "action": { - "Known": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource": { - "Known": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - } - }, - "context": { - "expr_kind": { - "Record": { - "authenticated": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": null, - "data": null - }, - "confidence_score": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "decimal", - "path": [] - }, - "args": [ - { - "expr_kind": { - "Lit": { - "String": "0.6" - } - }, - "source_info": null, - "data": null - } - ] - } - }, - "source_info": null, - "data": null - }, - "source_ip": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "ip", - "path": [] - }, - "args": [ - { - "expr_kind": { - "Lit": { - "String": "123.123.123.123" - } - }, - "source_info": null, - "data": null - } - ] - } - }, - "source_info": null, - "data": null - } - } - }, - "source_info": null, - "data": null - } - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": { - "Eq": { - "EUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - } - } - }, - "action_constraint": "Any", - "resource_constraint": { - "constraint": { - "In": { - "EUID": { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": { - "start": 85, - "end": 173 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "entities": { - "entities": [ - [ - { - "ty": { - "Specified": { - "id": "Video", - "path": [] - } - }, - "eid": "surf.mp4" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Video", - "path": [] - } - }, - "eid": "surf.mp4" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - }, - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "selfie.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "selfie.jpg" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "bob" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "bob" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "bob" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "tim" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "tim" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "jane_friends" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "jane_friends" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "jane_friends" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "jane_friends" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Administrator", - "path": [] - } - }, - "eid": "ahmad" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Administrator", - "path": [] - } - }, - "eid": "ahmad" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "passportscan.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "passportscan.jpg" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - }, - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "bob" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "bob" - }, - "attrs": {}, - "ancestors": [] - } - ] - ] - } -} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/authorize/example4a.json b/cedar-lean/Cli/json-inputs/authorize/example4a.json deleted file mode 100644 index 46b7a1343..000000000 --- a/cedar-lean/Cli/json-inputs/authorize/example4a.json +++ /dev/null @@ -1,1344 +0,0 @@ -{ - "request": { - "principal": { - "Known": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - }, - "action": { - "Known": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource": { - "Known": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "prototype_v0.jpg" - } - }, - "context": { - "expr_kind": { - "Record": { - "authenticated": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": null, - "data": null - } - } - }, - "source_info": null, - "data": null - } - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": "Any" - }, - "action_constraint": { - "In": [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - ] - }, - "resource_constraint": { - "constraint": { - "In": { - "EUID": { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "device_prototypes" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "And": { - "left": { - "expr_kind": { - "BinaryApp": { - "op": "Eq", - "arg1": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "principal" - }, - "source_info": { - "start": 257, - "end": 266 - }, - "data": null - }, - "attr": "department" - } - }, - "source_info": { - "start": 257, - "end": 277 - }, - "data": null - }, - "arg2": { - "expr_kind": { - "Lit": { - "String": "HardwareEngineering" - } - }, - "source_info": { - "start": 281, - "end": 302 - }, - "data": null - } - } - }, - "source_info": { - "start": 257, - "end": 302 - }, - "data": null - }, - "right": { - "expr_kind": { - "UnaryApp": { - "op": "Not", - "arg": { - "expr_kind": { - "BinaryApp": { - "op": "Less", - "arg1": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "principal" - }, - "source_info": { - "start": 306, - "end": 315 - }, - "data": null - }, - "attr": "jobLevel" - } - }, - "source_info": { - "start": 306, - "end": 324 - }, - "data": null - }, - "arg2": { - "expr_kind": { - "Lit": { - "Long": 5 - } - }, - "source_info": { - "start": 328, - "end": 329 - }, - "data": null - } - } - }, - "source_info": { - "start": 306, - "end": 329 - }, - "data": null - } - } - }, - "source_info": { - "start": 306, - "end": 329 - }, - "data": null - } - } - }, - "source_info": { - "start": 257, - "end": 329 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "entities": { - "entities": [ - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "device_prototypes" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "device_prototypes" - }, - "attrs": { - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "stacey" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "stacey" - }, - "attrs": { - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "owner": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "stacey" - } - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - }, - "attrs": { - "jobLevel": { - "expr_kind": { - "Lit": { - "Long": 5 - } - }, - "source_info": null, - "data": null - }, - "department": { - "expr_kind": { - "Lit": { - "String": "HardwareEngineering" - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "alice_friends" - }, - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "AVTeam" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "ahmad" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "ahmad" - }, - "attrs": { - "jobLevel": { - "expr_kind": { - "Lit": { - "Long": 4 - } - }, - "source_info": null, - "data": null - }, - "department": { - "expr_kind": { - "Lit": { - "String": "HardwareEngineering" - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - }, - "attrs": { - "owner": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "ahmad" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "ahmad" - }, - "attrs": { - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "owner": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "ahmad" - } - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - }, - "attrs": { - "owner": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "sales_projections.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "sales_projections.jpg" - }, - "attrs": { - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [ - { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "giuseppe" - } - } - }, - "source_info": null, - "data": null - } - ] - }, - "source_info": null, - "data": null - }, - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "stacey" - } - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "stacey" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "AVTeam" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "AVTeam" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "alice_w2.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "alice_w2.jpg" - }, - "attrs": { - "private": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - }, - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "stacey" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "stacey" - }, - "attrs": { - "jobLevel": { - "expr_kind": { - "Lit": { - "Long": 6 - } - }, - "source_info": null, - "data": null - }, - "department": { - "expr_kind": { - "Lit": { - "String": "Sales" - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "alice_friends" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "alice_friends" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "alice_friends" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "giuseppe" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "giuseppe" - }, - "attrs": { - "department": { - "expr_kind": { - "Lit": { - "String": "CustomerSupport" - } - }, - "source_info": null, - "data": null - }, - "jobLevel": { - "expr_kind": { - "Lit": { - "Long": 7 - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "AVTeam" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "prototype_v0.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "prototype_v0.jpg" - }, - "attrs": { - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "ahmad" - } - } - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "device_prototypes" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "vacation.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "vacation.jpg" - }, - "attrs": { - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - }, - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "alice_vacation" - }, - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "alice_vacation" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "alice_vacation" - }, - "attrs": { - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - }, - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - ] - } - ] - ] - } -} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/authorize/example4d.json b/cedar-lean/Cli/json-inputs/authorize/example4d.json deleted file mode 100644 index 133354dc5..000000000 --- a/cedar-lean/Cli/json-inputs/authorize/example4d.json +++ /dev/null @@ -1,1285 +0,0 @@ -{ - "request": { - "principal": { - "Known": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - }, - "action": { - "Known": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource": { - "Known": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "vacation.jpg" - } - }, - "context": { - "expr_kind": { - "Record": { - "authenticated": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": null, - "data": null - } - } - }, - "source_info": null, - "data": null - } - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": "Any" - }, - "action_constraint": "Any", - "resource_constraint": { - "constraint": "Any" - }, - "non_head_constraints": { - "expr_kind": { - "And": { - "left": { - "expr_kind": { - "HasAttr": { - "expr": { - "expr_kind": { - "Var": "resource" - }, - "source_info": { - "start": 337, - "end": 345 - }, - "data": null - }, - "attr": "account" - } - }, - "source_info": { - "start": 337, - "end": 357 - }, - "data": null - }, - "right": { - "expr_kind": { - "BinaryApp": { - "op": "Eq", - "arg1": { - "expr_kind": { - "Var": "principal" - }, - "source_info": { - "start": 361, - "end": 370 - }, - "data": null - }, - "arg2": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "resource" - }, - "source_info": { - "start": 374, - "end": 382 - }, - "data": null - }, - "attr": "account" - } - }, - "source_info": { - "start": 374, - "end": 396 - }, - "data": null - }, - "attr": "owner" - } - }, - "source_info": { - "start": 374, - "end": 396 - }, - "data": null - } - } - }, - "source_info": { - "start": 361, - "end": 396 - }, - "data": null - } - } - }, - "source_info": { - "start": 337, - "end": 396 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "entities": { - "entities": [ - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "ahmad" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "ahmad" - }, - "attrs": { - "department": { - "expr_kind": { - "Lit": { - "String": "HardwareEngineering" - } - }, - "source_info": null, - "data": null - }, - "jobLevel": { - "expr_kind": { - "Lit": { - "Long": 4 - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "stacey" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "stacey" - }, - "attrs": { - "department": { - "expr_kind": { - "Lit": { - "String": "Sales" - } - }, - "source_info": null, - "data": null - }, - "jobLevel": { - "expr_kind": { - "Lit": { - "Long": 6 - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "alice_friends" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "prototype_v0.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "prototype_v0.jpg" - }, - "attrs": { - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "ahmad" - } - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "device_prototypes" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - }, - "attrs": { - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "owner": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "AVTeam" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "AVTeam" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - }, - "attrs": { - "owner": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "stacey" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "stacey" - }, - "attrs": { - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "owner": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "stacey" - } - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - } - }, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - }, - "attrs": { - "jobLevel": { - "expr_kind": { - "Lit": { - "Long": 5 - } - }, - "source_info": null, - "data": null - }, - "department": { - "expr_kind": { - "Lit": { - "String": "HardwareEngineering" - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "alice_friends" - }, - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "AVTeam" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "giuseppe" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "giuseppe" - }, - "attrs": { - "department": { - "expr_kind": { - "Lit": { - "String": "CustomerSupport" - } - }, - "source_info": null, - "data": null - }, - "jobLevel": { - "expr_kind": { - "Lit": { - "Long": 7 - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "AVTeam" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "alice_w2.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "alice_w2.jpg" - }, - "attrs": { - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - }, - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "sales_projections.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "sales_projections.jpg" - }, - "attrs": { - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [ - { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "giuseppe" - } - } - }, - "source_info": null, - "data": null - } - ] - }, - "source_info": null, - "data": null - }, - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "stacey" - } - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "stacey" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "ahmad" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "ahmad" - }, - "attrs": { - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "owner": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "ahmad" - } - } - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "device_prototypes" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "device_prototypes" - }, - "attrs": { - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - } - }, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "alice_friends" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "alice_friends" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "alice_vacation" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "alice_vacation" - }, - "attrs": { - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - }, - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "vacation.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "vacation.jpg" - }, - "attrs": { - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "alice_vacation" - }, - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - }, - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - ] - } - ] - ] - } -} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/authorize/example4e.json b/cedar-lean/Cli/json-inputs/authorize/example4e.json deleted file mode 100644 index 58b660690..000000000 --- a/cedar-lean/Cli/json-inputs/authorize/example4e.json +++ /dev/null @@ -1,1286 +0,0 @@ -{ - "request": { - "principal": { - "Known": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - }, - "action": { - "Known": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource": { - "Known": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "vacation.jpg" - } - }, - "context": { - "expr_kind": { - "Record": { - "authenticated": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": null, - "data": null - } - } - }, - "source_info": null, - "data": null - } - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": "Any" - }, - "action_constraint": { - "Eq": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource_constraint": { - "constraint": "Any" - }, - "non_head_constraints": { - "expr_kind": { - "BinaryApp": { - "op": "Eq", - "arg1": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "principal" - }, - "source_info": { - "start": 337, - "end": 346 - }, - "data": null - }, - "attr": "department" - } - }, - "source_info": { - "start": 337, - "end": 357 - }, - "data": null - }, - "arg2": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "resource" - }, - "source_info": { - "start": 361, - "end": 369 - }, - "data": null - }, - "attr": "account" - } - }, - "source_info": { - "start": 361, - "end": 394 - }, - "data": null - }, - "attr": "owner" - } - }, - "source_info": { - "start": 361, - "end": 394 - }, - "data": null - }, - "attr": "department" - } - }, - "source_info": { - "start": 361, - "end": 394 - }, - "data": null - } - } - }, - "source_info": { - "start": 337, - "end": 394 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "entities": { - "entities": [ - [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - }, - "attrs": { - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "owner": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "stacey" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "stacey" - }, - "attrs": { - "jobLevel": { - "expr_kind": { - "Lit": { - "Long": 6 - } - }, - "source_info": null, - "data": null - }, - "department": { - "expr_kind": { - "Lit": { - "String": "Sales" - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "alice_friends" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "device_prototypes" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "device_prototypes" - }, - "attrs": { - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - } - }, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "prototype_v0.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "prototype_v0.jpg" - }, - "attrs": { - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "ahmad" - } - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "device_prototypes" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - }, - "attrs": { - "department": { - "expr_kind": { - "Lit": { - "String": "HardwareEngineering" - } - }, - "source_info": null, - "data": null - }, - "jobLevel": { - "expr_kind": { - "Lit": { - "Long": 5 - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "AVTeam" - }, - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "alice_friends" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "alice_vacation" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "alice_vacation" - }, - "attrs": { - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - }, - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - }, - "attrs": { - "owner": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "ahmad" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "ahmad" - }, - "attrs": { - "jobLevel": { - "expr_kind": { - "Lit": { - "Long": 4 - } - }, - "source_info": null, - "data": null - }, - "department": { - "expr_kind": { - "Lit": { - "String": "HardwareEngineering" - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "vacation.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "vacation.jpg" - }, - "attrs": { - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - }, - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - }, - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "alice_vacation" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "alice_friends" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "alice_friends" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "AVTeam" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "AVTeam" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "ahmad" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "ahmad" - }, - "attrs": { - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "owner": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "ahmad" - } - } - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "alice_w2.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "alice_w2.jpg" - }, - "attrs": { - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - }, - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "giuseppe" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "giuseppe" - }, - "attrs": { - "department": { - "expr_kind": { - "Lit": { - "String": "CustomerSupport" - } - }, - "source_info": null, - "data": null - }, - "jobLevel": { - "expr_kind": { - "Lit": { - "Long": 7 - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "AVTeam" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "sales_projections.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "sales_projections.jpg" - }, - "attrs": { - "admins": { - "expr_kind": { - "Set": [ - { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "giuseppe" - } - } - }, - "source_info": null, - "data": null - } - ] - }, - "source_info": null, - "data": null - }, - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "stacey" - } - } - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "stacey" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "stacey" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "stacey" - }, - "attrs": { - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "owner": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "stacey" - } - } - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "attrs": {}, - "ancestors": [] - } - ] - ] - } -} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/authorize/example4f.json b/cedar-lean/Cli/json-inputs/authorize/example4f.json deleted file mode 100644 index 5d420aa4d..000000000 --- a/cedar-lean/Cli/json-inputs/authorize/example4f.json +++ /dev/null @@ -1,1340 +0,0 @@ -{ - "request": { - "principal": { - "Known": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - }, - "action": { - "Known": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource": { - "Known": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "vacation.jpg" - } - }, - "context": { - "expr_kind": { - "Record": { - "authenticated": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": null, - "data": null - } - } - }, - "source_info": null, - "data": null - } - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": "Any" - }, - "action_constraint": "Any", - "resource_constraint": { - "constraint": "Any" - }, - "non_head_constraints": { - "expr_kind": { - "Or": { - "left": { - "expr_kind": { - "And": { - "left": { - "expr_kind": { - "HasAttr": { - "expr": { - "expr_kind": { - "Var": "resource" - }, - "source_info": { - "start": 364, - "end": 372 - }, - "data": null - }, - "attr": "account" - } - }, - "source_info": { - "start": 364, - "end": 384 - }, - "data": null - }, - "right": { - "expr_kind": { - "BinaryApp": { - "op": "Eq", - "arg1": { - "expr_kind": { - "Var": "principal" - }, - "source_info": { - "start": 388, - "end": 397 - }, - "data": null - }, - "arg2": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "resource" - }, - "source_info": { - "start": 401, - "end": 409 - }, - "data": null - }, - "attr": "account" - } - }, - "source_info": { - "start": 401, - "end": 423 - }, - "data": null - }, - "attr": "owner" - } - }, - "source_info": { - "start": 401, - "end": 423 - }, - "data": null - } - } - }, - "source_info": { - "start": 388, - "end": 423 - }, - "data": null - } - } - }, - "source_info": { - "start": 364, - "end": 423 - }, - "data": null - }, - "right": { - "expr_kind": { - "BinaryApp": { - "op": "Contains", - "arg1": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "resource" - }, - "source_info": { - "start": 430, - "end": 438 - }, - "data": null - }, - "attr": "admins" - } - }, - "source_info": { - "start": 430, - "end": 465 - }, - "data": null - }, - "arg2": { - "expr_kind": { - "Var": "principal" - }, - "source_info": { - "start": 455, - "end": 464 - }, - "data": null - } - } - }, - "source_info": { - "start": 430, - "end": 465 - }, - "data": null - } - } - }, - "source_info": { - "start": 363, - "end": 465 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "entities": { - "entities": [ - [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "AVTeam" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "AVTeam" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "sales_projections.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "sales_projections.jpg" - }, - "attrs": { - "admins": { - "expr_kind": { - "Set": [ - { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "giuseppe" - } - } - }, - "source_info": null, - "data": null - } - ] - }, - "source_info": null, - "data": null - }, - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "stacey" - } - } - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "stacey" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "alice_w2.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "alice_w2.jpg" - }, - "attrs": { - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - }, - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "ahmad" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "ahmad" - }, - "attrs": { - "jobLevel": { - "expr_kind": { - "Lit": { - "Long": 4 - } - }, - "source_info": null, - "data": null - }, - "department": { - "expr_kind": { - "Lit": { - "String": "HardwareEngineering" - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - }, - "attrs": { - "jobLevel": { - "expr_kind": { - "Lit": { - "Long": 5 - } - }, - "source_info": null, - "data": null - }, - "department": { - "expr_kind": { - "Lit": { - "String": "HardwareEngineering" - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "AVTeam" - }, - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "alice_friends" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "alice_vacation" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "alice_vacation" - }, - "attrs": { - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - }, - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - }, - "attrs": { - "owner": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "vacation.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "vacation.jpg" - }, - "attrs": { - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - }, - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - }, - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "alice_vacation" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "stacey" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "stacey" - }, - "attrs": { - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "owner": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "stacey" - } - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "stacey" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "stacey" - }, - "attrs": { - "jobLevel": { - "expr_kind": { - "Lit": { - "Long": 6 - } - }, - "source_info": null, - "data": null - }, - "department": { - "expr_kind": { - "Lit": { - "String": "Sales" - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "alice_friends" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "giuseppe" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "giuseppe" - }, - "attrs": { - "jobLevel": { - "expr_kind": { - "Lit": { - "Long": 7 - } - }, - "source_info": null, - "data": null - }, - "department": { - "expr_kind": { - "Lit": { - "String": "CustomerSupport" - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "AVTeam" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "prototype_v0.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "prototype_v0.jpg" - }, - "attrs": { - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "ahmad" - } - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "device_prototypes" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - }, - "attrs": { - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "owner": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "alice_friends" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "alice_friends" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "device_prototypes" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "device_prototypes" - }, - "attrs": { - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - } - }, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "ahmad" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "ahmad" - }, - "attrs": { - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "owner": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "ahmad" - } - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - } - ] - } - ] - ] - } -} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/authorize/example5b.json b/cedar-lean/Cli/json-inputs/authorize/example5b.json index a56102eea..31b294f7a 100644 --- a/cedar-lean/Cli/json-inputs/authorize/example5b.json +++ b/cedar-lean/Cli/json-inputs/authorize/example5b.json @@ -469,84 +469,51 @@ { "ty": { "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "AVTeam" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "AVTeam" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", + "id": "Account", "path": [] } }, - "eid": "giuseppe" + "eid": "alice" }, { "uid": { "ty": { "Specified": { - "id": "User", + "id": "Account", "path": [] } }, - "eid": "giuseppe" + "eid": "alice" }, "attrs": { - "jobLevel": { + "private": { "expr_kind": { "Lit": { - "Long": 7 + "Bool": false } }, "source_info": null, "data": null }, - "department": { + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "owner": { "expr_kind": { "Lit": { - "String": "CustomerSupport" + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } } }, "source_info": null, @@ -557,15 +524,39 @@ { "ty": { "Specified": { - "id": "UserGroup", + "id": "AccountGroup", "path": [] } }, - "eid": "AVTeam" + "eid": "GeronimoTeam" } ] } ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "attrs": {}, + "ancestors": [] + } + ], [ { "ty": { @@ -594,6 +585,15 @@ "source_info": null, "data": null }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, "account": { "expr_kind": { "Lit": { @@ -610,44 +610,35 @@ }, "source_info": null, "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null } }, "ancestors": [ { "ty": { "Specified": { - "id": "Album", + "id": "Account", "path": [] } }, - "eid": "alice_vacation" + "eid": "alice" }, { "ty": { "Specified": { - "id": "Account", + "id": "AccountGroup", "path": [] } }, - "eid": "alice" + "eid": "GeronimoTeam" }, { "ty": { "Specified": { - "id": "AccountGroup", + "id": "Album", "path": [] } }, - "eid": "GeronimoTeam" + "eid": "alice_vacation" } ] } @@ -656,130 +647,48 @@ { "ty": { "Specified": { - "id": "Account", + "id": "Action", "path": [] } }, - "eid": "ahmad" + "eid": "delete" }, { "uid": { "ty": { "Specified": { - "id": "Account", + "id": "Action", "path": [] } }, - "eid": "ahmad" - }, - "attrs": { - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "owner": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "ahmad" - } - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - } + "eid": "delete" }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - } - ] + "attrs": {}, + "ancestors": [] } ], [ { "ty": { "Specified": { - "id": "User", + "id": "Action", "path": [] } }, - "eid": "alice" + "eid": "comment" }, { "uid": { "ty": { "Specified": { - "id": "User", + "id": "Action", "path": [] } }, - "eid": "alice" - }, - "attrs": { - "jobLevel": { - "expr_kind": { - "Lit": { - "Long": 5 - } - }, - "source_info": null, - "data": null - }, - "department": { - "expr_kind": { - "Lit": { - "String": "HardwareEngineering" - } - }, - "source_info": null, - "data": null - } + "eid": "comment" }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "alice_friends" - }, - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "AVTeam" - } - ] + "attrs": {}, + "ancestors": [] } ], [ @@ -803,19 +712,9 @@ "eid": "stacey" }, "attrs": { - "owner": { + "admins": { "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "stacey" - } - } + "Set": [] }, "source_info": null, "data": null @@ -829,9 +728,19 @@ "source_info": null, "data": null }, - "admins": { + "owner": { "expr_kind": { - "Set": [] + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "stacey" + } + } }, "source_info": null, "data": null @@ -848,7 +757,7 @@ "path": [] } }, - "eid": "alice_friends" + "eid": "AVTeam" }, { "uid": { @@ -858,7 +767,7 @@ "path": [] } }, - "eid": "alice_friends" + "eid": "AVTeam" }, "attrs": {}, "ancestors": [] @@ -868,21 +777,45 @@ { "ty": { "Specified": { - "id": "Album", + "id": "Action", "path": [] } }, - "eid": "alice_vacation" + "eid": "edit" }, { "uid": { "ty": { "Specified": { - "id": "Album", + "id": "Action", "path": [] } }, - "eid": "alice_vacation" + "eid": "edit" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "ahmad" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "ahmad" }, "attrs": { "admins": { @@ -892,17 +825,17 @@ "source_info": null, "data": null }, - "account": { + "owner": { "expr_kind": { "Lit": { "EntityUID": { "ty": { "Specified": { - "id": "Account", + "id": "User", "path": [] } }, - "eid": "alice" + "eid": "ahmad" } } }, @@ -920,15 +853,6 @@ } }, "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - }, { "ty": { "Specified": { @@ -945,41 +869,23 @@ { "ty": { "Specified": { - "id": "AccountGroup", + "id": "Action", "path": [] } }, - "eid": "GeronimoTeam" + "eid": "addPhoto" }, { "uid": { "ty": { "Specified": { - "id": "AccountGroup", + "id": "Action", "path": [] } }, - "eid": "GeronimoTeam" - }, - "attrs": { - "owner": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - } + "eid": "addPhoto" }, + "attrs": {}, "ancestors": [] } ], @@ -991,7 +897,7 @@ "path": [] } }, - "eid": "delete" + "eid": "listAlbums" }, { "uid": { @@ -1001,7 +907,7 @@ "path": [] } }, - "eid": "delete" + "eid": "listAlbums" }, "attrs": {}, "ancestors": [] @@ -1011,23 +917,57 @@ { "ty": { "Specified": { - "id": "Action", + "id": "Album", "path": [] } }, - "eid": "edit" + "eid": "device_prototypes" }, { "uid": { "ty": { "Specified": { - "id": "Action", + "id": "Album", "path": [] } }, - "eid": "edit" + "eid": "device_prototypes" + }, + "attrs": { + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + } }, - "attrs": {}, "ancestors": [] } ], @@ -1035,61 +975,92 @@ { "ty": { "Specified": { - "id": "Action", + "id": "User", "path": [] } }, - "eid": "addPhoto" + "eid": "alice" }, { "uid": { "ty": { "Specified": { - "id": "Action", + "id": "User", "path": [] } }, - "eid": "addPhoto" + "eid": "alice" }, - "attrs": {}, - "ancestors": [] + "attrs": { + "department": { + "expr_kind": { + "Lit": { + "String": "HardwareEngineering" + } + }, + "source_info": null, + "data": null + }, + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 5 + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + }, + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "AVTeam" + } + ] } ], [ { "ty": { "Specified": { - "id": "Album", + "id": "AccountGroup", "path": [] } }, - "eid": "device_prototypes" + "eid": "GeronimoTeam" }, { "uid": { "ty": { "Specified": { - "id": "Album", + "id": "AccountGroup", "path": [] } }, - "eid": "device_prototypes" + "eid": "GeronimoTeam" }, "attrs": { - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "account": { + "owner": { "expr_kind": { "Lit": { "EntityUID": { "ty": { "Specified": { - "id": "Account", + "id": "User", "path": [] } }, @@ -1099,15 +1070,6 @@ }, "source_info": null, "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null } }, "ancestors": [] @@ -1117,24 +1079,86 @@ { "ty": { "Specified": { - "id": "Action", + "id": "Photo", "path": [] } }, - "eid": "comment" + "eid": "sales_projections.jpg" }, { "uid": { "ty": { "Specified": { - "id": "Action", + "id": "Photo", "path": [] } }, - "eid": "comment" + "eid": "sales_projections.jpg" + }, + "attrs": { + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + } + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [ + { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "giuseppe" + } + } + }, + "source_info": null, + "data": null + } + ] + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + } }, - "attrs": {}, - "ancestors": [] + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + } + ] } ], [ @@ -1145,7 +1169,7 @@ "path": [] } }, - "eid": "stacey" + "eid": "giuseppe" }, { "uid": { @@ -1155,22 +1179,22 @@ "path": [] } }, - "eid": "stacey" + "eid": "giuseppe" }, "attrs": { - "department": { + "jobLevel": { "expr_kind": { "Lit": { - "String": "Sales" + "Long": 7 } }, "source_info": null, "data": null }, - "jobLevel": { + "department": { "expr_kind": { "Lit": { - "Long": 6 + "String": "CustomerSupport" } }, "source_info": null, @@ -1185,7 +1209,7 @@ "path": [] } }, - "eid": "alice_friends" + "eid": "AVTeam" } ] } @@ -1198,7 +1222,7 @@ "path": [] } }, - "eid": "ahmad" + "eid": "stacey" }, { "uid": { @@ -1208,13 +1232,13 @@ "path": [] } }, - "eid": "ahmad" + "eid": "stacey" }, "attrs": { "jobLevel": { "expr_kind": { "Lit": { - "Long": 4 + "Long": 6 } }, "source_info": null, @@ -1223,14 +1247,24 @@ "department": { "expr_kind": { "Lit": { - "String": "HardwareEngineering" + "String": "Sales" } }, "source_info": null, "data": null } }, - "ancestors": [] + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + } + ] } ], [ @@ -1263,13 +1297,6 @@ "source_info": null, "data": null }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, "account": { "expr_kind": { "Lit": { @@ -1286,6 +1313,13 @@ }, "source_info": null, "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null } }, "ancestors": [ @@ -1305,116 +1339,85 @@ { "ty": { "Specified": { - "id": "Photo", + "id": "Action", "path": [] } }, - "eid": "sales_projections.jpg" + "eid": "listPhotos" }, { "uid": { "ty": { "Specified": { - "id": "Photo", + "id": "Action", "path": [] } }, - "eid": "sales_projections.jpg" + "eid": "listPhotos" }, - "attrs": { - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [ - { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "giuseppe" - } - } - }, - "source_info": null, - "data": null - } - ] - }, - "source_info": null, - "data": null - }, - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "stacey" - } - } - }, - "source_info": null, - "data": null + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] } }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "stacey" - } - ] + "eid": "alice_friends" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + }, + "attrs": {}, + "ancestors": [] } ], [ { "ty": { "Specified": { - "id": "Account", + "id": "Album", "path": [] } }, - "eid": "alice" + "eid": "alice_vacation" }, { "uid": { "ty": { "Specified": { - "id": "Account", + "id": "Album", "path": [] } }, - "eid": "alice" + "eid": "alice_vacation" }, "attrs": { - "owner": { + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "account": { "expr_kind": { "Lit": { "EntityUID": { "ty": { "Specified": { - "id": "User", + "id": "Account", "path": [] } }, @@ -1425,13 +1428,6 @@ "source_info": null, "data": null }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, "private": { "expr_kind": { "Lit": { @@ -1443,6 +1439,15 @@ } }, "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + }, { "ty": { "Specified": { @@ -1459,23 +1464,42 @@ { "ty": { "Specified": { - "id": "Action", + "id": "User", "path": [] } }, - "eid": "view" + "eid": "ahmad" }, { "uid": { "ty": { "Specified": { - "id": "Action", + "id": "User", "path": [] } }, - "eid": "view" + "eid": "ahmad" + }, + "attrs": { + "department": { + "expr_kind": { + "Lit": { + "String": "HardwareEngineering" + } + }, + "source_info": null, + "data": null + }, + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 4 + } + }, + "source_info": null, + "data": null + } }, - "attrs": {}, "ancestors": [] } ], @@ -1555,30 +1579,6 @@ } ] } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "attrs": {}, - "ancestors": [] - } ] ] } diff --git a/cedar-lean/Cli/json-inputs/authorize/ip1.json b/cedar-lean/Cli/json-inputs/authorize/ip1.json deleted file mode 100644 index 44ff6b6ba..000000000 --- a/cedar-lean/Cli/json-inputs/authorize/ip1.json +++ /dev/null @@ -1,756 +0,0 @@ -{ - "request": { - "principal": { - "Known": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - }, - "action": { - "Known": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource": { - "Known": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - } - }, - "context": { - "expr_kind": { - "Record": { - "authenticated": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": null, - "data": null - }, - "confidence_score": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "decimal", - "path": [] - }, - "args": [ - { - "expr_kind": { - "Lit": { - "String": "0.6" - } - }, - "source_info": null, - "data": null - } - ] - } - }, - "source_info": null, - "data": null - }, - "source_ip": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "ip", - "path": [] - }, - "args": [ - { - "expr_kind": { - "Lit": { - "String": "222.222.222.222" - } - }, - "source_info": null, - "data": null - } - ] - } - }, - "source_info": null, - "data": null - } - } - }, - "source_info": null, - "data": null - } - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": "Any" - }, - "action_constraint": { - "Eq": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource_constraint": { - "constraint": { - "Eq": { - "EUID": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "BinaryApp": { - "op": "Eq", - "arg1": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "context" - }, - "source_info": { - "start": 102, - "end": 109 - }, - "data": null - }, - "attr": "source_ip" - } - }, - "source_info": { - "start": 102, - "end": 119 - }, - "data": null - }, - "arg2": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "ip", - "path": [] - }, - "args": [ - { - "expr_kind": { - "Lit": { - "String": "222.222.222.222" - } - }, - "source_info": { - "start": 126, - "end": 143 - }, - "data": null - } - ] - } - }, - "source_info": { - "start": 123, - "end": 144 - }, - "data": null - } - } - }, - "source_info": { - "start": 102, - "end": 144 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "entities": { - "entities": [ - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "passportscan.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "passportscan.jpg" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - }, - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Video", - "path": [] - } - }, - "eid": "surf.mp4" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Video", - "path": [] - } - }, - "eid": "surf.mp4" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - }, - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "selfie.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "selfie.jpg" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "bob" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Administrator", - "path": [] - } - }, - "eid": "ahmad" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Administrator", - "path": [] - } - }, - "eid": "ahmad" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "bob" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "bob" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "tim" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "tim" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "jane_friends" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "jane_friends" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "jane_friends" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "jane_friends" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "bob" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "bob" - }, - "attrs": {}, - "ancestors": [] - } - ] - ] - } -} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/authorize/ip2.json b/cedar-lean/Cli/json-inputs/authorize/ip2.json deleted file mode 100644 index e043e4d51..000000000 --- a/cedar-lean/Cli/json-inputs/authorize/ip2.json +++ /dev/null @@ -1,806 +0,0 @@ -{ - "request": { - "principal": { - "Known": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - }, - "action": { - "Known": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource": { - "Known": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - } - }, - "context": { - "expr_kind": { - "Record": { - "authenticated": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": null, - "data": null - }, - "confidence_score": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "decimal", - "path": [] - }, - "args": [ - { - "expr_kind": { - "Lit": { - "String": "0.6" - } - }, - "source_info": null, - "data": null - } - ] - } - }, - "source_info": null, - "data": null - }, - "source_ip": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "ip", - "path": [] - }, - "args": [ - { - "expr_kind": { - "Lit": { - "String": "222.222.222.222" - } - }, - "source_info": null, - "data": null - } - ] - } - }, - "source_info": null, - "data": null - } - } - }, - "source_info": null, - "data": null - } - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": "Any" - }, - "action_constraint": { - "Eq": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource_constraint": { - "constraint": { - "Eq": { - "EUID": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "And": { - "left": { - "expr_kind": { - "UnaryApp": { - "op": "Not", - "arg": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "isLoopback", - "path": [] - }, - "args": [ - { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "context" - }, - "source_info": { - "start": 104, - "end": 111 - }, - "data": null - }, - "attr": "source_ip" - } - }, - "source_info": { - "start": 104, - "end": 134 - }, - "data": null - } - ] - } - }, - "source_info": { - "start": 104, - "end": 134 - }, - "data": null - } - } - }, - "source_info": { - "start": 102, - "end": 135 - }, - "data": null - }, - "right": { - "expr_kind": { - "UnaryApp": { - "op": "Not", - "arg": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "isMulticast", - "path": [] - }, - "args": [ - { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "context" - }, - "source_info": { - "start": 141, - "end": 148 - }, - "data": null - }, - "attr": "source_ip" - } - }, - "source_info": { - "start": 141, - "end": 172 - }, - "data": null - } - ] - } - }, - "source_info": { - "start": 141, - "end": 172 - }, - "data": null - } - } - }, - "source_info": { - "start": 139, - "end": 173 - }, - "data": null - } - } - }, - "source_info": { - "start": 102, - "end": 173 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "entities": { - "entities": [ - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "passportscan.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "passportscan.jpg" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - }, - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "bob" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "bob" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Video", - "path": [] - } - }, - "eid": "surf.mp4" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Video", - "path": [] - } - }, - "eid": "surf.mp4" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - }, - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "jane_friends" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "jane_friends" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Administrator", - "path": [] - } - }, - "eid": "ahmad" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Administrator", - "path": [] - } - }, - "eid": "ahmad" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "bob" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "bob" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "selfie.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "selfie.jpg" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "bob" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "tim" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "tim" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "jane_friends" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "jane_friends" - } - ] - } - ] - ] - } -} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/authorize/ip3.json b/cedar-lean/Cli/json-inputs/authorize/ip3.json index 312b6af05..5338c361c 100644 --- a/cedar-lean/Cli/json-inputs/authorize/ip3.json +++ b/cedar-lean/Cli/json-inputs/authorize/ip3.json @@ -220,7 +220,7 @@ "path": [] } }, - "eid": "bob" + "eid": "jane" }, { "uid": { @@ -230,7 +230,7 @@ "path": [] } }, - "eid": "bob" + "eid": "jane" }, "attrs": {}, "ancestors": [] @@ -240,45 +240,55 @@ { "ty": { "Specified": { - "id": "Action", + "id": "Photo", "path": [] } }, - "eid": "addPhoto" + "eid": "selfie.jpg" }, { "uid": { "ty": { "Specified": { - "id": "Action", + "id": "Photo", "path": [] } }, - "eid": "addPhoto" + "eid": "selfie.jpg" }, "attrs": {}, - "ancestors": [] + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + } + ] } ], [ { "ty": { "Specified": { - "id": "Photo", + "id": "Video", "path": [] } }, - "eid": "selfie.jpg" + "eid": "surf.mp4" }, { "uid": { "ty": { "Specified": { - "id": "Photo", + "id": "Video", "path": [] } }, - "eid": "selfie.jpg" + "eid": "surf.mp4" }, "attrs": {}, "ancestors": [ @@ -289,7 +299,16 @@ "path": [] } }, - "eid": "bob" + "eid": "jane" + }, + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" } ] } @@ -298,21 +317,21 @@ { "ty": { "Specified": { - "id": "Action", + "id": "Account", "path": [] } }, - "eid": "delete" + "eid": "bob" }, { "uid": { "ty": { "Specified": { - "id": "Action", + "id": "Account", "path": [] } }, - "eid": "delete" + "eid": "bob" }, "attrs": {}, "ancestors": [] @@ -322,21 +341,21 @@ { "ty": { "Specified": { - "id": "Action", + "id": "Administrator", "path": [] } }, - "eid": "view" + "eid": "ahmad" }, { "uid": { "ty": { "Specified": { - "id": "Action", + "id": "Administrator", "path": [] } }, - "eid": "view" + "eid": "ahmad" }, "attrs": {}, "ancestors": [] @@ -346,57 +365,58 @@ { "ty": { "Specified": { - "id": "Action", + "id": "User", "path": [] } }, - "eid": "listAlbums" + "eid": "tim" }, { "uid": { "ty": { "Specified": { - "id": "Action", + "id": "User", "path": [] } }, - "eid": "listAlbums" + "eid": "tim" }, "attrs": {}, - "ancestors": [] + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + } + ] } ], [ { "ty": { "Specified": { - "id": "Video", + "id": "Album", "path": [] } }, - "eid": "surf.mp4" + "eid": "jane_vacation" }, { "uid": { "ty": { "Specified": { - "id": "Video", + "id": "Album", "path": [] } }, - "eid": "surf.mp4" + "eid": "jane_vacation" }, "attrs": {}, "ancestors": [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - }, { "ty": { "Specified": { @@ -409,6 +429,30 @@ ] } ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "addPhoto" + }, + "attrs": {}, + "ancestors": [] + } + ], [ { "ty": { @@ -451,7 +495,7 @@ "path": [] } }, - "eid": "VacationPhoto94.jpg" + "eid": "passportscan.jpg" }, { "uid": { @@ -461,19 +505,10 @@ "path": [] } }, - "eid": "VacationPhoto94.jpg" + "eid": "passportscan.jpg" }, "attrs": {}, "ancestors": [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - }, { "ty": { "Specified": { @@ -494,7 +529,7 @@ "path": [] } }, - "eid": "tim" + "eid": "bob" }, { "uid": { @@ -504,41 +539,31 @@ "path": [] } }, - "eid": "tim" + "eid": "bob" }, "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "jane_friends" - } - ] + "ancestors": [] } ], [ { "ty": { "Specified": { - "id": "Action", + "id": "UserGroup", "path": [] } }, - "eid": "edit" + "eid": "jane_friends" }, { "uid": { "ty": { "Specified": { - "id": "Action", + "id": "UserGroup", "path": [] } }, - "eid": "edit" + "eid": "jane_friends" }, "attrs": {}, "ancestors": [] @@ -552,7 +577,7 @@ "path": [] } }, - "eid": "comment" + "eid": "edit" }, { "uid": { @@ -562,7 +587,7 @@ "path": [] } }, - "eid": "comment" + "eid": "edit" }, "attrs": {}, "ancestors": [] @@ -576,7 +601,7 @@ "path": [] } }, - "eid": "listPhotos" + "eid": "delete" }, { "uid": { @@ -586,7 +611,7 @@ "path": [] } }, - "eid": "listPhotos" + "eid": "delete" }, "attrs": {}, "ancestors": [] @@ -596,24 +621,33 @@ { "ty": { "Specified": { - "id": "Album", + "id": "Photo", "path": [] } }, - "eid": "jane_vacation" + "eid": "VacationPhoto94.jpg" }, { "uid": { "ty": { "Specified": { - "id": "Album", + "id": "Photo", "path": [] } }, - "eid": "jane_vacation" + "eid": "VacationPhoto94.jpg" }, "attrs": {}, "ancestors": [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, { "ty": { "Specified": { @@ -630,21 +664,21 @@ { "ty": { "Specified": { - "id": "Administrator", + "id": "Action", "path": [] } }, - "eid": "ahmad" + "eid": "listAlbums" }, { "uid": { "ty": { "Specified": { - "id": "Administrator", + "id": "Action", "path": [] } }, - "eid": "ahmad" + "eid": "listAlbums" }, "attrs": {}, "ancestors": [] @@ -654,55 +688,21 @@ { "ty": { "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "passportscan.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "passportscan.jpg" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "UserGroup", + "id": "Action", "path": [] } }, - "eid": "jane_friends" + "eid": "comment" }, { "uid": { "ty": { "Specified": { - "id": "UserGroup", + "id": "Action", "path": [] } }, - "eid": "jane_friends" + "eid": "comment" }, "attrs": {}, "ancestors": [] @@ -712,21 +712,21 @@ { "ty": { "Specified": { - "id": "User", + "id": "Action", "path": [] } }, - "eid": "bob" + "eid": "view" }, { "uid": { "ty": { "Specified": { - "id": "User", + "id": "Action", "path": [] } }, - "eid": "bob" + "eid": "view" }, "attrs": {}, "ancestors": [] @@ -736,21 +736,21 @@ { "ty": { "Specified": { - "id": "Account", + "id": "Action", "path": [] } }, - "eid": "jane" + "eid": "listPhotos" }, { "uid": { "ty": { "Specified": { - "id": "Account", + "id": "Action", "path": [] } }, - "eid": "jane" + "eid": "listPhotos" }, "attrs": {}, "ancestors": [] diff --git a/cedar-lean/Cli/json-inputs/authorize/multi1.json b/cedar-lean/Cli/json-inputs/authorize/multi1.json index 85e04533d..2f960ce6f 100644 --- a/cedar-lean/Cli/json-inputs/authorize/multi1.json +++ b/cedar-lean/Cli/json-inputs/authorize/multi1.json @@ -99,8 +99,8 @@ }, "policies": { "templates": { - "policy0": { - "id": "policy0", + "policy1": { + "id": "policy1", "annotations": {}, "effect": "permit", "principal_constraint": { @@ -113,21 +113,32 @@ "path": [] } }, - "eid": "alice" + "eid": "bob" } } } }, "action_constraint": { - "Eq": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } + "In": [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" }, - "eid": "view" - } + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "edit" + } + ] }, "resource_constraint": { "constraint": { @@ -135,11 +146,11 @@ "EUID": { "ty": { "Specified": { - "id": "Album", + "id": "Account", "path": [] } }, - "eid": "jane_vacation" + "eid": "bob" } } } @@ -151,14 +162,14 @@ } }, "source_info": { - "start": 96, - "end": 202 + "start": 204, + "end": 318 }, "data": null } }, - "policy1": { - "id": "policy1", + "policy0": { + "id": "policy0", "annotations": {}, "effect": "permit", "principal_constraint": { @@ -171,32 +182,21 @@ "path": [] } }, - "eid": "bob" + "eid": "alice" } } } }, "action_constraint": { - "In": [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } }, - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - } - ] + "eid": "view" + } }, "resource_constraint": { "constraint": { @@ -204,11 +204,11 @@ "EUID": { "ty": { "Specified": { - "id": "Account", + "id": "Album", "path": [] } }, - "eid": "bob" + "eid": "jane_vacation" } } } @@ -220,8 +220,8 @@ } }, "source_info": { - "start": 204, - "end": 318 + "start": 96, + "end": 202 }, "data": null } @@ -246,48 +246,68 @@ { "ty": { "Specified": { - "id": "User", + "id": "Photo", "path": [] } }, - "eid": "bob" + "eid": "selfie.jpg" }, { "uid": { "ty": { "Specified": { - "id": "User", + "id": "Photo", "path": [] } }, - "eid": "bob" + "eid": "selfie.jpg" }, "attrs": {}, - "ancestors": [] + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "bob" + } + ] } ], [ { "ty": { "Specified": { - "id": "Action", + "id": "User", "path": [] } }, - "eid": "listAlbums" + "eid": "alice" }, { "uid": { "ty": { "Specified": { - "id": "Action", + "id": "User", "path": [] } }, - "eid": "listAlbums" + "eid": "alice" }, "attrs": {}, - "ancestors": [] + "ancestors": [ + { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "jane_friends" + } + ] } ], [ @@ -318,75 +338,56 @@ { "ty": { "Specified": { - "id": "Photo", + "id": "Action", "path": [] } }, - "eid": "VacationPhoto94.jpg" + "eid": "comment" }, { "uid": { "ty": { "Specified": { - "id": "Photo", + "id": "Action", "path": [] } }, - "eid": "VacationPhoto94.jpg" + "eid": "comment" }, "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - }, - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - } - ] + "ancestors": [] } ], [ { "ty": { "Specified": { - "id": "Photo", + "id": "User", "path": [] } }, - "eid": "selfie.jpg" + "eid": "tim" }, { "uid": { "ty": { "Specified": { - "id": "Photo", + "id": "User", "path": [] } }, - "eid": "selfie.jpg" + "eid": "tim" }, "attrs": {}, "ancestors": [ { "ty": { "Specified": { - "id": "Account", + "id": "UserGroup", "path": [] } }, - "eid": "bob" + "eid": "jane_friends" } ] } @@ -419,34 +420,24 @@ { "ty": { "Specified": { - "id": "Album", + "id": "Action", "path": [] } }, - "eid": "jane_vacation" + "eid": "edit" }, { "uid": { "ty": { "Specified": { - "id": "Album", + "id": "Action", "path": [] } }, - "eid": "jane_vacation" + "eid": "edit" }, "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - } - ] + "ancestors": [] } ], [ @@ -457,7 +448,7 @@ "path": [] } }, - "eid": "delete" + "eid": "listPhotos" }, { "uid": { @@ -467,7 +458,7 @@ "path": [] } }, - "eid": "delete" + "eid": "listPhotos" }, "attrs": {}, "ancestors": [] @@ -481,7 +472,7 @@ "path": [] } }, - "eid": "edit" + "eid": "view" }, { "uid": { @@ -491,7 +482,7 @@ "path": [] } }, - "eid": "edit" + "eid": "view" }, "attrs": {}, "ancestors": [] @@ -501,21 +492,21 @@ { "ty": { "Specified": { - "id": "Administrator", + "id": "Action", "path": [] } }, - "eid": "ahmad" + "eid": "delete" }, { "uid": { "ty": { "Specified": { - "id": "Administrator", + "id": "Action", "path": [] } }, - "eid": "ahmad" + "eid": "delete" }, "attrs": {}, "ancestors": [] @@ -525,21 +516,21 @@ { "ty": { "Specified": { - "id": "Video", + "id": "Photo", "path": [] } }, - "eid": "surf.mp4" + "eid": "VacationPhoto94.jpg" }, { "uid": { "ty": { "Specified": { - "id": "Video", + "id": "Photo", "path": [] } }, - "eid": "surf.mp4" + "eid": "VacationPhoto94.jpg" }, "attrs": {}, "ancestors": [ @@ -568,7 +559,7 @@ { "ty": { "Specified": { - "id": "Account", + "id": "User", "path": [] } }, @@ -578,7 +569,7 @@ "uid": { "ty": { "Specified": { - "id": "Account", + "id": "User", "path": [] } }, @@ -592,21 +583,21 @@ { "ty": { "Specified": { - "id": "Action", + "id": "Account", "path": [] } }, - "eid": "addPhoto" + "eid": "bob" }, { "uid": { "ty": { "Specified": { - "id": "Action", + "id": "Account", "path": [] } }, - "eid": "addPhoto" + "eid": "bob" }, "attrs": {}, "ancestors": [] @@ -616,32 +607,32 @@ { "ty": { "Specified": { - "id": "User", + "id": "Album", "path": [] } }, - "eid": "alice" + "eid": "jane_vacation" }, { "uid": { "ty": { "Specified": { - "id": "User", + "id": "Album", "path": [] } }, - "eid": "alice" + "eid": "jane_vacation" }, "attrs": {}, "ancestors": [ { "ty": { "Specified": { - "id": "UserGroup", + "id": "Account", "path": [] } }, - "eid": "jane_friends" + "eid": "jane" } ] } @@ -650,45 +641,21 @@ { "ty": { "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", + "id": "Administrator", "path": [] } }, - "eid": "listPhotos" + "eid": "ahmad" }, { "uid": { "ty": { "Specified": { - "id": "Action", + "id": "Administrator", "path": [] } }, - "eid": "listPhotos" + "eid": "ahmad" }, "attrs": {}, "ancestors": [] @@ -698,32 +665,32 @@ { "ty": { "Specified": { - "id": "User", + "id": "Photo", "path": [] } }, - "eid": "tim" + "eid": "passportscan.jpg" }, { "uid": { "ty": { "Specified": { - "id": "User", + "id": "Photo", "path": [] } }, - "eid": "tim" + "eid": "passportscan.jpg" }, "attrs": {}, "ancestors": [ { "ty": { "Specified": { - "id": "UserGroup", + "id": "Account", "path": [] } }, - "eid": "jane_friends" + "eid": "jane" } ] } @@ -736,7 +703,7 @@ "path": [] } }, - "eid": "comment" + "eid": "addPhoto" }, { "uid": { @@ -746,7 +713,7 @@ "path": [] } }, - "eid": "comment" + "eid": "addPhoto" }, "attrs": {}, "ancestors": [] @@ -756,24 +723,33 @@ { "ty": { "Specified": { - "id": "Photo", + "id": "Video", "path": [] } }, - "eid": "passportscan.jpg" + "eid": "surf.mp4" }, { "uid": { "ty": { "Specified": { - "id": "Photo", + "id": "Video", "path": [] } }, - "eid": "passportscan.jpg" + "eid": "surf.mp4" }, "attrs": {}, "ancestors": [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "jane_vacation" + }, { "ty": { "Specified": { @@ -785,6 +761,30 @@ } ] } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "listAlbums" + }, + "attrs": {}, + "ancestors": [] + } ] ] } diff --git a/cedar-lean/Cli/json-inputs/authorize/multi2.json b/cedar-lean/Cli/json-inputs/authorize/multi2.json deleted file mode 100644 index 7975f870d..000000000 --- a/cedar-lean/Cli/json-inputs/authorize/multi2.json +++ /dev/null @@ -1,768 +0,0 @@ -{ - "request": { - "principal": { - "Known": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - }, - "action": { - "Known": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource": { - "Known": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - } - }, - "context": { - "expr_kind": { - "Record": { - "authenticated": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": null, - "data": null - }, - "confidence_score": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "decimal", - "path": [] - }, - "args": [ - { - "expr_kind": { - "Lit": { - "String": "0.6" - } - }, - "source_info": null, - "data": null - } - ] - } - }, - "source_info": null, - "data": null - }, - "source_ip": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "ip", - "path": [] - }, - "args": [ - { - "expr_kind": { - "Lit": { - "String": "123.123.123.123" - } - }, - "source_info": null, - "data": null - } - ] - } - }, - "source_info": null, - "data": null - } - } - }, - "source_info": null, - "data": null - } - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": "Any" - }, - "action_constraint": { - "Eq": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource_constraint": { - "constraint": { - "In": { - "EUID": { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": { - "start": 121, - "end": 210 - }, - "data": null - } - }, - "policy1": { - "id": "policy1", - "annotations": {}, - "effect": "forbid", - "principal_constraint": { - "constraint": { - "Eq": { - "EUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "bob" - } - } - } - }, - "action_constraint": { - "Eq": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource_constraint": { - "constraint": { - "In": { - "EUID": { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": { - "start": 226, - "end": 330 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - }, - "policy1": { - "template_id": "policy1", - "link_id": null, - "values": {} - } - } - }, - "entities": { - "entities": [ - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "jane_friends" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "selfie.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "selfie.jpg" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "bob" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "passportscan.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "passportscan.jpg" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "bob" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "bob" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "tim" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "tim" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "jane_friends" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - }, - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Video", - "path": [] - } - }, - "eid": "surf.mp4" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Video", - "path": [] - } - }, - "eid": "surf.mp4" - }, - "attrs": {}, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - }, - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "bob" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "bob" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "jane_friends" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "jane_friends" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Administrator", - "path": [] - } - }, - "eid": "ahmad" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Administrator", - "path": [] - } - }, - "eid": "ahmad" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "attrs": {}, - "ancestors": [] - } - ] - ] - } -} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/authorize/multi3.json b/cedar-lean/Cli/json-inputs/authorize/multi3.json deleted file mode 100644 index d23d9b8e4..000000000 --- a/cedar-lean/Cli/json-inputs/authorize/multi3.json +++ /dev/null @@ -1,1439 +0,0 @@ -{ - "request": { - "principal": { - "Known": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - }, - "action": { - "Known": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource": { - "Known": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "vacation.jpg" - } - }, - "context": { - "expr_kind": { - "Record": { - "authenticated": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": null, - "data": null - }, - "confidence_score": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "decimal", - "path": [] - }, - "args": [ - { - "expr_kind": { - "Lit": { - "String": "0.6" - } - }, - "source_info": null, - "data": null - } - ] - } - }, - "source_info": null, - "data": null - }, - "source_ip": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "ip", - "path": [] - }, - "args": [ - { - "expr_kind": { - "Lit": { - "String": "123.123.123.123" - } - }, - "source_info": null, - "data": null - } - ] - } - }, - "source_info": null, - "data": null - } - } - }, - "source_info": null, - "data": null - } - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": { - "In": { - "EUID": { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "alice_friends" - } - } - } - }, - "action_constraint": { - "Eq": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource_constraint": { - "constraint": { - "In": { - "EUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": { - "start": 145, - "end": 258 - }, - "data": null - } - }, - "policy1": { - "id": "policy1", - "annotations": {}, - "effect": "forbid", - "principal_constraint": { - "constraint": "Any" - }, - "action_constraint": "Any", - "resource_constraint": { - "constraint": "Any" - }, - "non_head_constraints": { - "expr_kind": { - "And": { - "left": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "resource" - }, - "source_info": { - "start": 398, - "end": 406 - }, - "data": null - }, - "attr": "private" - } - }, - "source_info": { - "start": 398, - "end": 414 - }, - "data": null - }, - "right": { - "expr_kind": { - "UnaryApp": { - "op": "Not", - "arg": { - "expr_kind": { - "And": { - "left": { - "expr_kind": { - "HasAttr": { - "expr": { - "expr_kind": { - "Var": "resource" - }, - "source_info": { - "start": 426, - "end": 434 - }, - "data": null - }, - "attr": "account" - } - }, - "source_info": { - "start": 426, - "end": 446 - }, - "data": null - }, - "right": { - "expr_kind": { - "BinaryApp": { - "op": "Eq", - "arg1": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "resource" - }, - "source_info": { - "start": 450, - "end": 458 - }, - "data": null - }, - "attr": "account" - } - }, - "source_info": { - "start": 450, - "end": 472 - }, - "data": null - }, - "attr": "owner" - } - }, - "source_info": { - "start": 450, - "end": 472 - }, - "data": null - }, - "arg2": { - "expr_kind": { - "Var": "principal" - }, - "source_info": { - "start": 476, - "end": 485 - }, - "data": null - } - } - }, - "source_info": { - "start": 450, - "end": 485 - }, - "data": null - } - } - }, - "source_info": { - "start": 426, - "end": 485 - }, - "data": null - } - } - }, - "source_info": { - "start": 417, - "end": 487 - }, - "data": null - } - } - }, - "source_info": { - "start": 354, - "end": 488 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - }, - "policy1": { - "template_id": "policy1", - "link_id": null, - "values": {} - } - } - }, - "entities": { - "entities": [ - [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "stacey" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "stacey" - }, - "attrs": { - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "owner": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "stacey" - } - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - } - }, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "giuseppe" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "giuseppe" - }, - "attrs": { - "department": { - "expr_kind": { - "Lit": { - "String": "CustomerSupport" - } - }, - "source_info": null, - "data": null - }, - "jobLevel": { - "expr_kind": { - "Lit": { - "Long": 7 - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "AVTeam" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "alice_w2.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "alice_w2.jpg" - }, - "attrs": { - "private": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": null, - "data": null - }, - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - }, - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - }, - "attrs": { - "owner": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "stacey" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "stacey" - }, - "attrs": { - "department": { - "expr_kind": { - "Lit": { - "String": "Sales" - } - }, - "source_info": null, - "data": null - }, - "jobLevel": { - "expr_kind": { - "Lit": { - "Long": 6 - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "alice_friends" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "device_prototypes" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "device_prototypes" - }, - "attrs": { - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - } - }, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "AVTeam" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "AVTeam" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "prototype_v0.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "prototype_v0.jpg" - }, - "attrs": { - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "ahmad" - } - } - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "device_prototypes" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - }, - "attrs": { - "jobLevel": { - "expr_kind": { - "Lit": { - "Long": 5 - } - }, - "source_info": null, - "data": null - }, - "department": { - "expr_kind": { - "Lit": { - "String": "HardwareEngineering" - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "alice_friends" - }, - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "AVTeam" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "vacation.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "vacation.jpg" - }, - "attrs": { - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - }, - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - }, - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "alice_vacation" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "alice_friends" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "alice_friends" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "alice_vacation" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "alice_vacation" - }, - "attrs": { - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - }, - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "ahmad" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "ahmad" - }, - "attrs": { - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "owner": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "ahmad" - } - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "ahmad" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "ahmad" - }, - "attrs": { - "department": { - "expr_kind": { - "Lit": { - "String": "HardwareEngineering" - } - }, - "source_info": null, - "data": null - }, - "jobLevel": { - "expr_kind": { - "Lit": { - "Long": 4 - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "sales_projections.jpg" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "sales_projections.jpg" - }, - "attrs": { - "admins": { - "expr_kind": { - "Set": [ - { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "giuseppe" - } - } - }, - "source_info": null, - "data": null - } - ] - }, - "source_info": null, - "data": null - }, - "account": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "stacey" - } - } - }, - "source_info": null, - "data": null - }, - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "stacey" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - }, - "attrs": { - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - }, - "owner": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - } - }, - "source_info": null, - "data": null - } - }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - } - ] - } - ] - ] - } -} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/authorize/multi4.json b/cedar-lean/Cli/json-inputs/authorize/multi4.json index 127d60bfd..6eff618c1 100644 --- a/cedar-lean/Cli/json-inputs/authorize/multi4.json +++ b/cedar-lean/Cli/json-inputs/authorize/multi4.json @@ -53,52 +53,6 @@ }, "policies": { "templates": { - "policy3": { - "id": "policy3", - "annotations": {}, - "effect": "forbid", - "principal_constraint": { - "constraint": "Any" - }, - "action_constraint": "Any", - "resource_constraint": { - "constraint": "Any" - }, - "non_head_constraints": { - "expr_kind": { - "UnaryApp": { - "op": "Not", - "arg": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "context" - }, - "source_info": { - "start": 751, - "end": 758 - }, - "data": null - }, - "attr": "authenticated" - } - }, - "source_info": { - "start": 751, - "end": 772 - }, - "data": null - } - } - }, - "source_info": { - "start": 750, - "end": 772 - }, - "data": null - } - }, "policy1": { "id": "policy1", "annotations": {}, @@ -169,60 +123,48 @@ "data": null } }, - "policy0": { - "id": "policy0", + "policy3": { + "id": "policy3", "annotations": {}, - "effect": "permit", + "effect": "forbid", "principal_constraint": { - "constraint": { - "In": { - "EUID": { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "alice_friends" - } - } - } - }, - "action_constraint": { - "Eq": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } + "constraint": "Any" }, + "action_constraint": "Any", "resource_constraint": { - "constraint": { - "In": { - "EUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - } - } + "constraint": "Any" }, "non_head_constraints": { "expr_kind": { - "Lit": { - "Bool": true + "UnaryApp": { + "op": "Not", + "arg": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 751, + "end": 758 + }, + "data": null + }, + "attr": "authenticated" + } + }, + "source_info": { + "start": 751, + "end": 772 + }, + "data": null + } } }, "source_info": { - "start": 140, - "end": 253 + "start": 750, + "end": 772 }, "data": null } @@ -372,16 +314,74 @@ }, "data": null } + }, + "policy0": { + "id": "policy0", + "annotations": {}, + "effect": "permit", + "principal_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "UserGroup", + "path": [] + } + }, + "eid": "alice_friends" + } + } + } + }, + "action_constraint": { + "Eq": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + } + }, + "resource_constraint": { + "constraint": { + "In": { + "EUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + } + }, + "non_head_constraints": { + "expr_kind": { + "Lit": { + "Bool": true + } + }, + "source_info": { + "start": 140, + "end": 253 + }, + "data": null + } } }, "links": { - "policy1": { - "template_id": "policy1", + "policy2": { + "template_id": "policy2", "link_id": null, "values": {} }, - "policy2": { - "template_id": "policy2", + "policy1": { + "template_id": "policy1", "link_id": null, "values": {} }, @@ -407,7 +407,7 @@ "path": [] } }, - "eid": "comment" + "eid": "edit" }, { "uid": { @@ -417,7 +417,7 @@ "path": [] } }, - "eid": "comment" + "eid": "edit" }, "attrs": {}, "ancestors": [] @@ -427,97 +427,77 @@ { "ty": { "Specified": { - "id": "User", + "id": "Action", "path": [] } }, - "eid": "alice" + "eid": "addPhoto" }, { "uid": { "ty": { "Specified": { - "id": "User", + "id": "Action", "path": [] } }, - "eid": "alice" - }, - "attrs": { - "department": { - "expr_kind": { - "Lit": { - "String": "HardwareEngineering" - } - }, - "source_info": null, - "data": null - }, - "jobLevel": { - "expr_kind": { - "Lit": { - "Long": 5 - } - }, - "source_info": null, - "data": null - } + "eid": "addPhoto" }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "AVTeam" - }, - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "alice_friends" - } - ] + "attrs": {}, + "ancestors": [] } ], [ { "ty": { "Specified": { - "id": "UserGroup", + "id": "AccountGroup", "path": [] } }, - "eid": "alice_friends" + "eid": "GeronimoTeam" }, { "uid": { "ty": { "Specified": { - "id": "UserGroup", + "id": "AccountGroup", "path": [] } }, - "eid": "alice_friends" + "eid": "GeronimoTeam" }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { + "attrs": { + "owner": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [] + } + ], + [ + { "ty": { "Specified": { "id": "Photo", "path": [] } }, - "eid": "vacation.jpg" + "eid": "prototype_v0.jpg" }, { "uid": { @@ -527,7 +507,7 @@ "path": [] } }, - "eid": "vacation.jpg" + "eid": "prototype_v0.jpg" }, "attrs": { "account": { @@ -540,40 +520,31 @@ "path": [] } }, - "eid": "alice" + "eid": "ahmad" } } }, "source_info": null, "data": null }, - "private": { + "admins": { "expr_kind": { - "Lit": { - "Bool": false - } + "Set": [] }, "source_info": null, "data": null }, - "admins": { + "private": { "expr_kind": { - "Set": [] + "Lit": { + "Bool": false + } }, "source_info": null, "data": null } }, "ancestors": [ - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - }, { "ty": { "Specified": { @@ -581,16 +552,7 @@ "path": [] } }, - "eid": "alice_vacation" - }, - { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" + "eid": "device_prototypes" } ] } @@ -599,42 +561,47 @@ { "ty": { "Specified": { - "id": "User", + "id": "UserGroup", "path": [] } }, - "eid": "ahmad" + "eid": "AVTeam" }, { "uid": { "ty": { "Specified": { - "id": "User", + "id": "UserGroup", "path": [] } }, - "eid": "ahmad" + "eid": "AVTeam" }, - "attrs": { - "department": { - "expr_kind": { - "Lit": { - "String": "HardwareEngineering" - } - }, - "source_info": null, - "data": null - }, - "jobLevel": { - "expr_kind": { - "Lit": { - "Long": 4 - } - }, - "source_info": null, - "data": null + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "Action", + "path": [] } }, + "eid": "view" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "Action", + "path": [] + } + }, + "eid": "view" + }, + "attrs": {}, "ancestors": [] } ], @@ -642,84 +609,51 @@ { "ty": { "Specified": { - "id": "Photo", + "id": "User", "path": [] } }, - "eid": "sales_projections.jpg" + "eid": "stacey" }, { "uid": { "ty": { "Specified": { - "id": "Photo", + "id": "User", "path": [] } }, - "eid": "sales_projections.jpg" + "eid": "stacey" }, "attrs": { - "account": { + "jobLevel": { "expr_kind": { "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "stacey" - } + "Long": 6 } }, "source_info": null, "data": null }, - "private": { + "department": { "expr_kind": { "Lit": { - "Bool": false + "String": "Sales" } }, "source_info": null, "data": null - }, - "admins": { - "expr_kind": { - "Set": [ - { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "giuseppe" - } - } - }, - "source_info": null, - "data": null - } - ] - }, - "source_info": null, - "data": null } }, "ancestors": [ { "ty": { "Specified": { - "id": "Account", + "id": "UserGroup", "path": [] } }, - "eid": "stacey" + "eid": "alice_friends" } ] } @@ -728,21 +662,21 @@ { "ty": { "Specified": { - "id": "Account", + "id": "Photo", "path": [] } }, - "eid": "ahmad" + "eid": "vacation.jpg" }, { "uid": { "ty": { "Specified": { - "id": "Account", + "id": "Photo", "path": [] } }, - "eid": "ahmad" + "eid": "vacation.jpg" }, "attrs": { "private": { @@ -754,17 +688,17 @@ "source_info": null, "data": null }, - "owner": { + "account": { "expr_kind": { "Lit": { "EntityUID": { "ty": { "Specified": { - "id": "User", + "id": "Account", "path": [] } }, - "eid": "ahmad" + "eid": "alice" } } }, @@ -780,6 +714,15 @@ } }, "ancestors": [ + { + "ty": { + "Specified": { + "id": "Album", + "path": [] + } + }, + "eid": "alice_vacation" + }, { "ty": { "Specified": { @@ -788,6 +731,15 @@ } }, "eid": "GeronimoTeam" + }, + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" } ] } @@ -796,57 +748,23 @@ { "ty": { "Specified": { - "id": "Account", + "id": "Action", "path": [] } }, - "eid": "stacey" + "eid": "delete" }, { "uid": { "ty": { "Specified": { - "id": "Account", + "id": "Action", "path": [] } }, - "eid": "stacey" - }, - "attrs": { - "private": { - "expr_kind": { - "Lit": { - "Bool": false - } - }, - "source_info": null, - "data": null - }, - "owner": { - "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "stacey" - } - } - }, - "source_info": null, - "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null - } + "eid": "delete" }, + "attrs": {}, "ancestors": [] } ], @@ -858,7 +776,7 @@ "path": [] } }, - "eid": "stacey" + "eid": "giuseppe" }, { "uid": { @@ -868,13 +786,13 @@ "path": [] } }, - "eid": "stacey" + "eid": "giuseppe" }, "attrs": { "department": { "expr_kind": { "Lit": { - "String": "Sales" + "String": "CustomerSupport" } }, "source_info": null, @@ -883,7 +801,7 @@ "jobLevel": { "expr_kind": { "Lit": { - "Long": 6 + "Long": 7 } }, "source_info": null, @@ -898,7 +816,7 @@ "path": [] } }, - "eid": "alice_friends" + "eid": "AVTeam" } ] } @@ -907,21 +825,21 @@ { "ty": { "Specified": { - "id": "Photo", + "id": "Album", "path": [] } }, - "eid": "prototype_v0.jpg" + "eid": "alice_vacation" }, { "uid": { "ty": { "Specified": { - "id": "Photo", + "id": "Album", "path": [] } }, - "eid": "prototype_v0.jpg" + "eid": "alice_vacation" }, "attrs": { "account": { @@ -934,7 +852,7 @@ "path": [] } }, - "eid": "ahmad" + "eid": "alice" } } }, @@ -962,61 +880,22 @@ { "ty": { "Specified": { - "id": "Album", + "id": "Account", "path": [] } }, - "eid": "device_prototypes" - } - ] - } - ], - [ - { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "AVTeam" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } + "eid": "alice" }, - "eid": "AVTeam" - }, - "attrs": {}, - "ancestors": [] - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" } - }, - "eid": "addPhoto" - }, - { - "uid": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "attrs": {}, - "ancestors": [] + ] } ], [ @@ -1027,7 +906,7 @@ "path": [] } }, - "eid": "edit" + "eid": "listPhotos" }, { "uid": { @@ -1037,7 +916,7 @@ "path": [] } }, - "eid": "edit" + "eid": "listPhotos" }, "attrs": {}, "ancestors": [] @@ -1047,30 +926,30 @@ { "ty": { "Specified": { - "id": "Album", + "id": "Account", "path": [] } }, - "eid": "device_prototypes" + "eid": "alice" }, { "uid": { "ty": { "Specified": { - "id": "Album", + "id": "Account", "path": [] } }, - "eid": "device_prototypes" + "eid": "alice" }, "attrs": { - "account": { + "owner": { "expr_kind": { "Lit": { "EntityUID": { "ty": { "Specified": { - "id": "Account", + "id": "User", "path": [] } }, @@ -1081,24 +960,34 @@ "source_info": null, "data": null }, - "private": { + "admins": { "expr_kind": { - "Lit": { - "Bool": false - } + "Set": [] }, "source_info": null, "data": null }, - "admins": { + "private": { "expr_kind": { - "Set": [] + "Lit": { + "Bool": false + } }, "source_info": null, "data": null } }, - "ancestors": [] + "ancestors": [ + { + "ty": { + "Specified": { + "id": "AccountGroup", + "path": [] + } + }, + "eid": "GeronimoTeam" + } + ] } ], [ @@ -1129,36 +1018,51 @@ { "ty": { "Specified": { - "id": "User", + "id": "Account", "path": [] } }, - "eid": "giuseppe" + "eid": "ahmad" }, { "uid": { "ty": { "Specified": { - "id": "User", + "id": "Account", "path": [] } }, - "eid": "giuseppe" + "eid": "ahmad" }, "attrs": { - "department": { + "private": { "expr_kind": { "Lit": { - "String": "CustomerSupport" + "Bool": false } }, "source_info": null, "data": null }, - "jobLevel": { + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + }, + "owner": { "expr_kind": { "Lit": { - "Long": 7 + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "ahmad" + } } }, "source_info": null, @@ -1169,11 +1073,11 @@ { "ty": { "Specified": { - "id": "UserGroup", + "id": "AccountGroup", "path": [] } }, - "eid": "AVTeam" + "eid": "GeronimoTeam" } ] } @@ -1182,75 +1086,84 @@ { "ty": { "Specified": { - "id": "Album", + "id": "UserGroup", "path": [] } }, - "eid": "alice_vacation" + "eid": "alice_friends" }, { "uid": { "ty": { "Specified": { - "id": "Album", + "id": "UserGroup", "path": [] } }, - "eid": "alice_vacation" + "eid": "alice_friends" + }, + "attrs": {}, + "ancestors": [] + } + ], + [ + { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" + }, + { + "uid": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "alice" }, "attrs": { - "private": { + "jobLevel": { "expr_kind": { "Lit": { - "Bool": false + "Long": 5 } }, "source_info": null, "data": null }, - "account": { + "department": { "expr_kind": { "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } + "String": "HardwareEngineering" } }, "source_info": null, "data": null - }, - "admins": { - "expr_kind": { - "Set": [] - }, - "source_info": null, - "data": null } }, "ancestors": [ { "ty": { "Specified": { - "id": "Account", + "id": "UserGroup", "path": [] } }, - "eid": "alice" + "eid": "AVTeam" }, { "ty": { "Specified": { - "id": "AccountGroup", + "id": "UserGroup", "path": [] } }, - "eid": "GeronimoTeam" + "eid": "alice_friends" } ] } @@ -1263,7 +1176,7 @@ "path": [] } }, - "eid": "alice" + "eid": "stacey" }, { "uid": { @@ -1273,22 +1186,12 @@ "path": [] } }, - "eid": "alice" + "eid": "stacey" }, "attrs": { - "owner": { + "admins": { "expr_kind": { - "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - } + "Set": [] }, "source_info": null, "data": null @@ -1302,60 +1205,61 @@ "source_info": null, "data": null }, - "admins": { + "owner": { "expr_kind": { - "Set": [] + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "stacey" + } + } }, "source_info": null, "data": null } }, - "ancestors": [ - { - "ty": { - "Specified": { - "id": "AccountGroup", - "path": [] - } - }, - "eid": "GeronimoTeam" - } - ] + "ancestors": [] } ], [ { "ty": { "Specified": { - "id": "AccountGroup", + "id": "User", "path": [] } }, - "eid": "GeronimoTeam" + "eid": "ahmad" }, { "uid": { "ty": { "Specified": { - "id": "AccountGroup", + "id": "User", "path": [] } }, - "eid": "GeronimoTeam" + "eid": "ahmad" }, "attrs": { - "owner": { + "department": { "expr_kind": { "Lit": { - "EntityUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } + "String": "HardwareEngineering" + } + }, + "source_info": null, + "data": null + }, + "jobLevel": { + "expr_kind": { + "Lit": { + "Long": 4 } }, "source_info": null, @@ -1403,18 +1307,18 @@ "source_info": null, "data": null }, - "private": { + "admins": { "expr_kind": { - "Lit": { - "Bool": true - } + "Set": [] }, "source_info": null, "data": null }, - "admins": { + "private": { "expr_kind": { - "Set": [] + "Lit": { + "Bool": true + } }, "source_info": null, "data": null @@ -1424,20 +1328,20 @@ { "ty": { "Specified": { - "id": "AccountGroup", + "id": "Account", "path": [] } }, - "eid": "GeronimoTeam" + "eid": "alice" }, { "ty": { "Specified": { - "id": "Account", + "id": "AccountGroup", "path": [] } }, - "eid": "alice" + "eid": "GeronimoTeam" } ] } @@ -1446,47 +1350,143 @@ { "ty": { "Specified": { - "id": "Action", + "id": "Photo", "path": [] } }, - "eid": "delete" + "eid": "sales_projections.jpg" }, { "uid": { "ty": { "Specified": { - "id": "Action", + "id": "Photo", "path": [] } }, - "eid": "delete" + "eid": "sales_projections.jpg" }, - "attrs": {}, - "ancestors": [] + "attrs": { + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + } + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [ + { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "User", + "path": [] + } + }, + "eid": "giuseppe" + } + } + }, + "source_info": null, + "data": null + } + ] + }, + "source_info": null, + "data": null + }, + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + } + }, + "ancestors": [ + { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "stacey" + } + ] } ], [ { "ty": { "Specified": { - "id": "Action", + "id": "Album", "path": [] } }, - "eid": "listPhotos" + "eid": "device_prototypes" }, { "uid": { "ty": { "Specified": { - "id": "Action", + "id": "Album", "path": [] } }, - "eid": "listPhotos" + "eid": "device_prototypes" + }, + "attrs": { + "private": { + "expr_kind": { + "Lit": { + "Bool": false + } + }, + "source_info": null, + "data": null + }, + "account": { + "expr_kind": { + "Lit": { + "EntityUID": { + "ty": { + "Specified": { + "id": "Account", + "path": [] + } + }, + "eid": "alice" + } + } + }, + "source_info": null, + "data": null + }, + "admins": { + "expr_kind": { + "Set": [] + }, + "source_info": null, + "data": null + } }, - "attrs": {}, "ancestors": [] } ], @@ -1498,7 +1498,7 @@ "path": [] } }, - "eid": "view" + "eid": "comment" }, { "uid": { @@ -1508,7 +1508,7 @@ "path": [] } }, - "eid": "view" + "eid": "comment" }, "attrs": {}, "ancestors": [] diff --git a/cedar-lean/Cli/json-inputs/validate/decimal1.json b/cedar-lean/Cli/json-inputs/validate/decimal1.json deleted file mode 100644 index 607ff0440..000000000 --- a/cedar-lean/Cli/json-inputs/validate/decimal1.json +++ /dev/null @@ -1,883 +0,0 @@ -{ - "schema": { - "entityTypes": [ - [ - { - "id": "Administrator", - "path": [] - }, - { - "name": { - "id": "Administrator", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Album", - "path": [] - }, - { - "name": { - "id": "Album", - "path": [] - }, - "descendants": [ - { - "id": "Album", - "path": [] - }, - { - "id": "Photo", - "path": [] - } - ], - "attributes": { - "attrs": { - "account": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "Account", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "Photo", - "path": [] - }, - { - "name": { - "id": "Photo", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": { - "account": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "Account", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "Account", - "path": [] - }, - { - "name": { - "id": "Account", - "path": [] - }, - "descendants": [ - { - "id": "Album", - "path": [] - }, - { - "id": "Photo", - "path": [] - } - ], - "attributes": { - "attrs": { - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "owner": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "UserGroup", - "path": [] - }, - { - "name": { - "id": "UserGroup", - "path": [] - }, - "descendants": [ - { - "id": "User", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "AccountGroup", - "path": [] - }, - { - "name": { - "id": "AccountGroup", - "path": [] - }, - "descendants": [ - { - "id": "Account", - "path": [] - }, - { - "id": "Album", - "path": [] - }, - { - "id": "Photo", - "path": [] - } - ], - "attributes": { - "attrs": { - "owner": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "User", - "path": [] - }, - { - "name": { - "id": "User", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": { - "department": { - "attrType": { - "Primitive": { - "primitiveType": "String" - } - }, - "isRequired": true - }, - "jobLevel": { - "attrType": { - "Primitive": { - "primitiveType": "Long" - } - }, - "isRequired": true - } - } - } - } - ] - ], - "actionIds": [ - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Account", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "photo": { - "attrType": { - "EntityOrRecord": { - "Record": { - "attrs": { - "attrs": { - "filesize_mb": { - "attrType": { - "Primitive": { - "primitiveType": "Long" - } - }, - "isRequired": true - }, - "filetype": { - "attrType": { - "Primitive": { - "primitiveType": "String" - } - }, - "isRequired": true - } - } - }, - "open_attributes": "ClosedAttributes" - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ] - ] - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": "Any" - }, - "action_constraint": { - "Eq": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource_constraint": { - "constraint": { - "Eq": { - "EUID": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "greaterThan", - "path": [] - }, - "args": [ - { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "context" - }, - "source_info": { - "start": 102, - "end": 109 - }, - "data": null - }, - "attr": "confidence_score" - } - }, - "source_info": { - "start": 102, - "end": 155 - }, - "data": null - }, - { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "decimal", - "path": [] - }, - "args": [ - { - "expr_kind": { - "Lit": { - "String": "0.75" - } - }, - "source_info": { - "start": 147, - "end": 153 - }, - "data": null - } - ] - } - }, - "source_info": { - "start": 139, - "end": 154 - }, - "data": null - } - ] - } - }, - "source_info": { - "start": 102, - "end": 155 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "mode": "Strict" -} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/validate/decimal2.json b/cedar-lean/Cli/json-inputs/validate/decimal2.json index 628ab2a0c..7237e012d 100644 --- a/cedar-lean/Cli/json-inputs/validate/decimal2.json +++ b/cedar-lean/Cli/json-inputs/validate/decimal2.json @@ -14,28 +14,77 @@ "descendants": [], "attributes": { "attrs": {} - } + }, + "open_attributes": "ClosedAttributes" } ], [ { - "id": "UserGroup", + "id": "Album", "path": [] }, { "name": { - "id": "UserGroup", + "id": "Album", "path": [] }, "descendants": [ { - "id": "User", + "id": "Album", + "path": [] + }, + { + "id": "Photo", "path": [] } ], "attributes": { - "attrs": {} - } + "attrs": { + "account": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "Account", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, + "admins": { + "attrType": { + "Set": { + "elementType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + } + } + }, + "isRequired": true + }, + "private": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } + } + }, + "open_attributes": "ClosedAttributes" } ], [ @@ -103,7 +152,8 @@ "isRequired": true } } - } + }, + "open_attributes": "ClosedAttributes" } ], [ @@ -136,66 +186,30 @@ "isRequired": true } } - } + }, + "open_attributes": "ClosedAttributes" } ], [ { - "id": "Photo", + "id": "UserGroup", "path": [] }, { "name": { - "id": "Photo", + "id": "UserGroup", "path": [] }, - "descendants": [], - "attributes": { - "attrs": { - "account": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "Account", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } + "descendants": [ + { + "id": "User", + "path": [] } - } + ], + "attributes": { + "attrs": {} + }, + "open_attributes": "ClosedAttributes" } ], [ @@ -214,11 +228,11 @@ "path": [] }, { - "id": "Photo", + "id": "Account", "path": [] }, { - "id": "Account", + "id": "Photo", "path": [] } ], @@ -240,29 +254,21 @@ "isRequired": true } } - } + }, + "open_attributes": "ClosedAttributes" } ], [ { - "id": "Album", + "id": "Photo", "path": [] }, { "name": { - "id": "Album", + "id": "Photo", "path": [] }, - "descendants": [ - { - "id": "Album", - "path": [] - }, - { - "id": "Photo", - "path": [] - } - ], + "descendants": [], "attributes": { "attrs": { "account": { @@ -308,7 +314,8 @@ "isRequired": true } } - } + }, + "open_attributes": "ClosedAttributes" } ] ], @@ -321,7 +328,7 @@ "path": [] } }, - "eid": "listPhotos" + "eid": "listAlbums" }, { "name": { @@ -331,7 +338,7 @@ "path": [] } }, - "eid": "listPhotos" + "eid": "listAlbums" }, "appliesTo": { "principalApplySpec": [ @@ -345,7 +352,7 @@ "resourceApplySpec": [ { "Specified": { - "id": "Album", + "id": "Account", "path": [] } } @@ -353,14 +360,21 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } } }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -378,7 +392,7 @@ "path": [] } }, - "eid": "addPhoto" + "eid": "comment" }, { "name": { @@ -388,7 +402,7 @@ "path": [] } }, - "eid": "addPhoto" + "eid": "comment" }, "appliesTo": { "principalApplySpec": [ @@ -402,7 +416,7 @@ "resourceApplySpec": [ { "Specified": { - "id": "Album", + "id": "Photo", "path": [] } } @@ -410,44 +424,21 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "photo": { - "attrType": { - "EntityOrRecord": { - "Record": { - "attrs": { - "attrs": { - "filesize_mb": { - "attrType": { - "Primitive": { - "primitiveType": "Long" - } - }, - "isRequired": true - }, - "filetype": { - "attrType": { - "Primitive": { - "primitiveType": "String" - } - }, - "isRequired": true - } + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" } }, - "open_attributes": "ClosedAttributes" + "isRequired": true } } }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -465,7 +456,7 @@ "path": [] } }, - "eid": "comment" + "eid": "listPhotos" }, { "name": { @@ -475,7 +466,7 @@ "path": [] } }, - "eid": "comment" + "eid": "listPhotos" }, "appliesTo": { "principalApplySpec": [ @@ -489,7 +480,7 @@ "resourceApplySpec": [ { "Specified": { - "id": "Photo", + "id": "Album", "path": [] } } @@ -497,14 +488,21 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } } }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -522,7 +520,7 @@ "path": [] } }, - "eid": "edit" + "eid": "view" }, { "name": { @@ -532,7 +530,7 @@ "path": [] } }, - "eid": "edit" + "eid": "view" }, "appliesTo": { "principalApplySpec": [ @@ -554,14 +552,43 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true + } } }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -579,7 +606,7 @@ "path": [] } }, - "eid": "view" + "eid": "edit" }, { "name": { @@ -589,7 +616,7 @@ "path": [] } }, - "eid": "view" + "eid": "edit" }, "appliesTo": { "principalApplySpec": [ @@ -611,36 +638,21 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true } } }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -690,14 +702,21 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } } }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -715,7 +734,7 @@ "path": [] } }, - "eid": "listAlbums" + "eid": "addPhoto" }, { "name": { @@ -725,7 +744,7 @@ "path": [] } }, - "eid": "listAlbums" + "eid": "addPhoto" }, "appliesTo": { "principalApplySpec": [ @@ -739,7 +758,7 @@ "resourceApplySpec": [ { "Specified": { - "id": "Account", + "id": "Album", "path": [] } } @@ -747,14 +766,51 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "photo": { + "attrType": { + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "filesize_mb": { + "attrType": { + "Primitive": { + "primitiveType": "Long" + } + }, + "isRequired": true + }, + "filetype": { + "attrType": { + "Primitive": { + "primitiveType": "String" + } + }, + "isRequired": true + } + } + }, + "open_attributes": "ClosedAttributes" + } + } + }, + "isRequired": true + } } }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, diff --git a/cedar-lean/Cli/json-inputs/validate/example1a.json b/cedar-lean/Cli/json-inputs/validate/example1a.json deleted file mode 100644 index 490192515..000000000 --- a/cedar-lean/Cli/json-inputs/validate/example1a.json +++ /dev/null @@ -1,802 +0,0 @@ -{ - "schema": { - "entityTypes": [ - [ - { - "id": "Account", - "path": [] - }, - { - "name": { - "id": "Account", - "path": [] - }, - "descendants": [ - { - "id": "Photo", - "path": [] - }, - { - "id": "Video", - "path": [] - }, - { - "id": "Album", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "AccountGroup", - "path": [] - }, - { - "name": { - "id": "AccountGroup", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Administrator", - "path": [] - }, - { - "name": { - "id": "Administrator", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Video", - "path": [] - }, - { - "name": { - "id": "Video", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Album", - "path": [] - }, - { - "name": { - "id": "Album", - "path": [] - }, - "descendants": [ - { - "id": "Video", - "path": [] - }, - { - "id": "Album", - "path": [] - }, - { - "id": "Photo", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "User", - "path": [] - }, - { - "name": { - "id": "User", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Photo", - "path": [] - }, - { - "name": { - "id": "Photo", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "UserGroup", - "path": [] - }, - { - "name": { - "id": "UserGroup", - "path": [] - }, - "descendants": [ - { - "id": "User", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ] - ], - "actionIds": [ - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Account", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "Administrator", - "path": [] - } - }, - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Video", - "path": [] - } - }, - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ] - ] - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": { - "Eq": { - "EUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - } - } - }, - "action_constraint": { - "Eq": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource_constraint": { - "constraint": { - "Eq": { - "EUID": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": { - "start": 56, - "end": 168 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "mode": "Strict" -} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/validate/example2a.json b/cedar-lean/Cli/json-inputs/validate/example2a.json index 4a3344580..53dd52b0a 100644 --- a/cedar-lean/Cli/json-inputs/validate/example2a.json +++ b/cedar-lean/Cli/json-inputs/validate/example2a.json @@ -3,95 +3,105 @@ "entityTypes": [ [ { - "id": "AccountGroup", + "id": "Photo", "path": [] }, { "name": { - "id": "AccountGroup", + "id": "Photo", "path": [] }, "descendants": [], "attributes": { "attrs": {} - } + }, + "open_attributes": "ClosedAttributes" } ], [ { - "id": "Administrator", + "id": "Album", "path": [] }, { "name": { - "id": "Administrator", + "id": "Album", "path": [] }, - "descendants": [], + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Video", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], "attributes": { "attrs": {} - } + }, + "open_attributes": "ClosedAttributes" } ], [ { - "id": "Photo", + "id": "UserGroup", "path": [] }, { "name": { - "id": "Photo", + "id": "UserGroup", "path": [] }, - "descendants": [], + "descendants": [ + { + "id": "User", + "path": [] + } + ], "attributes": { "attrs": {} - } + }, + "open_attributes": "ClosedAttributes" } ], [ { - "id": "Album", + "id": "Video", "path": [] }, { "name": { - "id": "Album", + "id": "Video", "path": [] }, - "descendants": [ - { - "id": "Photo", - "path": [] - }, - { - "id": "Album", - "path": [] - }, - { - "id": "Video", - "path": [] - } - ], + "descendants": [], "attributes": { "attrs": {} - } + }, + "open_attributes": "ClosedAttributes" } ], [ { - "id": "User", + "id": "AccountGroup", "path": [] }, { "name": { - "id": "User", + "id": "AccountGroup", "path": [] }, "descendants": [], "attributes": { "attrs": {} - } + }, + "open_attributes": "ClosedAttributes" } ], [ @@ -110,54 +120,52 @@ "path": [] }, { - "id": "Album", + "id": "Photo", "path": [] }, { - "id": "Photo", + "id": "Album", "path": [] } ], "attributes": { "attrs": {} - } + }, + "open_attributes": "ClosedAttributes" } ], [ { - "id": "UserGroup", + "id": "User", "path": [] }, { "name": { - "id": "UserGroup", + "id": "User", "path": [] }, - "descendants": [ - { - "id": "User", - "path": [] - } - ], + "descendants": [], "attributes": { "attrs": {} - } + }, + "open_attributes": "ClosedAttributes" } ], [ { - "id": "Video", + "id": "Administrator", "path": [] }, { "name": { - "id": "Video", + "id": "Administrator", "path": [] }, "descendants": [], "attributes": { "attrs": {} - } + }, + "open_attributes": "ClosedAttributes" } ] ], @@ -170,7 +178,7 @@ "path": [] } }, - "eid": "delete" + "eid": "view" }, { "name": { @@ -180,7 +188,7 @@ "path": [] } }, - "eid": "delete" + "eid": "view" }, "appliesTo": { "principalApplySpec": [ @@ -189,6 +197,12 @@ "id": "User", "path": [] } + }, + { + "Specified": { + "id": "Administrator", + "path": [] + } } ], "resourceApplySpec": [ @@ -197,41 +211,54 @@ "id": "Photo", "path": [] } + }, + { + "Specified": { + "id": "Video", + "path": [] + } } ] }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true } } }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -249,7 +276,7 @@ "path": [] } }, - "eid": "view" + "eid": "delete" }, { "name": { @@ -259,16 +286,10 @@ "path": [] } }, - "eid": "view" + "eid": "delete" }, "appliesTo": { "principalApplySpec": [ - { - "Specified": { - "id": "Administrator", - "path": [] - } - }, { "Specified": { "id": "User", @@ -282,47 +303,48 @@ "id": "Photo", "path": [] } - }, - { - "Specified": { - "id": "Video", - "path": [] - } } ] }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true } } }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -340,7 +362,7 @@ "path": [] } }, - "eid": "listPhotos" + "eid": "listAlbums" }, { "name": { @@ -350,7 +372,7 @@ "path": [] } }, - "eid": "listPhotos" + "eid": "listAlbums" }, "appliesTo": { "principalApplySpec": [ @@ -364,7 +386,7 @@ "resourceApplySpec": [ { "Specified": { - "id": "Album", + "id": "Account", "path": [] } } @@ -372,36 +394,43 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true } } }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -451,36 +480,43 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true } } }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -498,7 +534,7 @@ "path": [] } }, - "eid": "edit" + "eid": "listPhotos" }, { "name": { @@ -508,7 +544,7 @@ "path": [] } }, - "eid": "edit" + "eid": "listPhotos" }, "appliesTo": { "principalApplySpec": [ @@ -522,7 +558,7 @@ "resourceApplySpec": [ { "Specified": { - "id": "Photo", + "id": "Album", "path": [] } } @@ -530,36 +566,43 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true } } }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -577,7 +620,7 @@ "path": [] } }, - "eid": "addPhoto" + "eid": "edit" }, { "name": { @@ -587,7 +630,7 @@ "path": [] } }, - "eid": "addPhoto" + "eid": "edit" }, "appliesTo": { "principalApplySpec": [ @@ -601,7 +644,7 @@ "resourceApplySpec": [ { "Specified": { - "id": "Album", + "id": "Photo", "path": [] } } @@ -609,36 +652,43 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true } } }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -656,7 +706,7 @@ "path": [] } }, - "eid": "listAlbums" + "eid": "addPhoto" }, { "name": { @@ -666,7 +716,7 @@ "path": [] } }, - "eid": "listAlbums" + "eid": "addPhoto" }, "appliesTo": { "principalApplySpec": [ @@ -680,7 +730,7 @@ "resourceApplySpec": [ { "Specified": { - "id": "Account", + "id": "Album", "path": [] } } @@ -688,36 +738,43 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true } } }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, diff --git a/cedar-lean/Cli/json-inputs/validate/example2b.json b/cedar-lean/Cli/json-inputs/validate/example2b.json deleted file mode 100644 index bc1272881..000000000 --- a/cedar-lean/Cli/json-inputs/validate/example2b.json +++ /dev/null @@ -1,802 +0,0 @@ -{ - "schema": { - "entityTypes": [ - [ - { - "id": "UserGroup", - "path": [] - }, - { - "name": { - "id": "UserGroup", - "path": [] - }, - "descendants": [ - { - "id": "User", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Album", - "path": [] - }, - { - "name": { - "id": "Album", - "path": [] - }, - "descendants": [ - { - "id": "Album", - "path": [] - }, - { - "id": "Video", - "path": [] - }, - { - "id": "Photo", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Administrator", - "path": [] - }, - { - "name": { - "id": "Administrator", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Photo", - "path": [] - }, - { - "name": { - "id": "Photo", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "User", - "path": [] - }, - { - "name": { - "id": "User", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Account", - "path": [] - }, - { - "name": { - "id": "Account", - "path": [] - }, - "descendants": [ - { - "id": "Photo", - "path": [] - }, - { - "id": "Album", - "path": [] - }, - { - "id": "Video", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "AccountGroup", - "path": [] - }, - { - "name": { - "id": "AccountGroup", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Video", - "path": [] - }, - { - "name": { - "id": "Video", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ] - ], - "actionIds": [ - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Account", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - }, - { - "Specified": { - "id": "Administrator", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Video", - "path": [] - } - }, - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ] - ] - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": { - "Eq": { - "EUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - } - } - }, - "action_constraint": { - "Eq": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource_constraint": { - "constraint": { - "In": { - "EUID": { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": { - "start": 68, - "end": 174 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "mode": "Strict" -} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/validate/example2c.json b/cedar-lean/Cli/json-inputs/validate/example2c.json index 2143a969e..c515a4fc0 100644 --- a/cedar-lean/Cli/json-inputs/validate/example2c.json +++ b/cedar-lean/Cli/json-inputs/validate/example2c.json @@ -14,52 +14,25 @@ "descendants": [], "attributes": { "attrs": {} - } - } - ], - [ - { - "id": "Account", - "path": [] - }, - { - "name": { - "id": "Account", - "path": [] }, - "descendants": [ - { - "id": "Video", - "path": [] - }, - { - "id": "Photo", - "path": [] - }, - { - "id": "Album", - "path": [] - } - ], - "attributes": { - "attrs": {} - } + "open_attributes": "ClosedAttributes" } ], [ { - "id": "Video", + "id": "Administrator", "path": [] }, { "name": { - "id": "Video", + "id": "Administrator", "path": [] }, "descendants": [], "attributes": { "attrs": {} - } + }, + "open_attributes": "ClosedAttributes" } ], [ @@ -80,23 +53,25 @@ ], "attributes": { "attrs": {} - } + }, + "open_attributes": "ClosedAttributes" } ], [ { - "id": "User", + "id": "Photo", "path": [] }, { "name": { - "id": "User", + "id": "Photo", "path": [] }, "descendants": [], "attributes": { "attrs": {} - } + }, + "open_attributes": "ClosedAttributes" } ], [ @@ -111,11 +86,11 @@ }, "descendants": [ { - "id": "Album", + "id": "Photo", "path": [] }, { - "id": "Photo", + "id": "Album", "path": [] }, { @@ -125,39 +100,72 @@ ], "attributes": { "attrs": {} - } + }, + "open_attributes": "ClosedAttributes" } ], [ { - "id": "Administrator", + "id": "Video", "path": [] }, { "name": { - "id": "Administrator", + "id": "Video", "path": [] }, "descendants": [], "attributes": { "attrs": {} - } + }, + "open_attributes": "ClosedAttributes" } ], [ { - "id": "Photo", + "id": "User", "path": [] }, { "name": { - "id": "Photo", + "id": "User", "path": [] }, "descendants": [], "attributes": { "attrs": {} - } + }, + "open_attributes": "ClosedAttributes" + } + ], + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + }, + { + "id": "Video", + "path": [] + } + ], + "attributes": { + "attrs": {} + }, + "open_attributes": "ClosedAttributes" } ] ], @@ -170,7 +178,7 @@ "path": [] } }, - "eid": "comment" + "eid": "view" }, { "name": { @@ -180,10 +188,16 @@ "path": [] } }, - "eid": "comment" + "eid": "view" }, "appliesTo": { "principalApplySpec": [ + { + "Specified": { + "id": "Administrator", + "path": [] + } + }, { "Specified": { "id": "User", @@ -197,41 +211,54 @@ "id": "Photo", "path": [] } + }, + { + "Specified": { + "id": "Video", + "path": [] + } } ] }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true } } }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -249,7 +276,7 @@ "path": [] } }, - "eid": "delete" + "eid": "edit" }, { "name": { @@ -259,7 +286,7 @@ "path": [] } }, - "eid": "delete" + "eid": "edit" }, "appliesTo": { "principalApplySpec": [ @@ -281,36 +308,43 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true } } }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -328,7 +362,7 @@ "path": [] } }, - "eid": "addPhoto" + "eid": "listAlbums" }, { "name": { @@ -338,7 +372,7 @@ "path": [] } }, - "eid": "addPhoto" + "eid": "listAlbums" }, "appliesTo": { "principalApplySpec": [ @@ -352,7 +386,7 @@ "resourceApplySpec": [ { "Specified": { - "id": "Album", + "id": "Account", "path": [] } } @@ -360,36 +394,43 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true } } }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -439,36 +480,43 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true } } }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -486,7 +534,7 @@ "path": [] } }, - "eid": "edit" + "eid": "comment" }, { "name": { @@ -496,7 +544,7 @@ "path": [] } }, - "eid": "edit" + "eid": "comment" }, "appliesTo": { "principalApplySpec": [ @@ -518,36 +566,43 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true } } }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -565,7 +620,7 @@ "path": [] } }, - "eid": "listAlbums" + "eid": "delete" }, { "name": { @@ -575,7 +630,7 @@ "path": [] } }, - "eid": "listAlbums" + "eid": "delete" }, "appliesTo": { "principalApplySpec": [ @@ -589,7 +644,7 @@ "resourceApplySpec": [ { "Specified": { - "id": "Account", + "id": "Photo", "path": [] } } @@ -597,36 +652,43 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true } } }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -644,7 +706,7 @@ "path": [] } }, - "eid": "view" + "eid": "addPhoto" }, { "name": { @@ -654,7 +716,7 @@ "path": [] } }, - "eid": "view" + "eid": "addPhoto" }, "appliesTo": { "principalApplySpec": [ @@ -663,24 +725,12 @@ "id": "User", "path": [] } - }, - { - "Specified": { - "id": "Administrator", - "path": [] - } } ], "resourceApplySpec": [ { "Specified": { - "id": "Photo", - "path": [] - } - }, - { - "Specified": { - "id": "Video", + "id": "Album", "path": [] } } @@ -688,36 +738,43 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true } } }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, diff --git a/cedar-lean/Cli/json-inputs/validate/example3a.json b/cedar-lean/Cli/json-inputs/validate/example3a.json deleted file mode 100644 index 347c97905..000000000 --- a/cedar-lean/Cli/json-inputs/validate/example3a.json +++ /dev/null @@ -1,790 +0,0 @@ -{ - "schema": { - "entityTypes": [ - [ - { - "id": "AccountGroup", - "path": [] - }, - { - "name": { - "id": "AccountGroup", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Video", - "path": [] - }, - { - "name": { - "id": "Video", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Photo", - "path": [] - }, - { - "name": { - "id": "Photo", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "UserGroup", - "path": [] - }, - { - "name": { - "id": "UserGroup", - "path": [] - }, - "descendants": [ - { - "id": "User", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Account", - "path": [] - }, - { - "name": { - "id": "Account", - "path": [] - }, - "descendants": [ - { - "id": "Photo", - "path": [] - }, - { - "id": "Video", - "path": [] - }, - { - "id": "Album", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Album", - "path": [] - }, - { - "name": { - "id": "Album", - "path": [] - }, - "descendants": [ - { - "id": "Photo", - "path": [] - }, - { - "id": "Video", - "path": [] - }, - { - "id": "Album", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "User", - "path": [] - }, - { - "name": { - "id": "User", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Administrator", - "path": [] - }, - { - "name": { - "id": "Administrator", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ] - ], - "actionIds": [ - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - }, - { - "Specified": { - "id": "Administrator", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - }, - { - "Specified": { - "id": "Video", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Account", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ] - ] - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": "Any" - }, - "action_constraint": { - "Eq": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource_constraint": { - "constraint": { - "In": { - "EUID": { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": { - "start": 63, - "end": 152 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "mode": "Strict" -} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/validate/example3b.json b/cedar-lean/Cli/json-inputs/validate/example3b.json deleted file mode 100644 index 0aa07de3f..000000000 --- a/cedar-lean/Cli/json-inputs/validate/example3b.json +++ /dev/null @@ -1,822 +0,0 @@ -{ - "schema": { - "entityTypes": [ - [ - { - "id": "Album", - "path": [] - }, - { - "name": { - "id": "Album", - "path": [] - }, - "descendants": [ - { - "id": "Album", - "path": [] - }, - { - "id": "Video", - "path": [] - }, - { - "id": "Photo", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Video", - "path": [] - }, - { - "name": { - "id": "Video", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Administrator", - "path": [] - }, - { - "name": { - "id": "Administrator", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Photo", - "path": [] - }, - { - "name": { - "id": "Photo", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "AccountGroup", - "path": [] - }, - { - "name": { - "id": "AccountGroup", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Account", - "path": [] - }, - { - "name": { - "id": "Account", - "path": [] - }, - "descendants": [ - { - "id": "Album", - "path": [] - }, - { - "id": "Photo", - "path": [] - }, - { - "id": "Video", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "UserGroup", - "path": [] - }, - { - "name": { - "id": "UserGroup", - "path": [] - }, - "descendants": [ - { - "id": "User", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "User", - "path": [] - }, - { - "name": { - "id": "User", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ] - ], - "actionIds": [ - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Account", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - }, - { - "Specified": { - "id": "Administrator", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - }, - { - "Specified": { - "id": "Video", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ] - ] - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": { - "Eq": { - "EUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - } - } - }, - "action_constraint": { - "In": [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - ] - }, - "resource_constraint": { - "constraint": { - "In": { - "EUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "jane" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": { - "start": 86, - "end": 231 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "mode": "Strict" -} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/validate/example3c.json b/cedar-lean/Cli/json-inputs/validate/example3c.json deleted file mode 100644 index e2fcdcb94..000000000 --- a/cedar-lean/Cli/json-inputs/validate/example3c.json +++ /dev/null @@ -1,792 +0,0 @@ -{ - "schema": { - "entityTypes": [ - [ - { - "id": "Video", - "path": [] - }, - { - "name": { - "id": "Video", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Album", - "path": [] - }, - { - "name": { - "id": "Album", - "path": [] - }, - "descendants": [ - { - "id": "Photo", - "path": [] - }, - { - "id": "Video", - "path": [] - }, - { - "id": "Album", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "User", - "path": [] - }, - { - "name": { - "id": "User", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Photo", - "path": [] - }, - { - "name": { - "id": "Photo", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "AccountGroup", - "path": [] - }, - { - "name": { - "id": "AccountGroup", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "UserGroup", - "path": [] - }, - { - "name": { - "id": "UserGroup", - "path": [] - }, - "descendants": [ - { - "id": "User", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Administrator", - "path": [] - }, - { - "name": { - "id": "Administrator", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Account", - "path": [] - }, - { - "name": { - "id": "Account", - "path": [] - }, - "descendants": [ - { - "id": "Photo", - "path": [] - }, - { - "id": "Album", - "path": [] - }, - { - "id": "Video", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ] - ], - "actionIds": [ - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "Administrator", - "path": [] - } - }, - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Video", - "path": [] - } - }, - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Account", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ] - ] - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": { - "Eq": { - "EUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "alice" - } - } - } - }, - "action_constraint": "Any", - "resource_constraint": { - "constraint": { - "In": { - "EUID": { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": { - "start": 85, - "end": 173 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "mode": "Strict" -} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/validate/example4a.json b/cedar-lean/Cli/json-inputs/validate/example4a.json deleted file mode 100644 index 5e8686723..000000000 --- a/cedar-lean/Cli/json-inputs/validate/example4a.json +++ /dev/null @@ -1,919 +0,0 @@ -{ - "schema": { - "entityTypes": [ - [ - { - "id": "Administrator", - "path": [] - }, - { - "name": { - "id": "Administrator", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "UserGroup", - "path": [] - }, - { - "name": { - "id": "UserGroup", - "path": [] - }, - "descendants": [ - { - "id": "User", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Photo", - "path": [] - }, - { - "name": { - "id": "Photo", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": { - "account": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "Account", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "Album", - "path": [] - }, - { - "name": { - "id": "Album", - "path": [] - }, - "descendants": [ - { - "id": "Photo", - "path": [] - }, - { - "id": "Album", - "path": [] - } - ], - "attributes": { - "attrs": { - "account": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "Account", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "Account", - "path": [] - }, - { - "name": { - "id": "Account", - "path": [] - }, - "descendants": [ - { - "id": "Album", - "path": [] - }, - { - "id": "Photo", - "path": [] - } - ], - "attributes": { - "attrs": { - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "owner": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "User", - "path": [] - }, - { - "name": { - "id": "User", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": { - "department": { - "attrType": { - "Primitive": { - "primitiveType": "String" - } - }, - "isRequired": true - }, - "jobLevel": { - "attrType": { - "Primitive": { - "primitiveType": "Long" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "AccountGroup", - "path": [] - }, - { - "name": { - "id": "AccountGroup", - "path": [] - }, - "descendants": [ - { - "id": "Photo", - "path": [] - }, - { - "id": "Album", - "path": [] - }, - { - "id": "Account", - "path": [] - } - ], - "attributes": { - "attrs": { - "owner": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - }, - "isRequired": true - } - } - } - } - ] - ], - "actionIds": [ - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Account", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "photo": { - "attrType": { - "EntityOrRecord": { - "Record": { - "attrs": { - "attrs": { - "filesize_mb": { - "attrType": { - "Primitive": { - "primitiveType": "Long" - } - }, - "isRequired": true - }, - "filetype": { - "attrType": { - "Primitive": { - "primitiveType": "String" - } - }, - "isRequired": true - } - } - }, - "open_attributes": "ClosedAttributes" - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ] - ] - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": "Any" - }, - "action_constraint": { - "In": [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - ] - }, - "resource_constraint": { - "constraint": { - "In": { - "EUID": { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "device_prototypes" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "And": { - "left": { - "expr_kind": { - "BinaryApp": { - "op": "Eq", - "arg1": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "principal" - }, - "source_info": { - "start": 257, - "end": 266 - }, - "data": null - }, - "attr": "department" - } - }, - "source_info": { - "start": 257, - "end": 277 - }, - "data": null - }, - "arg2": { - "expr_kind": { - "Lit": { - "String": "HardwareEngineering" - } - }, - "source_info": { - "start": 281, - "end": 302 - }, - "data": null - } - } - }, - "source_info": { - "start": 257, - "end": 302 - }, - "data": null - }, - "right": { - "expr_kind": { - "UnaryApp": { - "op": "Not", - "arg": { - "expr_kind": { - "BinaryApp": { - "op": "Less", - "arg1": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "principal" - }, - "source_info": { - "start": 306, - "end": 315 - }, - "data": null - }, - "attr": "jobLevel" - } - }, - "source_info": { - "start": 306, - "end": 324 - }, - "data": null - }, - "arg2": { - "expr_kind": { - "Lit": { - "Long": 5 - } - }, - "source_info": { - "start": 328, - "end": 329 - }, - "data": null - } - } - }, - "source_info": { - "start": 306, - "end": 329 - }, - "data": null - } - } - }, - "source_info": { - "start": 306, - "end": 329 - }, - "data": null - } - } - }, - "source_info": { - "start": 257, - "end": 329 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "mode": "Strict" -} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/validate/example4d.json b/cedar-lean/Cli/json-inputs/validate/example4d.json deleted file mode 100644 index 0dfc2670a..000000000 --- a/cedar-lean/Cli/json-inputs/validate/example4d.json +++ /dev/null @@ -1,860 +0,0 @@ -{ - "schema": { - "entityTypes": [ - [ - { - "id": "User", - "path": [] - }, - { - "name": { - "id": "User", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": { - "department": { - "attrType": { - "Primitive": { - "primitiveType": "String" - } - }, - "isRequired": true - }, - "jobLevel": { - "attrType": { - "Primitive": { - "primitiveType": "Long" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "UserGroup", - "path": [] - }, - { - "name": { - "id": "UserGroup", - "path": [] - }, - "descendants": [ - { - "id": "User", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "AccountGroup", - "path": [] - }, - { - "name": { - "id": "AccountGroup", - "path": [] - }, - "descendants": [ - { - "id": "Photo", - "path": [] - }, - { - "id": "Account", - "path": [] - }, - { - "id": "Album", - "path": [] - } - ], - "attributes": { - "attrs": { - "owner": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "Account", - "path": [] - }, - { - "name": { - "id": "Account", - "path": [] - }, - "descendants": [ - { - "id": "Photo", - "path": [] - }, - { - "id": "Album", - "path": [] - } - ], - "attributes": { - "attrs": { - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "owner": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "Photo", - "path": [] - }, - { - "name": { - "id": "Photo", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": { - "account": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "Account", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "Album", - "path": [] - }, - { - "name": { - "id": "Album", - "path": [] - }, - "descendants": [ - { - "id": "Photo", - "path": [] - }, - { - "id": "Album", - "path": [] - } - ], - "attributes": { - "attrs": { - "account": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "Account", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "Administrator", - "path": [] - }, - { - "name": { - "id": "Administrator", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ] - ], - "actionIds": [ - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Account", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "photo": { - "attrType": { - "EntityOrRecord": { - "Record": { - "attrs": { - "attrs": { - "filesize_mb": { - "attrType": { - "Primitive": { - "primitiveType": "Long" - } - }, - "isRequired": true - }, - "filetype": { - "attrType": { - "Primitive": { - "primitiveType": "String" - } - }, - "isRequired": true - } - } - }, - "open_attributes": "ClosedAttributes" - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ] - ] - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": "Any" - }, - "action_constraint": "Any", - "resource_constraint": { - "constraint": "Any" - }, - "non_head_constraints": { - "expr_kind": { - "And": { - "left": { - "expr_kind": { - "HasAttr": { - "expr": { - "expr_kind": { - "Var": "resource" - }, - "source_info": { - "start": 337, - "end": 345 - }, - "data": null - }, - "attr": "account" - } - }, - "source_info": { - "start": 337, - "end": 357 - }, - "data": null - }, - "right": { - "expr_kind": { - "BinaryApp": { - "op": "Eq", - "arg1": { - "expr_kind": { - "Var": "principal" - }, - "source_info": { - "start": 361, - "end": 370 - }, - "data": null - }, - "arg2": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "resource" - }, - "source_info": { - "start": 374, - "end": 382 - }, - "data": null - }, - "attr": "account" - } - }, - "source_info": { - "start": 374, - "end": 396 - }, - "data": null - }, - "attr": "owner" - } - }, - "source_info": { - "start": 374, - "end": 396 - }, - "data": null - } - } - }, - "source_info": { - "start": 361, - "end": 396 - }, - "data": null - } - } - }, - "source_info": { - "start": 337, - "end": 396 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "mode": "Strict" -} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/validate/example4e.json b/cedar-lean/Cli/json-inputs/validate/example4e.json deleted file mode 100644 index 72d052bdc..000000000 --- a/cedar-lean/Cli/json-inputs/validate/example4e.json +++ /dev/null @@ -1,861 +0,0 @@ -{ - "schema": { - "entityTypes": [ - [ - { - "id": "Administrator", - "path": [] - }, - { - "name": { - "id": "Administrator", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Album", - "path": [] - }, - { - "name": { - "id": "Album", - "path": [] - }, - "descendants": [ - { - "id": "Album", - "path": [] - }, - { - "id": "Photo", - "path": [] - } - ], - "attributes": { - "attrs": { - "account": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "Account", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "AccountGroup", - "path": [] - }, - { - "name": { - "id": "AccountGroup", - "path": [] - }, - "descendants": [ - { - "id": "Album", - "path": [] - }, - { - "id": "Photo", - "path": [] - }, - { - "id": "Account", - "path": [] - } - ], - "attributes": { - "attrs": { - "owner": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "User", - "path": [] - }, - { - "name": { - "id": "User", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": { - "department": { - "attrType": { - "Primitive": { - "primitiveType": "String" - } - }, - "isRequired": true - }, - "jobLevel": { - "attrType": { - "Primitive": { - "primitiveType": "Long" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "UserGroup", - "path": [] - }, - { - "name": { - "id": "UserGroup", - "path": [] - }, - "descendants": [ - { - "id": "User", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Account", - "path": [] - }, - { - "name": { - "id": "Account", - "path": [] - }, - "descendants": [ - { - "id": "Album", - "path": [] - }, - { - "id": "Photo", - "path": [] - } - ], - "attributes": { - "attrs": { - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "owner": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "Photo", - "path": [] - }, - { - "name": { - "id": "Photo", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": { - "account": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "Account", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ] - ], - "actionIds": [ - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Account", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "photo": { - "attrType": { - "EntityOrRecord": { - "Record": { - "attrs": { - "attrs": { - "filesize_mb": { - "attrType": { - "Primitive": { - "primitiveType": "Long" - } - }, - "isRequired": true - }, - "filetype": { - "attrType": { - "Primitive": { - "primitiveType": "String" - } - }, - "isRequired": true - } - } - }, - "open_attributes": "ClosedAttributes" - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ] - ] - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": "Any" - }, - "action_constraint": { - "Eq": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource_constraint": { - "constraint": "Any" - }, - "non_head_constraints": { - "expr_kind": { - "BinaryApp": { - "op": "Eq", - "arg1": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "principal" - }, - "source_info": { - "start": 337, - "end": 346 - }, - "data": null - }, - "attr": "department" - } - }, - "source_info": { - "start": 337, - "end": 357 - }, - "data": null - }, - "arg2": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "resource" - }, - "source_info": { - "start": 361, - "end": 369 - }, - "data": null - }, - "attr": "account" - } - }, - "source_info": { - "start": 361, - "end": 394 - }, - "data": null - }, - "attr": "owner" - } - }, - "source_info": { - "start": 361, - "end": 394 - }, - "data": null - }, - "attr": "department" - } - }, - "source_info": { - "start": 361, - "end": 394 - }, - "data": null - } - } - }, - "source_info": { - "start": 337, - "end": 394 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "mode": "Strict" -} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/validate/example4f.json b/cedar-lean/Cli/json-inputs/validate/example4f.json deleted file mode 100644 index e4bf679c6..000000000 --- a/cedar-lean/Cli/json-inputs/validate/example4f.json +++ /dev/null @@ -1,915 +0,0 @@ -{ - "schema": { - "entityTypes": [ - [ - { - "id": "AccountGroup", - "path": [] - }, - { - "name": { - "id": "AccountGroup", - "path": [] - }, - "descendants": [ - { - "id": "Account", - "path": [] - }, - { - "id": "Album", - "path": [] - }, - { - "id": "Photo", - "path": [] - } - ], - "attributes": { - "attrs": { - "owner": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "Photo", - "path": [] - }, - { - "name": { - "id": "Photo", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": { - "account": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "Account", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "Administrator", - "path": [] - }, - { - "name": { - "id": "Administrator", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "UserGroup", - "path": [] - }, - { - "name": { - "id": "UserGroup", - "path": [] - }, - "descendants": [ - { - "id": "User", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Album", - "path": [] - }, - { - "name": { - "id": "Album", - "path": [] - }, - "descendants": [ - { - "id": "Photo", - "path": [] - }, - { - "id": "Album", - "path": [] - } - ], - "attributes": { - "attrs": { - "account": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "Account", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "User", - "path": [] - }, - { - "name": { - "id": "User", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": { - "department": { - "attrType": { - "Primitive": { - "primitiveType": "String" - } - }, - "isRequired": true - }, - "jobLevel": { - "attrType": { - "Primitive": { - "primitiveType": "Long" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "Account", - "path": [] - }, - { - "name": { - "id": "Account", - "path": [] - }, - "descendants": [ - { - "id": "Photo", - "path": [] - }, - { - "id": "Album", - "path": [] - } - ], - "attributes": { - "attrs": { - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "owner": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ] - ], - "actionIds": [ - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Account", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "photo": { - "attrType": { - "EntityOrRecord": { - "Record": { - "attrs": { - "attrs": { - "filesize_mb": { - "attrType": { - "Primitive": { - "primitiveType": "Long" - } - }, - "isRequired": true - }, - "filetype": { - "attrType": { - "Primitive": { - "primitiveType": "String" - } - }, - "isRequired": true - } - } - }, - "open_attributes": "ClosedAttributes" - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ] - ] - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": "Any" - }, - "action_constraint": "Any", - "resource_constraint": { - "constraint": "Any" - }, - "non_head_constraints": { - "expr_kind": { - "Or": { - "left": { - "expr_kind": { - "And": { - "left": { - "expr_kind": { - "HasAttr": { - "expr": { - "expr_kind": { - "Var": "resource" - }, - "source_info": { - "start": 364, - "end": 372 - }, - "data": null - }, - "attr": "account" - } - }, - "source_info": { - "start": 364, - "end": 384 - }, - "data": null - }, - "right": { - "expr_kind": { - "BinaryApp": { - "op": "Eq", - "arg1": { - "expr_kind": { - "Var": "principal" - }, - "source_info": { - "start": 388, - "end": 397 - }, - "data": null - }, - "arg2": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "resource" - }, - "source_info": { - "start": 401, - "end": 409 - }, - "data": null - }, - "attr": "account" - } - }, - "source_info": { - "start": 401, - "end": 423 - }, - "data": null - }, - "attr": "owner" - } - }, - "source_info": { - "start": 401, - "end": 423 - }, - "data": null - } - } - }, - "source_info": { - "start": 388, - "end": 423 - }, - "data": null - } - } - }, - "source_info": { - "start": 364, - "end": 423 - }, - "data": null - }, - "right": { - "expr_kind": { - "BinaryApp": { - "op": "Contains", - "arg1": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "resource" - }, - "source_info": { - "start": 430, - "end": 438 - }, - "data": null - }, - "attr": "admins" - } - }, - "source_info": { - "start": 430, - "end": 465 - }, - "data": null - }, - "arg2": { - "expr_kind": { - "Var": "principal" - }, - "source_info": { - "start": 455, - "end": 464 - }, - "data": null - } - } - }, - "source_info": { - "start": 430, - "end": 465 - }, - "data": null - } - } - }, - "source_info": { - "start": 363, - "end": 465 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "mode": "Strict" -} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/validate/example5b.json b/cedar-lean/Cli/json-inputs/validate/example5b.json index 6c329a052..6f3e9438a 100644 --- a/cedar-lean/Cli/json-inputs/validate/example5b.json +++ b/cedar-lean/Cli/json-inputs/validate/example5b.json @@ -3,63 +3,24 @@ "entityTypes": [ [ { - "id": "AccountGroup", + "id": "UserGroup", "path": [] }, { "name": { - "id": "AccountGroup", + "id": "UserGroup", "path": [] }, "descendants": [ { - "id": "Photo", - "path": [] - }, - { - "id": "Album", - "path": [] - }, - { - "id": "Account", + "id": "User", "path": [] } ], - "attributes": { - "attrs": { - "owner": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "Administrator", - "path": [] - }, - { - "name": { - "id": "Administrator", - "path": [] - }, - "descendants": [], "attributes": { "attrs": {} - } + }, + "open_attributes": "ClosedAttributes" } ], [ @@ -92,29 +53,43 @@ "isRequired": true } } - } + }, + "open_attributes": "ClosedAttributes" } ], [ { - "id": "Photo", + "id": "AccountGroup", "path": [] }, { "name": { - "id": "Photo", + "id": "AccountGroup", "path": [] }, - "descendants": [], + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Account", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], "attributes": { "attrs": { - "account": { + "owner": { "attrType": { "EntityOrRecord": { "Entity": { "lub_elements": [ { - "id": "Account", + "id": "User", "path": [] } ] @@ -122,7 +97,34 @@ } }, "isRequired": true - }, + } + } + }, + "open_attributes": "ClosedAttributes" + } + ], + [ + { + "id": "Account", + "path": [] + }, + { + "name": { + "id": "Account", + "path": [] + }, + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Album", + "path": [] + } + ], + "attributes": { + "attrs": { "admins": { "attrType": { "Set": { @@ -142,6 +144,21 @@ }, "isRequired": true }, + "owner": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, "private": { "attrType": { "Primitive": { @@ -151,7 +168,8 @@ "isRequired": true } } - } + }, + "open_attributes": "ClosedAttributes" } ], [ @@ -166,11 +184,11 @@ }, "descendants": [ { - "id": "Album", + "id": "Photo", "path": [] }, { - "id": "Photo", + "id": "Album", "path": [] } ], @@ -219,31 +237,38 @@ "isRequired": true } } - } + }, + "open_attributes": "ClosedAttributes" } ], [ { - "id": "Account", + "id": "Photo", "path": [] }, { "name": { - "id": "Account", + "id": "Photo", "path": [] }, - "descendants": [ - { - "id": "Album", - "path": [] - }, - { - "id": "Photo", - "path": [] - } - ], + "descendants": [], "attributes": { "attrs": { + "account": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "Account", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, "admins": { "attrType": { "Set": { @@ -263,21 +288,6 @@ }, "isRequired": true }, - "owner": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, "private": { "attrType": { "Primitive": { @@ -287,28 +297,25 @@ "isRequired": true } } - } + }, + "open_attributes": "ClosedAttributes" } ], [ { - "id": "UserGroup", + "id": "Administrator", "path": [] }, { "name": { - "id": "UserGroup", + "id": "Administrator", "path": [] }, - "descendants": [ - { - "id": "User", - "path": [] - } - ], + "descendants": [], "attributes": { "attrs": {} - } + }, + "open_attributes": "ClosedAttributes" } ] ], @@ -321,7 +328,7 @@ "path": [] } }, - "eid": "comment" + "eid": "view" }, { "name": { @@ -331,7 +338,7 @@ "path": [] } }, - "eid": "comment" + "eid": "view" }, "appliesTo": { "principalApplySpec": [ @@ -353,14 +360,21 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } } }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -378,7 +392,7 @@ "path": [] } }, - "eid": "edit" + "eid": "listAlbums" }, { "name": { @@ -388,7 +402,7 @@ "path": [] } }, - "eid": "edit" + "eid": "listAlbums" }, "appliesTo": { "principalApplySpec": [ @@ -402,7 +416,7 @@ "resourceApplySpec": [ { "Specified": { - "id": "Photo", + "id": "Account", "path": [] } } @@ -410,14 +424,21 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } } }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -435,7 +456,7 @@ "path": [] } }, - "eid": "delete" + "eid": "addPhoto" }, { "name": { @@ -445,7 +466,7 @@ "path": [] } }, - "eid": "delete" + "eid": "addPhoto" }, "appliesTo": { "principalApplySpec": [ @@ -459,7 +480,7 @@ "resourceApplySpec": [ { "Specified": { - "id": "Photo", + "id": "Album", "path": [] } } @@ -467,14 +488,51 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "photo": { + "attrType": { + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "filesize_mb": { + "attrType": { + "Primitive": { + "primitiveType": "Long" + } + }, + "isRequired": true + }, + "filetype": { + "attrType": { + "Primitive": { + "primitiveType": "String" + } + }, + "isRequired": true + } + } + }, + "open_attributes": "ClosedAttributes" + } + } + }, + "isRequired": true + } } }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -492,7 +550,7 @@ "path": [] } }, - "eid": "addPhoto" + "eid": "listPhotos" }, { "name": { @@ -502,7 +560,7 @@ "path": [] } }, - "eid": "addPhoto" + "eid": "listPhotos" }, "appliesTo": { "principalApplySpec": [ @@ -524,44 +582,21 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "photo": { - "attrType": { - "EntityOrRecord": { - "Record": { - "attrs": { - "attrs": { - "filesize_mb": { - "attrType": { - "Primitive": { - "primitiveType": "Long" - } - }, - "isRequired": true - }, - "filetype": { - "attrType": { - "Primitive": { - "primitiveType": "String" - } - }, - "isRequired": true - } + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" } }, - "open_attributes": "ClosedAttributes" + "isRequired": true } } }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -579,7 +614,7 @@ "path": [] } }, - "eid": "listPhotos" + "eid": "edit" }, { "name": { @@ -589,7 +624,7 @@ "path": [] } }, - "eid": "listPhotos" + "eid": "edit" }, "appliesTo": { "principalApplySpec": [ @@ -603,7 +638,7 @@ "resourceApplySpec": [ { "Specified": { - "id": "Album", + "id": "Photo", "path": [] } } @@ -611,14 +646,21 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } } }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -636,7 +678,7 @@ "path": [] } }, - "eid": "listAlbums" + "eid": "delete" }, { "name": { @@ -646,7 +688,7 @@ "path": [] } }, - "eid": "listAlbums" + "eid": "delete" }, "appliesTo": { "principalApplySpec": [ @@ -660,7 +702,7 @@ "resourceApplySpec": [ { "Specified": { - "id": "Account", + "id": "Photo", "path": [] } } @@ -668,14 +710,21 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } } }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -693,7 +742,7 @@ "path": [] } }, - "eid": "view" + "eid": "comment" }, { "name": { @@ -703,7 +752,7 @@ "path": [] } }, - "eid": "view" + "eid": "comment" }, "appliesTo": { "principalApplySpec": [ @@ -725,14 +774,21 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } } }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, diff --git a/cedar-lean/Cli/json-inputs/validate/ip1.json b/cedar-lean/Cli/json-inputs/validate/ip1.json deleted file mode 100644 index f4f2b06c0..000000000 --- a/cedar-lean/Cli/json-inputs/validate/ip1.json +++ /dev/null @@ -1,841 +0,0 @@ -{ - "schema": { - "entityTypes": [ - [ - { - "id": "Album", - "path": [] - }, - { - "name": { - "id": "Album", - "path": [] - }, - "descendants": [ - { - "id": "Album", - "path": [] - }, - { - "id": "Video", - "path": [] - }, - { - "id": "Photo", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "User", - "path": [] - }, - { - "name": { - "id": "User", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Administrator", - "path": [] - }, - { - "name": { - "id": "Administrator", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "UserGroup", - "path": [] - }, - { - "name": { - "id": "UserGroup", - "path": [] - }, - "descendants": [ - { - "id": "User", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Video", - "path": [] - }, - { - "name": { - "id": "Video", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Photo", - "path": [] - }, - { - "name": { - "id": "Photo", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "AccountGroup", - "path": [] - }, - { - "name": { - "id": "AccountGroup", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Account", - "path": [] - }, - { - "name": { - "id": "Account", - "path": [] - }, - "descendants": [ - { - "id": "Photo", - "path": [] - }, - { - "id": "Album", - "path": [] - }, - { - "id": "Video", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ] - ], - "actionIds": [ - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Account", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "Administrator", - "path": [] - } - }, - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Video", - "path": [] - } - }, - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ] - ] - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": "Any" - }, - "action_constraint": { - "Eq": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource_constraint": { - "constraint": { - "Eq": { - "EUID": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "BinaryApp": { - "op": "Eq", - "arg1": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "context" - }, - "source_info": { - "start": 102, - "end": 109 - }, - "data": null - }, - "attr": "source_ip" - } - }, - "source_info": { - "start": 102, - "end": 119 - }, - "data": null - }, - "arg2": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "ip", - "path": [] - }, - "args": [ - { - "expr_kind": { - "Lit": { - "String": "222.222.222.222" - } - }, - "source_info": { - "start": 126, - "end": 143 - }, - "data": null - } - ] - } - }, - "source_info": { - "start": 123, - "end": 144 - }, - "data": null - } - } - }, - "source_info": { - "start": 102, - "end": 144 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "mode": "Strict" -} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/validate/ip2.json b/cedar-lean/Cli/json-inputs/validate/ip2.json deleted file mode 100644 index df51e7cd2..000000000 --- a/cedar-lean/Cli/json-inputs/validate/ip2.json +++ /dev/null @@ -1,891 +0,0 @@ -{ - "schema": { - "entityTypes": [ - [ - { - "id": "Photo", - "path": [] - }, - { - "name": { - "id": "Photo", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Administrator", - "path": [] - }, - { - "name": { - "id": "Administrator", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Account", - "path": [] - }, - { - "name": { - "id": "Account", - "path": [] - }, - "descendants": [ - { - "id": "Album", - "path": [] - }, - { - "id": "Video", - "path": [] - }, - { - "id": "Photo", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "AccountGroup", - "path": [] - }, - { - "name": { - "id": "AccountGroup", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Album", - "path": [] - }, - { - "name": { - "id": "Album", - "path": [] - }, - "descendants": [ - { - "id": "Photo", - "path": [] - }, - { - "id": "Video", - "path": [] - }, - { - "id": "Album", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "User", - "path": [] - }, - { - "name": { - "id": "User", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "UserGroup", - "path": [] - }, - { - "name": { - "id": "UserGroup", - "path": [] - }, - "descendants": [ - { - "id": "User", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Video", - "path": [] - }, - { - "name": { - "id": "Video", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ] - ], - "actionIds": [ - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - }, - { - "Specified": { - "id": "Administrator", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - }, - { - "Specified": { - "id": "Video", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Account", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ] - ] - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": "Any" - }, - "action_constraint": { - "Eq": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource_constraint": { - "constraint": { - "Eq": { - "EUID": { - "ty": { - "Specified": { - "id": "Photo", - "path": [] - } - }, - "eid": "VacationPhoto94.jpg" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "And": { - "left": { - "expr_kind": { - "UnaryApp": { - "op": "Not", - "arg": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "isLoopback", - "path": [] - }, - "args": [ - { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "context" - }, - "source_info": { - "start": 104, - "end": 111 - }, - "data": null - }, - "attr": "source_ip" - } - }, - "source_info": { - "start": 104, - "end": 134 - }, - "data": null - } - ] - } - }, - "source_info": { - "start": 104, - "end": 134 - }, - "data": null - } - } - }, - "source_info": { - "start": 102, - "end": 135 - }, - "data": null - }, - "right": { - "expr_kind": { - "UnaryApp": { - "op": "Not", - "arg": { - "expr_kind": { - "ExtensionFunctionApp": { - "fn_name": { - "id": "isMulticast", - "path": [] - }, - "args": [ - { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "context" - }, - "source_info": { - "start": 141, - "end": 148 - }, - "data": null - }, - "attr": "source_ip" - } - }, - "source_info": { - "start": 141, - "end": 172 - }, - "data": null - } - ] - } - }, - "source_info": { - "start": 141, - "end": 172 - }, - "data": null - } - } - }, - "source_info": { - "start": 139, - "end": 173 - }, - "data": null - } - } - }, - "source_info": { - "start": 102, - "end": 173 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - } - } - }, - "mode": "Strict" -} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/validate/ip3.json b/cedar-lean/Cli/json-inputs/validate/ip3.json index 56cbf856a..3d11ddd1b 100644 --- a/cedar-lean/Cli/json-inputs/validate/ip3.json +++ b/cedar-lean/Cli/json-inputs/validate/ip3.json @@ -3,161 +3,169 @@ "entityTypes": [ [ { - "id": "Video", + "id": "Administrator", "path": [] }, { "name": { - "id": "Video", + "id": "Administrator", "path": [] }, "descendants": [], "attributes": { "attrs": {} - } + }, + "open_attributes": "ClosedAttributes" } ], [ { - "id": "Administrator", + "id": "AccountGroup", "path": [] }, { "name": { - "id": "Administrator", + "id": "AccountGroup", "path": [] }, "descendants": [], "attributes": { "attrs": {} - } + }, + "open_attributes": "ClosedAttributes" } ], [ { - "id": "Photo", + "id": "Account", "path": [] }, { "name": { - "id": "Photo", + "id": "Account", "path": [] }, - "descendants": [], + "descendants": [ + { + "id": "Video", + "path": [] + }, + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], "attributes": { "attrs": {} - } + }, + "open_attributes": "ClosedAttributes" } ], [ { - "id": "User", + "id": "Video", "path": [] }, { "name": { - "id": "User", + "id": "Video", "path": [] }, "descendants": [], "attributes": { "attrs": {} - } + }, + "open_attributes": "ClosedAttributes" } ], [ { - "id": "Album", + "id": "Photo", "path": [] }, { "name": { - "id": "Album", + "id": "Photo", "path": [] }, - "descendants": [ - { - "id": "Video", - "path": [] - }, - { - "id": "Photo", - "path": [] - }, - { - "id": "Album", - "path": [] - } - ], + "descendants": [], "attributes": { "attrs": {} - } + }, + "open_attributes": "ClosedAttributes" } ], [ { - "id": "Account", + "id": "UserGroup", "path": [] }, { "name": { - "id": "Account", + "id": "UserGroup", "path": [] }, "descendants": [ { - "id": "Video", - "path": [] - }, - { - "id": "Photo", - "path": [] - }, - { - "id": "Album", + "id": "User", "path": [] } ], "attributes": { "attrs": {} - } + }, + "open_attributes": "ClosedAttributes" } ], [ { - "id": "UserGroup", + "id": "User", "path": [] }, { "name": { - "id": "UserGroup", + "id": "User", "path": [] }, - "descendants": [ - { - "id": "User", - "path": [] - } - ], + "descendants": [], "attributes": { "attrs": {} - } + }, + "open_attributes": "ClosedAttributes" } ], [ { - "id": "AccountGroup", + "id": "Album", "path": [] }, { "name": { - "id": "AccountGroup", + "id": "Album", "path": [] }, - "descendants": [], + "descendants": [ + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + }, + { + "id": "Video", + "path": [] + } + ], "attributes": { "attrs": {} - } + }, + "open_attributes": "ClosedAttributes" } ] ], @@ -170,7 +178,7 @@ "path": [] } }, - "eid": "listPhotos" + "eid": "view" }, { "name": { @@ -180,7 +188,7 @@ "path": [] } }, - "eid": "listPhotos" + "eid": "view" }, "appliesTo": { "principalApplySpec": [ @@ -189,12 +197,24 @@ "id": "User", "path": [] } + }, + { + "Specified": { + "id": "Administrator", + "path": [] + } } ], "resourceApplySpec": [ { "Specified": { - "id": "Album", + "id": "Photo", + "path": [] + } + }, + { + "Specified": { + "id": "Video", "path": [] } } @@ -202,36 +222,43 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true } } }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -249,7 +276,7 @@ "path": [] } }, - "eid": "listAlbums" + "eid": "edit" }, { "name": { @@ -259,7 +286,7 @@ "path": [] } }, - "eid": "listAlbums" + "eid": "edit" }, "appliesTo": { "principalApplySpec": [ @@ -273,7 +300,7 @@ "resourceApplySpec": [ { "Specified": { - "id": "Account", + "id": "Photo", "path": [] } } @@ -281,36 +308,43 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true } } }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -328,7 +362,7 @@ "path": [] } }, - "eid": "delete" + "eid": "listPhotos" }, { "name": { @@ -338,7 +372,7 @@ "path": [] } }, - "eid": "delete" + "eid": "listPhotos" }, "appliesTo": { "principalApplySpec": [ @@ -352,7 +386,7 @@ "resourceApplySpec": [ { "Specified": { - "id": "Photo", + "id": "Album", "path": [] } } @@ -360,36 +394,43 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true } } }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -407,7 +448,7 @@ "path": [] } }, - "eid": "edit" + "eid": "addPhoto" }, { "name": { @@ -417,7 +458,7 @@ "path": [] } }, - "eid": "edit" + "eid": "addPhoto" }, "appliesTo": { "principalApplySpec": [ @@ -431,7 +472,7 @@ "resourceApplySpec": [ { "Specified": { - "id": "Photo", + "id": "Album", "path": [] } } @@ -439,36 +480,43 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true } } }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -486,7 +534,7 @@ "path": [] } }, - "eid": "comment" + "eid": "listAlbums" }, { "name": { @@ -496,7 +544,7 @@ "path": [] } }, - "eid": "comment" + "eid": "listAlbums" }, "appliesTo": { "principalApplySpec": [ @@ -510,7 +558,7 @@ "resourceApplySpec": [ { "Specified": { - "id": "Photo", + "id": "Account", "path": [] } } @@ -518,36 +566,43 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true } } }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -565,7 +620,7 @@ "path": [] } }, - "eid": "view" + "eid": "comment" }, { "name": { @@ -575,7 +630,7 @@ "path": [] } }, - "eid": "view" + "eid": "comment" }, "appliesTo": { "principalApplySpec": [ @@ -584,21 +639,9 @@ "id": "User", "path": [] } - }, - { - "Specified": { - "id": "Administrator", - "path": [] - } } ], "resourceApplySpec": [ - { - "Specified": { - "id": "Video", - "path": [] - } - }, { "Specified": { "id": "Photo", @@ -609,36 +652,43 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true } } }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -656,7 +706,7 @@ "path": [] } }, - "eid": "addPhoto" + "eid": "delete" }, { "name": { @@ -666,7 +716,7 @@ "path": [] } }, - "eid": "addPhoto" + "eid": "delete" }, "appliesTo": { "principalApplySpec": [ @@ -680,7 +730,7 @@ "resourceApplySpec": [ { "Specified": { - "id": "Album", + "id": "Photo", "path": [] } } @@ -688,36 +738,43 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true } } }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, diff --git a/cedar-lean/Cli/json-inputs/validate/multi1.json b/cedar-lean/Cli/json-inputs/validate/multi1.json index a6323545d..11b16c6f2 100644 --- a/cedar-lean/Cli/json-inputs/validate/multi1.json +++ b/cedar-lean/Cli/json-inputs/validate/multi1.json @@ -3,100 +3,92 @@ "entityTypes": [ [ { - "id": "UserGroup", + "id": "User", "path": [] }, { "name": { - "id": "UserGroup", + "id": "User", "path": [] }, - "descendants": [ - { - "id": "User", - "path": [] - } - ], + "descendants": [], "attributes": { "attrs": {} - } + }, + "open_attributes": "ClosedAttributes" } ], [ { - "id": "Administrator", + "id": "AccountGroup", "path": [] }, { "name": { - "id": "Administrator", + "id": "AccountGroup", "path": [] }, "descendants": [], "attributes": { "attrs": {} - } + }, + "open_attributes": "ClosedAttributes" } ], [ { - "id": "AccountGroup", + "id": "Video", "path": [] }, { "name": { - "id": "AccountGroup", + "id": "Video", "path": [] }, "descendants": [], "attributes": { "attrs": {} - } + }, + "open_attributes": "ClosedAttributes" } ], [ { - "id": "Album", + "id": "UserGroup", "path": [] }, { "name": { - "id": "Album", + "id": "UserGroup", "path": [] }, "descendants": [ { - "id": "Album", - "path": [] - }, - { - "id": "Video", - "path": [] - }, - { - "id": "Photo", + "id": "User", "path": [] } ], "attributes": { "attrs": {} - } + }, + "open_attributes": "ClosedAttributes" } ], [ { - "id": "User", + "id": "Administrator", "path": [] }, { "name": { - "id": "User", + "id": "Administrator", "path": [] }, "descendants": [], "attributes": { "attrs": {} - } + }, + "open_attributes": "ClosedAttributes" } ], [ @@ -112,7 +104,8 @@ "descendants": [], "attributes": { "attrs": {} - } + }, + "open_attributes": "ClosedAttributes" } ], [ @@ -141,23 +134,38 @@ ], "attributes": { "attrs": {} - } + }, + "open_attributes": "ClosedAttributes" } ], [ { - "id": "Video", + "id": "Album", "path": [] }, { "name": { - "id": "Video", + "id": "Album", "path": [] }, - "descendants": [], + "descendants": [ + { + "id": "Video", + "path": [] + }, + { + "id": "Album", + "path": [] + }, + { + "id": "Photo", + "path": [] + } + ], "attributes": { "attrs": {} - } + }, + "open_attributes": "ClosedAttributes" } ] ], @@ -170,7 +178,7 @@ "path": [] } }, - "eid": "delete" + "eid": "comment" }, { "name": { @@ -180,7 +188,7 @@ "path": [] } }, - "eid": "delete" + "eid": "comment" }, "appliesTo": { "principalApplySpec": [ @@ -202,36 +210,43 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true } } }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -249,7 +264,7 @@ "path": [] } }, - "eid": "edit" + "eid": "listPhotos" }, { "name": { @@ -259,7 +274,7 @@ "path": [] } }, - "eid": "edit" + "eid": "listPhotos" }, "appliesTo": { "principalApplySpec": [ @@ -273,7 +288,7 @@ "resourceApplySpec": [ { "Specified": { - "id": "Photo", + "id": "Album", "path": [] } } @@ -281,36 +296,43 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true } } }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -360,36 +382,43 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true } } }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -407,7 +436,7 @@ "path": [] } }, - "eid": "comment" + "eid": "edit" }, { "name": { @@ -417,7 +446,7 @@ "path": [] } }, - "eid": "comment" + "eid": "edit" }, "appliesTo": { "principalApplySpec": [ @@ -439,36 +468,43 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true } } }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -502,13 +538,13 @@ "principalApplySpec": [ { "Specified": { - "id": "Administrator", + "id": "User", "path": [] } }, { "Specified": { - "id": "User", + "id": "Administrator", "path": [] } } @@ -530,36 +566,43 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true } } }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -577,7 +620,7 @@ "path": [] } }, - "eid": "listPhotos" + "eid": "delete" }, { "name": { @@ -587,7 +630,7 @@ "path": [] } }, - "eid": "listPhotos" + "eid": "delete" }, "appliesTo": { "principalApplySpec": [ @@ -601,7 +644,7 @@ "resourceApplySpec": [ { "Specified": { - "id": "Album", + "id": "Photo", "path": [] } } @@ -609,36 +652,43 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true } } }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -688,36 +738,43 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "confidence_score": { + "attrType": { + "ExtensionType": { + "name": { + "id": "decimal", + "path": [] + } + } + }, + "isRequired": true + }, + "source_ip": { + "attrType": { + "ExtensionType": { + "name": { + "id": "ipaddr", + "path": [] + } + } + }, + "isRequired": true } } }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -860,13 +917,13 @@ } }, "links": { - "policy1": { - "template_id": "policy1", + "policy0": { + "template_id": "policy0", "link_id": null, "values": {} }, - "policy0": { - "template_id": "policy0", + "policy1": { + "template_id": "policy1", "link_id": null, "values": {} } diff --git a/cedar-lean/Cli/json-inputs/validate/multi2.json b/cedar-lean/Cli/json-inputs/validate/multi2.json deleted file mode 100644 index 06b040763..000000000 --- a/cedar-lean/Cli/json-inputs/validate/multi2.json +++ /dev/null @@ -1,853 +0,0 @@ -{ - "schema": { - "entityTypes": [ - [ - { - "id": "Video", - "path": [] - }, - { - "name": { - "id": "Video", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "UserGroup", - "path": [] - }, - { - "name": { - "id": "UserGroup", - "path": [] - }, - "descendants": [ - { - "id": "User", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Administrator", - "path": [] - }, - { - "name": { - "id": "Administrator", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Album", - "path": [] - }, - { - "name": { - "id": "Album", - "path": [] - }, - "descendants": [ - { - "id": "Photo", - "path": [] - }, - { - "id": "Video", - "path": [] - }, - { - "id": "Album", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Photo", - "path": [] - }, - { - "name": { - "id": "Photo", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "User", - "path": [] - }, - { - "name": { - "id": "User", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "AccountGroup", - "path": [] - }, - { - "name": { - "id": "AccountGroup", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Account", - "path": [] - }, - { - "name": { - "id": "Account", - "path": [] - }, - "descendants": [ - { - "id": "Photo", - "path": [] - }, - { - "id": "Album", - "path": [] - }, - { - "id": "Video", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ] - ], - "actionIds": [ - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Account", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "Administrator", - "path": [] - } - }, - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Video", - "path": [] - } - }, - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ] - ] - }, - "policies": { - "templates": { - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": "Any" - }, - "action_constraint": { - "Eq": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource_constraint": { - "constraint": { - "In": { - "EUID": { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": { - "start": 121, - "end": 210 - }, - "data": null - } - }, - "policy1": { - "id": "policy1", - "annotations": {}, - "effect": "forbid", - "principal_constraint": { - "constraint": { - "Eq": { - "EUID": { - "ty": { - "Specified": { - "id": "User", - "path": [] - } - }, - "eid": "bob" - } - } - } - }, - "action_constraint": { - "Eq": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource_constraint": { - "constraint": { - "In": { - "EUID": { - "ty": { - "Specified": { - "id": "Album", - "path": [] - } - }, - "eid": "jane_vacation" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": { - "start": 226, - "end": 330 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - }, - "policy1": { - "template_id": "policy1", - "link_id": null, - "values": {} - } - } - }, - "mode": "Strict" -} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/validate/multi3.json b/cedar-lean/Cli/json-inputs/validate/multi3.json deleted file mode 100644 index 3d27a3b68..000000000 --- a/cedar-lean/Cli/json-inputs/validate/multi3.json +++ /dev/null @@ -1,990 +0,0 @@ -{ - "schema": { - "entityTypes": [ - [ - { - "id": "UserGroup", - "path": [] - }, - { - "name": { - "id": "UserGroup", - "path": [] - }, - "descendants": [ - { - "id": "User", - "path": [] - } - ], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Album", - "path": [] - }, - { - "name": { - "id": "Album", - "path": [] - }, - "descendants": [ - { - "id": "Album", - "path": [] - }, - { - "id": "Photo", - "path": [] - } - ], - "attributes": { - "attrs": { - "account": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "Account", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "User", - "path": [] - }, - { - "name": { - "id": "User", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": { - "department": { - "attrType": { - "Primitive": { - "primitiveType": "String" - } - }, - "isRequired": true - }, - "jobLevel": { - "attrType": { - "Primitive": { - "primitiveType": "Long" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "Account", - "path": [] - }, - { - "name": { - "id": "Account", - "path": [] - }, - "descendants": [ - { - "id": "Album", - "path": [] - }, - { - "id": "Photo", - "path": [] - } - ], - "attributes": { - "attrs": { - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "owner": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "Administrator", - "path": [] - }, - { - "name": { - "id": "Administrator", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": {} - } - } - ], - [ - { - "id": "Photo", - "path": [] - }, - { - "name": { - "id": "Photo", - "path": [] - }, - "descendants": [], - "attributes": { - "attrs": { - "account": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "Account", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, - "admins": { - "attrType": { - "Set": { - "elementType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - } - } - }, - "isRequired": true - }, - "private": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - } - } - ], - [ - { - "id": "AccountGroup", - "path": [] - }, - { - "name": { - "id": "AccountGroup", - "path": [] - }, - "descendants": [ - { - "id": "Album", - "path": [] - }, - { - "id": "Account", - "path": [] - }, - { - "id": "Photo", - "path": [] - } - ], - "attributes": { - "attrs": { - "owner": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - }, - "isRequired": true - } - } - } - } - ] - ], - "actionIds": [ - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "confidence_score": { - "attrType": { - "ExtensionType": { - "name": { - "id": "decimal", - "path": [] - } - } - }, - "isRequired": true - }, - "source_ip": { - "attrType": { - "ExtensionType": { - "name": { - "id": "ipaddr", - "path": [] - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "delete" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "comment" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listAlbums" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Account", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "listPhotos" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "addPhoto" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Album", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "photo": { - "attrType": { - "EntityOrRecord": { - "Record": { - "attrs": { - "attrs": { - "filesize_mb": { - "attrType": { - "Primitive": { - "primitiveType": "Long" - } - }, - "isRequired": true - }, - "filetype": { - "attrType": { - "Primitive": { - "primitiveType": "String" - } - }, - "isRequired": true - } - } - }, - "open_attributes": "ClosedAttributes" - } - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ], - [ - { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - { - "name": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "edit" - }, - "appliesTo": { - "principalApplySpec": [ - { - "Specified": { - "id": "User", - "path": [] - } - } - ], - "resourceApplySpec": [ - { - "Specified": { - "id": "Photo", - "path": [] - } - } - ] - }, - "descendants": [], - "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - } - } - }, - "attribute_types": { - "attrs": {} - }, - "attributes": {} - } - ] - ] - }, - "policies": { - "templates": { - "policy1": { - "id": "policy1", - "annotations": {}, - "effect": "forbid", - "principal_constraint": { - "constraint": "Any" - }, - "action_constraint": "Any", - "resource_constraint": { - "constraint": "Any" - }, - "non_head_constraints": { - "expr_kind": { - "And": { - "left": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "resource" - }, - "source_info": { - "start": 398, - "end": 406 - }, - "data": null - }, - "attr": "private" - } - }, - "source_info": { - "start": 398, - "end": 414 - }, - "data": null - }, - "right": { - "expr_kind": { - "UnaryApp": { - "op": "Not", - "arg": { - "expr_kind": { - "And": { - "left": { - "expr_kind": { - "HasAttr": { - "expr": { - "expr_kind": { - "Var": "resource" - }, - "source_info": { - "start": 426, - "end": 434 - }, - "data": null - }, - "attr": "account" - } - }, - "source_info": { - "start": 426, - "end": 446 - }, - "data": null - }, - "right": { - "expr_kind": { - "BinaryApp": { - "op": "Eq", - "arg1": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "resource" - }, - "source_info": { - "start": 450, - "end": 458 - }, - "data": null - }, - "attr": "account" - } - }, - "source_info": { - "start": 450, - "end": 472 - }, - "data": null - }, - "attr": "owner" - } - }, - "source_info": { - "start": 450, - "end": 472 - }, - "data": null - }, - "arg2": { - "expr_kind": { - "Var": "principal" - }, - "source_info": { - "start": 476, - "end": 485 - }, - "data": null - } - } - }, - "source_info": { - "start": 450, - "end": 485 - }, - "data": null - } - } - }, - "source_info": { - "start": 426, - "end": 485 - }, - "data": null - } - } - }, - "source_info": { - "start": 417, - "end": 487 - }, - "data": null - } - } - }, - "source_info": { - "start": 354, - "end": 488 - }, - "data": null - } - }, - "policy0": { - "id": "policy0", - "annotations": {}, - "effect": "permit", - "principal_constraint": { - "constraint": { - "In": { - "EUID": { - "ty": { - "Specified": { - "id": "UserGroup", - "path": [] - } - }, - "eid": "alice_friends" - } - } - } - }, - "action_constraint": { - "Eq": { - "ty": { - "Specified": { - "id": "Action", - "path": [] - } - }, - "eid": "view" - } - }, - "resource_constraint": { - "constraint": { - "In": { - "EUID": { - "ty": { - "Specified": { - "id": "Account", - "path": [] - } - }, - "eid": "alice" - } - } - } - }, - "non_head_constraints": { - "expr_kind": { - "Lit": { - "Bool": true - } - }, - "source_info": { - "start": 145, - "end": 258 - }, - "data": null - } - } - }, - "links": { - "policy0": { - "template_id": "policy0", - "link_id": null, - "values": {} - }, - "policy1": { - "template_id": "policy1", - "link_id": null, - "values": {} - } - } - }, - "mode": "Strict" -} \ No newline at end of file diff --git a/cedar-lean/Cli/json-inputs/validate/multi4.json b/cedar-lean/Cli/json-inputs/validate/multi4.json index 62cafffd9..45488ab5f 100644 --- a/cedar-lean/Cli/json-inputs/validate/multi4.json +++ b/cedar-lean/Cli/json-inputs/validate/multi4.json @@ -3,26 +3,58 @@ "entityTypes": [ [ { - "id": "Account", + "id": "Administrator", "path": [] }, { "name": { - "id": "Account", + "id": "Administrator", + "path": [] + }, + "descendants": [], + "attributes": { + "attrs": {} + }, + "open_attributes": "ClosedAttributes" + } + ], + [ + { + "id": "Album", + "path": [] + }, + { + "name": { + "id": "Album", "path": [] }, "descendants": [ { - "id": "Photo", + "id": "Album", "path": [] }, { - "id": "Album", + "id": "Photo", "path": [] } ], "attributes": { "attrs": { + "account": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "Account", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, "admins": { "attrType": { "Set": { @@ -42,21 +74,6 @@ }, "isRequired": true }, - "owner": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "User", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, "private": { "attrType": { "Primitive": { @@ -66,7 +83,8 @@ "isRequired": true } } - } + }, + "open_attributes": "ClosedAttributes" } ], [ @@ -81,15 +99,15 @@ }, "descendants": [ { - "id": "Photo", + "id": "Album", "path": [] }, { - "id": "Account", + "id": "Photo", "path": [] }, { - "id": "Album", + "id": "Account", "path": [] } ], @@ -111,37 +129,32 @@ "isRequired": true } } - } + }, + "open_attributes": "ClosedAttributes" } ], [ { - "id": "Photo", + "id": "Account", "path": [] }, { "name": { - "id": "Photo", + "id": "Account", "path": [] }, - "descendants": [], + "descendants": [ + { + "id": "Photo", + "path": [] + }, + { + "id": "Album", + "path": [] + } + ], "attributes": { "attrs": { - "account": { - "attrType": { - "EntityOrRecord": { - "Entity": { - "lub_elements": [ - { - "id": "Account", - "path": [] - } - ] - } - } - }, - "isRequired": true - }, "admins": { "attrType": { "Set": { @@ -161,6 +174,21 @@ }, "isRequired": true }, + "owner": { + "attrType": { + "EntityOrRecord": { + "Entity": { + "lub_elements": [ + { + "id": "User", + "path": [] + } + ] + } + } + }, + "isRequired": true + }, "private": { "attrType": { "Primitive": { @@ -170,28 +198,8 @@ "isRequired": true } } - } - } - ], - [ - { - "id": "UserGroup", - "path": [] - }, - { - "name": { - "id": "UserGroup", - "path": [] }, - "descendants": [ - { - "id": "User", - "path": [] - } - ], - "attributes": { - "attrs": {} - } + "open_attributes": "ClosedAttributes" } ], [ @@ -224,45 +232,43 @@ "isRequired": true } } - } + }, + "open_attributes": "ClosedAttributes" } ], [ { - "id": "Administrator", + "id": "UserGroup", "path": [] }, { "name": { - "id": "Administrator", + "id": "UserGroup", "path": [] }, - "descendants": [], + "descendants": [ + { + "id": "User", + "path": [] + } + ], "attributes": { "attrs": {} - } + }, + "open_attributes": "ClosedAttributes" } ], [ { - "id": "Album", + "id": "Photo", "path": [] }, { "name": { - "id": "Album", + "id": "Photo", "path": [] }, - "descendants": [ - { - "id": "Album", - "path": [] - }, - { - "id": "Photo", - "path": [] - } - ], + "descendants": [], "attributes": { "attrs": { "account": { @@ -308,7 +314,8 @@ "isRequired": true } } - } + }, + "open_attributes": "ClosedAttributes" } ] ], @@ -321,7 +328,7 @@ "path": [] } }, - "eid": "delete" + "eid": "listPhotos" }, { "name": { @@ -331,7 +338,7 @@ "path": [] } }, - "eid": "delete" + "eid": "listPhotos" }, "appliesTo": { "principalApplySpec": [ @@ -345,7 +352,7 @@ "resourceApplySpec": [ { "Specified": { - "id": "Photo", + "id": "Album", "path": [] } } @@ -353,14 +360,21 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } } }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -378,7 +392,7 @@ "path": [] } }, - "eid": "listPhotos" + "eid": "edit" }, { "name": { @@ -388,7 +402,7 @@ "path": [] } }, - "eid": "listPhotos" + "eid": "edit" }, "appliesTo": { "principalApplySpec": [ @@ -402,7 +416,7 @@ "resourceApplySpec": [ { "Specified": { - "id": "Album", + "id": "Photo", "path": [] } } @@ -410,14 +424,21 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } } }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -467,14 +488,21 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } } }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -492,7 +520,7 @@ "path": [] } }, - "eid": "edit" + "eid": "comment" }, { "name": { @@ -502,7 +530,7 @@ "path": [] } }, - "eid": "edit" + "eid": "comment" }, "appliesTo": { "principalApplySpec": [ @@ -524,14 +552,21 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } } }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -549,7 +584,7 @@ "path": [] } }, - "eid": "addPhoto" + "eid": "delete" }, { "name": { @@ -559,7 +594,7 @@ "path": [] } }, - "eid": "addPhoto" + "eid": "delete" }, "appliesTo": { "principalApplySpec": [ @@ -573,7 +608,7 @@ "resourceApplySpec": [ { "Specified": { - "id": "Album", + "id": "Photo", "path": [] } } @@ -581,44 +616,21 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" - } - }, - "isRequired": true - }, - "photo": { - "attrType": { - "EntityOrRecord": { - "Record": { - "attrs": { - "attrs": { - "filesize_mb": { - "attrType": { - "Primitive": { - "primitiveType": "Long" - } - }, - "isRequired": true - }, - "filetype": { - "attrType": { - "Primitive": { - "primitiveType": "String" - } - }, - "isRequired": true - } + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" } }, - "open_attributes": "ClosedAttributes" + "isRequired": true } } }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -668,14 +680,21 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + } } }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -693,7 +712,7 @@ "path": [] } }, - "eid": "comment" + "eid": "addPhoto" }, { "name": { @@ -703,7 +722,7 @@ "path": [] } }, - "eid": "comment" + "eid": "addPhoto" }, "appliesTo": { "principalApplySpec": [ @@ -717,7 +736,7 @@ "resourceApplySpec": [ { "Specified": { - "id": "Photo", + "id": "Album", "path": [] } } @@ -725,14 +744,51 @@ }, "descendants": [], "context": { - "attrs": { - "authenticated": { - "attrType": { - "Primitive": { - "primitiveType": "Bool" + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "authenticated": { + "attrType": { + "Primitive": { + "primitiveType": "Bool" + } + }, + "isRequired": true + }, + "photo": { + "attrType": { + "EntityOrRecord": { + "Record": { + "attrs": { + "attrs": { + "filesize_mb": { + "attrType": { + "Primitive": { + "primitiveType": "Long" + } + }, + "isRequired": true + }, + "filetype": { + "attrType": { + "Primitive": { + "primitiveType": "String" + } + }, + "isRequired": true + } + } + }, + "open_attributes": "ClosedAttributes" + } + } + }, + "isRequired": true + } } }, - "isRequired": true + "open_attributes": "ClosedAttributes" } } }, @@ -804,52 +860,6 @@ "data": null } }, - "policy3": { - "id": "policy3", - "annotations": {}, - "effect": "forbid", - "principal_constraint": { - "constraint": "Any" - }, - "action_constraint": "Any", - "resource_constraint": { - "constraint": "Any" - }, - "non_head_constraints": { - "expr_kind": { - "UnaryApp": { - "op": "Not", - "arg": { - "expr_kind": { - "GetAttr": { - "expr": { - "expr_kind": { - "Var": "context" - }, - "source_info": { - "start": 751, - "end": 758 - }, - "data": null - }, - "attr": "authenticated" - } - }, - "source_info": { - "start": 751, - "end": 772 - }, - "data": null - } - } - }, - "source_info": { - "start": 750, - "end": 772 - }, - "data": null - } - }, "policy2": { "id": "policy2", "annotations": {}, @@ -996,6 +1006,52 @@ "data": null } }, + "policy3": { + "id": "policy3", + "annotations": {}, + "effect": "forbid", + "principal_constraint": { + "constraint": "Any" + }, + "action_constraint": "Any", + "resource_constraint": { + "constraint": "Any" + }, + "non_head_constraints": { + "expr_kind": { + "UnaryApp": { + "op": "Not", + "arg": { + "expr_kind": { + "GetAttr": { + "expr": { + "expr_kind": { + "Var": "context" + }, + "source_info": { + "start": 751, + "end": 758 + }, + "data": null + }, + "attr": "authenticated" + } + }, + "source_info": { + "start": 751, + "end": 772 + }, + "data": null + } + } + }, + "source_info": { + "start": 750, + "end": 772 + }, + "data": null + } + }, "policy1": { "id": "policy1", "annotations": {}, @@ -1068,18 +1124,13 @@ } }, "links": { - "policy1": { - "template_id": "policy1", - "link_id": null, - "values": {} - }, "policy3": { "template_id": "policy3", "link_id": null, "values": {} }, - "policy2": { - "template_id": "policy2", + "policy1": { + "template_id": "policy1", "link_id": null, "values": {} }, @@ -1087,6 +1138,11 @@ "template_id": "policy0", "link_id": null, "values": {} + }, + "policy2": { + "template_id": "policy2", + "link_id": null, + "values": {} } } }, diff --git a/cedar-lean/DiffTest.lean b/cedar-lean/DiffTest.lean deleted file mode 100644 index fd3499c17..000000000 --- a/cedar-lean/DiffTest.lean +++ /dev/null @@ -1,19 +0,0 @@ -/- - Copyright 2022-2023 Amazon.com, Inc. or its affiliates. All Rights Reserved. - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - https://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. --/ - -import DiffTest.Main -import DiffTest.Parser -import DiffTest.Util diff --git a/cedar-lean/DiffTest/Parser.lean b/cedar-lean/DiffTest/Parser.lean index 82d8ca863..d93ac7d96 100644 --- a/cedar-lean/DiffTest/Parser.lean +++ b/cedar-lean/DiffTest/Parser.lean @@ -434,12 +434,14 @@ partial def jsonToSchemaActionEntry (json : Lean.Json) : JsonSchemaActionEntry : let appliesToPrincipal := jsonToArray (getJsonField appliesTo "principalApplySpec") let appliesToResource := jsonToArray (getJsonField appliesTo "resourceApplySpec") let descendants := jsonToArray (getJsonField json "descendants") - let context := getJsonField (getJsonField json "context") "attrs" + let context := match jsonToCedarType (getJsonField json "context") with + | .record rty => rty + | _ => panic! "jsonToSchemaActionEntry: context should be record-typed" { appliesToPrincipal := Set.mk (List.map jsonToEntityType appliesToPrincipal.toList), appliesToResource := Set.mk (List.map jsonToEntityType appliesToResource.toList), descendants := Set.mk (List.map jsonToEuid descendants.toList), - context := jsonToRecordType context + context := context } partial def jsonToSchema (json : Lean.Json) : Schema := diff --git a/cedar-lean/README.md b/cedar-lean/README.md index 540994f31..b7607d7be 100644 --- a/cedar-lean/README.md +++ b/cedar-lean/README.md @@ -6,28 +6,30 @@ This folder contains the Lean formalization of, and proofs about, Cedar. Follow [these instructions](https://leanprover.github.io/lean4/doc/setup.html) to set up Lean and install the VS Code plugin. - ## Usage To use VS Code, open the `cedar-lean` folder as the root directory. To build code and proofs from the command line: -``` -$ cd cedar-lean -$ lake build Cedar + +```shell +cd cedar-lean +lake build Cedar ``` The the first build may take a while because it builds the `mathlib4` library that Cedar depends on. Subsequent builds will be fast. To run the unit tests: -``` -$ lake exe CedarUnitTests + +```shell +lake exe CedarUnitTests ``` -To run on integration test JSON files: +To run the CLI, use `lake exe Cli`. We provide some example inputs in `Cli/json-inputs`. The authorization examples should all return "allow" and the validation examples should return "ok". + ```shell -lake exe Cli authorize Cli/json-inputs/authorize/example1a.json -lake exe Cli validate Cli/json-inputs/validate/example1a.json +lake exe Cli authorize Cli/json-inputs/authorize/example2a.json +lake exe Cli validate Cli/json-inputs/validate/example2a.json ``` ## Updating the Lean toolchain @@ -36,18 +38,10 @@ Cedar depends on [`mathlib4`](https://github.com/leanprover-community/mathlib4), Follow [these instructions](https://github.com/leanprover-community/mathlib4/wiki/Using-mathlib4-as-a-dependency#updating-mathlib4) to update to the latest version of `mathlib4` and Lean: -``` -$ curl https://raw.githubusercontent.com/leanprover-community/mathlib4/master/lean-toolchain -o lean-toolchain -$ lake update -$ lake exe cache get -``` - -## Linking with Rust - -To link with Rust, compile as static libraries: - ```shell -lake build DiffTest:static Std:static Aesop:static ProofWidgets:static Qq:static Mathlib:static Cedar:static +curl https://raw.githubusercontent.com/leanprover-community/mathlib4/master/lean-toolchain -o lean-toolchain +lake update +lake exe cache get ``` ## Contributing @@ -78,4 +72,3 @@ Basic theorems ([`Cedar/Thm/Basic.lean`](Cedar/Thm/Basic.lean)) Sound policy slicing ([`Cedar/Thm/Slicing.lean`](Cedar/Thm/Slicing.lean)) * Given a _sound policy slice_, the result of authorization is the same with the slice as it is with the full policy store. - diff --git a/cedar-lean/lakefile.lean b/cedar-lean/lakefile.lean index dddcb0eaf..b5be1f529 100644 --- a/cedar-lean/lakefile.lean +++ b/cedar-lean/lakefile.lean @@ -25,10 +25,10 @@ package Cedar lean_lib Cedar where defaultFacets := #[LeanLib.staticFacet] -lean_lib UnitTest where +lean_lib DiffTest where defaultFacets := #[LeanLib.staticFacet] -lean_lib DiffTest where +lean_lib UnitTest where defaultFacets := #[LeanLib.staticFacet] lean_exe CedarUnitTests where From d41cd8588cef498fb27afc4e424a04b50f5521a1 Mon Sep 17 00:00:00 2001 From: Kesha Hietala Date: Tue, 5 Dec 2023 14:21:45 +0000 Subject: [PATCH 38/57] forgot to add DiffTest file --- cedar-lean/DiffTest.lean | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100644 cedar-lean/DiffTest.lean diff --git a/cedar-lean/DiffTest.lean b/cedar-lean/DiffTest.lean new file mode 100644 index 000000000..822d23556 --- /dev/null +++ b/cedar-lean/DiffTest.lean @@ -0,0 +1,17 @@ +/- + Copyright 2022-2023 Amazon.com, Inc. or its affiliates. All Rights Reserved. + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + https://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +-/ + +import DiffTest.Main \ No newline at end of file From 0520792a80c09c2a83f781c20b7df6c6a2d633d7 Mon Sep 17 00:00:00 2001 From: Kesha Hietala Date: Tue, 5 Dec 2023 18:24:10 +0000 Subject: [PATCH 39/57] wip --- cedar-drt/Makefile | 3 ++- cedar-drt/set_env_vars.sh | 4 +--- cedar-drt/src/dafny_java_impl.rs | 17 +---------------- cedar-drt/src/lean_impl.rs | 11 +++-------- 4 files changed, 7 insertions(+), 28 deletions(-) diff --git a/cedar-drt/Makefile b/cedar-drt/Makefile index f8cb8bf20..b10515bd8 100644 --- a/cedar-drt/Makefile +++ b/cedar-drt/Makefile @@ -10,4 +10,5 @@ test: all DYLD_LIBRARY_PATH=`lean --print-libdir`:${DYLD_LIBRARY_PATH} \ LD_LIBRARY_PATH=`lean --print-libdir`:`lean --print-prefix`/lib/glibc/libm.so:${LD_LIBRARY_PATH} \ LEAN_LIB_DIR=`lean --print-libdir` \ - cargo test + RUST_BACKTRACE=1 \ + cargo test --verbose -- --nocapture diff --git a/cedar-drt/set_env_vars.sh b/cedar-drt/set_env_vars.sh index c44ee1792..8b207b7ca 100644 --- a/cedar-drt/set_env_vars.sh +++ b/cedar-drt/set_env_vars.sh @@ -25,6 +25,4 @@ unset -f add_lib_to_path # Set CLASSPATH if [ -f "$(pwd)/../cedar-dafny-java-wrapper/build/libs/cedar-dafny-java-wrapper.jar" ]; then export CLASSPATH="$(< ../cedar-dafny-java-wrapper/build/runtimeClasspath.txt):$(pwd)/../cedar-dafny-java-wrapper/build/libs/cedar-dafny-java-wrapper.jar" -fi - -export CEDAR_INTEGRATION_TESTS_PATH="$(pwd)/../cedar/cedar-integration-tests" \ No newline at end of file +fi \ No newline at end of file diff --git a/cedar-drt/src/dafny_java_impl.rs b/cedar-drt/src/dafny_java_impl.rs index c983d00de..37c031566 100644 --- a/cedar-drt/src/dafny_java_impl.rs +++ b/cedar-drt/src/dafny_java_impl.rs @@ -18,6 +18,7 @@ //! implementation extracted from the Dafny specification. use crate::cedar_test_impl::*; +use crate::definitional_request_types::*; use crate::logger::*; use cedar_policy::frontend::is_authorized::InterfaceResponse; use cedar_policy::integration_testing::{CustomCedarImpl, IntegrationTestValidationResult}; @@ -74,14 +75,6 @@ struct RequestForDefEngine<'a> { entities: &'a Entities, } -#[derive(Debug, Serialize, Deserialize)] -pub struct DefinitionalAuthResponse { - serialization_nanos: i64, - deserialization_nanos: i64, - auth_nanos: i64, - response: InterfaceResponse, -} - #[derive(Debug, Serialize)] struct EvalRequestForDefEngine<'a> { request: &'a ast::Request, @@ -103,14 +96,6 @@ struct RequestForDefValidator<'a> { mode: ValidationMode, } -#[derive(Debug, Deserialize)] -pub struct DefinitionalValResponse { - serialization_nanos: i64, - deserialization_nanos: i64, - validation_nanos: i64, - response: ValidationInterfaceResponse, -} - /// The lifetime parameter 'j is the lifetime of the JVM instance pub struct JavaDefinitionalEngine<'j> { /// Thread attached to the JVM diff --git a/cedar-drt/src/lean_impl.rs b/cedar-drt/src/lean_impl.rs index 7a60faf15..442052fe7 100644 --- a/cedar-drt/src/lean_impl.rs +++ b/cedar-drt/src/lean_impl.rs @@ -81,12 +81,7 @@ enum ValResponseDef { Error(String), } -#[derive(Debug)] -pub enum LeanDefEngineError {} - -pub struct LeanDefinitionalEngine { - initialized: bool, -} +pub struct LeanDefinitionalEngine {} fn lean_obj_to_string(o: *mut lean_object) -> String { let lean_obj_p = unsafe { lean_string_cstr(o) }; @@ -95,7 +90,7 @@ fn lean_obj_to_string(o: *mut lean_object) -> String { } impl LeanDefinitionalEngine { - pub fn new() -> Result { + pub fn new() -> Self { if env::var("RUST_LEAN_INTERFACE_INIT").is_err() { unsafe { lean_initialize_runtime_module() }; unsafe { lean_initialize() }; @@ -103,7 +98,7 @@ impl LeanDefinitionalEngine { unsafe { lean_io_mark_end_initialization() }; env::set_var("RUST_LEAN_INTERFACE_INIT", "1"); } - Ok(Self { initialized: true }) + Self {} } fn serialize_authorization_request( From 0a812a57a2d911000d67a2443dd2233634e64cde Mon Sep 17 00:00:00 2001 From: Kesha Hietala Date: Tue, 5 Dec 2023 18:25:40 +0000 Subject: [PATCH 40/57] update cedar submodule --- cedar | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cedar b/cedar index a9d2ed5a5..be410af9f 160000 --- a/cedar +++ b/cedar @@ -1 +1 @@ -Subproject commit a9d2ed5a59052df73ebe1a89e2b5827ac1664925 +Subproject commit be410af9ff377f9f4fcf0ce0fc416c428ab34174 From 3b895308e1e92dc3a588d30739915ca9a27d768c Mon Sep 17 00:00:00 2001 From: Kesha Hietala Date: Tue, 5 Dec 2023 18:28:04 +0000 Subject: [PATCH 41/57] minor fixes --- cedar-drt/Makefile | 2 +- cedar-drt/tests/integration_tests.rs | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/cedar-drt/Makefile b/cedar-drt/Makefile index b10515bd8..e6b89cc6c 100644 --- a/cedar-drt/Makefile +++ b/cedar-drt/Makefile @@ -11,4 +11,4 @@ test: all LD_LIBRARY_PATH=`lean --print-libdir`:`lean --print-prefix`/lib/glibc/libm.so:${LD_LIBRARY_PATH} \ LEAN_LIB_DIR=`lean --print-libdir` \ RUST_BACKTRACE=1 \ - cargo test --verbose -- --nocapture + cargo test -- --nocapture diff --git a/cedar-drt/tests/integration_tests.rs b/cedar-drt/tests/integration_tests.rs index b8f2d9dc8..7b5e32040 100644 --- a/cedar-drt/tests/integration_tests.rs +++ b/cedar-drt/tests/integration_tests.rs @@ -73,8 +73,7 @@ fn integration_tests_on_java_and_lean_def_impl() { //WARNING: We need to create lean def engine first so the JVM signal handlers are aware of it. //If this needs to change at some point in the future, you'll need to add libjsig.so to LD_PRELOAD //WARNING: Different tests run in new threads by default, so don't separate these. - let lean_def_impl = - LeanDefinitionalEngine::new().expect("failed to create Lean definitional engine"); + let lean_def_impl = LeanDefinitionalEngine::new(); run_integration_tests(&lean_def_impl); let java_def_impl = From 6d0c6b167ccd090101fb50e517f17a3be56d2e1a Mon Sep 17 00:00:00 2001 From: Kesha Hietala Date: Tue, 5 Dec 2023 20:39:29 +0000 Subject: [PATCH 42/57] cleanup --- .github/workflows/ci.yml | 77 ++++++++++------------------ README.md | 19 +++---- build.sh | 16 ++++-- cedar-drt/Makefile | 14 ----- cedar-drt/README.md | 20 +++----- cedar-drt/set_env_vars.sh | 8 ++- cedar-drt/src/lean_impl.rs | 9 +++- cedar-drt/src/lib.rs | 1 - cedar-drt/tests/integration_tests.rs | 2 +- 9 files changed, 70 insertions(+), 96 deletions(-) delete mode 100644 cedar-drt/Makefile diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1edfc9936..c20fc29ef 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -15,7 +15,6 @@ jobs: matrix: toolchain: - stable - steps: - name: Checkout cedar-spec uses: actions/checkout@v3 @@ -44,6 +43,32 @@ jobs: dotnet tool restore dotnet tool run dafny-reportgenerator summarize-csv-results --max-resource-count 10000000 . || true + build_and_test_lean: + name: Build and Test Lean + runs-on: ubuntu-latest + strategy: + matrix: + toolchain: + - stable + steps: + - name: Checkout cedar-spec + uses: actions/checkout@v3 + with: + submodules: recursive + - name: Install Lean + shell: bash + run: | + wget https://raw.githubusercontent.com/leanprover/elan/master/elan-init.sh + bash elan-init.sh -y + - name: Build + working-directory: ./cedar-lean + shell: bash + run: source ~/.profile && lake build Cedar + - name: Test + working-directory: ./cedar-lean + shell: bash + run: source ~/.profile && lake exe CedarUnitTests + build_and_test_drt: name: Build and Test DRT runs-on: ubuntu-latest @@ -51,7 +76,6 @@ jobs: matrix: toolchain: - stable - steps: - name: Checkout cedar-spec uses: actions/checkout@v3 @@ -63,14 +87,6 @@ jobs: distribution: 'corretto' java-version: '17' cache: 'gradle' - - name: Build Dafny def engine - working-directory: ./cedar-dafny - shell: bash - run: make compile-difftest - - name: Build cedar-dafny-java-wrapper - working-directory: ./cedar-dafny-java-wrapper - shell: bash - run: ./gradlew build dumpClasspath - name: rustup run: rustup update ${{ matrix.toolchain }} && rustup default ${{ matrix.toolchain }} - name: cargo fmt (cedar-policy-generators) @@ -85,46 +101,9 @@ jobs: - name: cargo rustc (cedar-policy-generators) working-directory: ./cedar-policy-generators run: RUSTFLAGS="-D warnings -F unsafe-code" cargo build --verbose - - name: cargo rustc (cedar-drt) - working-directory: ./cedar-drt - run: RUSTFLAGS="-D warnings -F unsafe-code" cargo build --verbose - - name: cargo rustc (cedar-drt/fuzz/) - working-directory: ./cedar-drt/fuzz - run: RUSTFLAGS="-D warnings -F unsafe-code" cargo build --verbose - name: cargo test (cedar-policy-generators) working-directory: ./cedar-policy-generators run: cargo test --verbose - - name: cargo test (cedar-drt) - working-directory: ./cedar-drt - shell: bash - run: | - source ./set_env_vars.sh - export LD_LIBRARY_PATH=${LD_LIBRARY_PATH+$LD_LIBRARY_PATH:}$JAVA_HOME/lib/server - cargo test --verbose - - build_cedar_lean: - name: Build cedar-lean - runs-on: ubuntu-latest - strategy: - matrix: - toolchain: - - stable - - steps: - - name: Checkout cedar-spec - uses: actions/checkout@v3 - with: - submodules: recursive - - name: Install Lean + - name: ./build.sh shell: bash - run: | - wget https://raw.githubusercontent.com/leanprover/elan/master/elan-init.sh - bash elan-init.sh -y - - name: Build - working-directory: ./cedar-lean - shell: bash - run: source ~/.profile && lake build Cedar - - name: Test - working-directory: ./cedar-lean - shell: bash - run: source ~/.profile && lake exe CedarUnitTests + run: ./build.sh diff --git a/README.md b/README.md index d3f7c8a31..59151c35c 100644 --- a/README.md +++ b/README.md @@ -15,12 +15,17 @@ This repository contains the Dafny formalization of Cedar and infrastructure for To build the Dafny formalization and proofs: -* Install Dafny 4.0, following the instructions [here](https://github.com/dafny-lang/dafny/wiki/INSTALL). Our proofs expect Z3 version 4.12.1, so if you have another copy of Z3 installed locally, you may need to adjust your PATH. +* Install Dafny, following the instructions [here](https://github.com/dafny-lang/dafny/wiki/INSTALL). Our proofs expect Z3 version 4.12.1, so if you have another copy of Z3 installed locally, you may need to adjust your PATH. * `cd cedar-dafny && make verify test` +To build the Lean formalization and proofs: + +* Install Lean, following the instructions [here](https://leanprover.github.io/lean4/doc/setup.html). +* `cd cedar-lean && lake build Cedar` + To build the DRT framework: -* Install Dafny, following the instructions above +* Install Dafny and Lean, following the instructions above. * `./build.sh` ## Run @@ -35,16 +40,6 @@ Available targets are described in the README in the `cedar-drt` directory. Additional commands available with `cargo fuzz help`. -## Checking Proof Stability - -You can measure the complexity of Dafny proofs using [dafny-reportgenerator](https://github.com/dafny-lang/dafny-reportgenerator/). -For example, the commands below check that all proofs have a [resource count](https://dafny.org/dafny/VerificationOptimization/VerificationOptimization#identifying-difficult-assertions) under 10M, which is our informal threshold for when a proof is "too expensive" and likely to break with future changes to Dafny and/or Z3. - -```bash -cd cedar-dafny && make verify GEN_STATS=1 -dotnet tool run dafny-reportgenerator summarize-csv-results --max-resource-count 10000000 . -``` - ## Security See [CONTRIBUTING](CONTRIBUTING.md#security-issue-notifications) for more information. diff --git a/build.sh b/build.sh index c06d65095..192c91694 100755 --- a/build.sh +++ b/build.sh @@ -7,16 +7,24 @@ git submodule update --init cd cedar-drt && source ./set_env_vars.sh cd .. -# Build the formalization and extract Java code +# Build the Dafny formalization and extract Java code cd cedar-dafny && make compile-difftest cd .. -# Build the Java wrapper for DRT +# Build the Dafny Java wrapper cd cedar-dafny-java-wrapper && ./gradlew build dumpClasspath cd .. +# Build the Lean formalization and extract to static C libraries +cd cedar-lean && \ +lake exe cache get && \ +lake build Cedar:static DiffTest:static Std:static Mathlib:static Qq:static Aesop:static ProofWidgets:static +cd .. + # Build DRT cd cedar-drt cargo build -cargo test -cd fuzz && RUSTFLAGS="--cfg=fuzzing" cargo build \ No newline at end of file +cd fuzz && RUSTFLAGS="--cfg=fuzzing" cargo build + +# Run integration tests +cargo test -- --nocapture \ No newline at end of file diff --git a/cedar-drt/Makefile b/cedar-drt/Makefile deleted file mode 100644 index e6b89cc6c..000000000 --- a/cedar-drt/Makefile +++ /dev/null @@ -1,14 +0,0 @@ -.PHONY: all run test - -all: - cd ../cedar-lean && lake build Cedar:static DiffTest:static Std:static Mathlib:static Qq:static Aesop:static ProofWidgets:static - LEAN_LIB_DIR=`lean --print-libdir` \ - cargo build - cd fuzz && LEAN_LIB_DIR=`lean --print-libdir` cargo build - -test: all - DYLD_LIBRARY_PATH=`lean --print-libdir`:${DYLD_LIBRARY_PATH} \ - LD_LIBRARY_PATH=`lean --print-libdir`:`lean --print-prefix`/lib/glibc/libm.so:${LD_LIBRARY_PATH} \ - LEAN_LIB_DIR=`lean --print-libdir` \ - RUST_BACKTRACE=1 \ - cargo test -- --nocapture diff --git a/cedar-drt/README.md b/cedar-drt/README.md index 588696405..13452f28a 100644 --- a/cedar-drt/README.md +++ b/cedar-drt/README.md @@ -30,15 +30,11 @@ If the fuzz targets are compiled with the `log` features, then they will log the The sampling rate can be controlled by the `RATE` environment variable, which defaults to 100% if not set. -## Linking Issues (Lean) -If you get weird linking issues make sure: -- `LD_PRELOAD` is set to the same lean version mathlib is using -- You built all the lean code with static linking. -- You cargo clean and rebuild (sometimes seemed necessary?) - -If you get SIG intercept issues make sure: -- You initialize Lean before you start the JVM -- You have Lean and the JVM in the same thread - -If you get errors for initializing Lean more than once make sure: -- You only initialize Lean once. \ No newline at end of file +## Debugging build failures + +If you run into weird build issues, +1. Make sure you have run `source set_env_vars.sh`, which sets all the environment variables needed to run the Dafny & Lean definitional code. +2. Try a `cargo clean` and rebuild. +3. If the steps above don't help, then file [an issue](https://github.com/cedar-policy/cedar-spec/issues). + +If everything builds, but the integration tests are failing, then it may be helpful to set `RUST_BACKTRACE=1` and run `cargo test -- --nocapture` to print additional test information. \ No newline at end of file diff --git a/cedar-drt/set_env_vars.sh b/cedar-drt/set_env_vars.sh index 8b207b7ca..092fd620c 100644 --- a/cedar-drt/set_env_vars.sh +++ b/cedar-drt/set_env_vars.sh @@ -25,4 +25,10 @@ unset -f add_lib_to_path # Set CLASSPATH if [ -f "$(pwd)/../cedar-dafny-java-wrapper/build/libs/cedar-dafny-java-wrapper.jar" ]; then export CLASSPATH="$(< ../cedar-dafny-java-wrapper/build/runtimeClasspath.txt):$(pwd)/../cedar-dafny-java-wrapper/build/libs/cedar-dafny-java-wrapper.jar" -fi \ No newline at end of file +fi + +# Set environment variables for Lean +export LEAN_LIB_DIR=$(lean --print-libdir) +export LD_LIBRARY_PATH=${LD_LIBRARY_PATH+$LD_LIBRARY_PATH:}$(lean --print-libdir) +export DYLD_LIBRARY_PATH=${DYLD_LIBRARY_PATH+$DYLD_LIBRARY_PATH:}$(lean --print-libdir) +export LD_PRELOAD=${LD_PRELOAD+$LD_PRELOAD:}$(lean --print-prefix)/lib/glibc/libm.so diff --git a/cedar-drt/src/lean_impl.rs b/cedar-drt/src/lean_impl.rs index 442052fe7..4125f5be0 100644 --- a/cedar-drt/src/lean_impl.rs +++ b/cedar-drt/src/lean_impl.rs @@ -210,6 +210,7 @@ impl CedarTestImplementation for LeanDefinitionalEngine { _expr: &Expr, _expected: Option, ) -> bool { + // TODO unimplemented!("Unimplemented: interpret"); } @@ -217,9 +218,13 @@ impl CedarTestImplementation for LeanDefinitionalEngine { &self, schema: &cedar_policy_validator::ValidatorSchema, policies: &ast::PolicySet, - _mode: ValidationMode, + mode: ValidationMode, ) -> ValidationInterfaceResponse { - // Note: only strict mode is supported in Lean + assert_eq!( + mode, + ValidationMode::Strict, + "Lean definitional validator only supports `Strict` mode" + ); self.validate(schema, policies) } } diff --git a/cedar-drt/src/lib.rs b/cedar-drt/src/lib.rs index d6d8dd0ac..a1383dd82 100644 --- a/cedar-drt/src/lib.rs +++ b/cedar-drt/src/lib.rs @@ -14,7 +14,6 @@ * limitations under the License. */ -// #![forbid(unsafe_code)] mod cedar_test_impl; mod dafny_java_impl; mod definitional_request_types; diff --git a/cedar-drt/tests/integration_tests.rs b/cedar-drt/tests/integration_tests.rs index 7b5e32040..a8c2babed 100644 --- a/cedar-drt/tests/integration_tests.rs +++ b/cedar-drt/tests/integration_tests.rs @@ -69,7 +69,7 @@ fn run_integration_tests(custom_impl: &dyn CustomCedarImpl) { } #[test] -fn integration_tests_on_java_and_lean_def_impl() { +fn integration_tests_on_def_impl() { //WARNING: We need to create lean def engine first so the JVM signal handlers are aware of it. //If this needs to change at some point in the future, you'll need to add libjsig.so to LD_PRELOAD //WARNING: Different tests run in new threads by default, so don't separate these. From f2cb33b5443e4b7ed14464a1089fc3026c046b65 Mon Sep 17 00:00:00 2001 From: Kesha Hietala Date: Tue, 5 Dec 2023 20:54:59 +0000 Subject: [PATCH 43/57] another attempt at ci --- .github/workflows/ci.yml | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c20fc29ef..46430ca63 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -71,16 +71,13 @@ jobs: build_and_test_drt: name: Build and Test DRT + needs: [build_and_test_dafny, build_and_test_lean] runs-on: ubuntu-latest strategy: matrix: toolchain: - stable steps: - - name: Checkout cedar-spec - uses: actions/checkout@v3 - with: - submodules: recursive - name: Get Java 17 uses: actions/setup-java@v3 with: From 665b45facc705f066b3a95a926ad8c594a222e82 Mon Sep 17 00:00:00 2001 From: Andrew Wells Date: Tue, 5 Dec 2023 13:43:48 -0800 Subject: [PATCH 44/57] fix CI --- .github/workflows/ci.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 46430ca63..353f9abd6 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -78,6 +78,10 @@ jobs: toolchain: - stable steps: + - name: Checkout cedar-spec + uses: actions/checkout@v3 + with: + submodules: recursive - name: Get Java 17 uses: actions/setup-java@v3 with: From 0f85cb0ec1e949b36b665dde844843542ce0c486 Mon Sep 17 00:00:00 2001 From: Andrew Wells Date: Tue, 5 Dec 2023 14:05:07 -0800 Subject: [PATCH 45/57] upterm --- .github/workflows/ci.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 353f9abd6..3412bd44d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -105,6 +105,8 @@ jobs: - name: cargo test (cedar-policy-generators) working-directory: ./cedar-policy-generators run: cargo test --verbose + - name: upterm + uses: lhotari/action-upterm@v1 - name: ./build.sh shell: bash run: ./build.sh From 54a56fc72da386a55857e3487e4584e1e8a907d1 Mon Sep 17 00:00:00 2001 From: Andrew Wells Date: Tue, 5 Dec 2023 14:28:45 -0800 Subject: [PATCH 46/57] fix CI --- .github/workflows/ci.yml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3412bd44d..7c3d6fb26 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -82,6 +82,11 @@ jobs: uses: actions/checkout@v3 with: submodules: recursive + - name: Install Lean + shell: bash + run: | + wget https://raw.githubusercontent.com/leanprover/elan/master/elan-init.sh + bash elan-init.sh -y - name: Get Java 17 uses: actions/setup-java@v3 with: @@ -105,8 +110,6 @@ jobs: - name: cargo test (cedar-policy-generators) working-directory: ./cedar-policy-generators run: cargo test --verbose - - name: upterm - uses: lhotari/action-upterm@v1 - - name: ./build.sh + - name: build.sh shell: bash - run: ./build.sh + run: source ~/.profile && ./build.sh From 0c91f6a1909a753bac456cfd5ef50367bcc90038 Mon Sep 17 00:00:00 2001 From: Kesha Hietala Date: Wed, 6 Dec 2023 16:57:13 +0000 Subject: [PATCH 47/57] minor cleanup --- .github/workflows/ci.yml | 1 - build.sh | 23 ++++++++++++++--------- 2 files changed, 14 insertions(+), 10 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7c3d6fb26..79382ac4f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -71,7 +71,6 @@ jobs: build_and_test_drt: name: Build and Test DRT - needs: [build_and_test_dafny, build_and_test_lean] runs-on: ubuntu-latest strategy: matrix: diff --git a/build.sh b/build.sh index 192c91694..5733b6ed6 100755 --- a/build.sh +++ b/build.sh @@ -4,27 +4,32 @@ git submodule update --init # Set environment variables -cd cedar-drt && source ./set_env_vars.sh +cd cedar-drt +source ./set_env_vars.sh cd .. -# Build the Dafny formalization and extract Java code -cd cedar-dafny && make compile-difftest -cd .. +# Build the Dafny formalization and extract to Java code +# cd cedar-dafny +# make compile-difftest +# cd .. # Build the Dafny Java wrapper -cd cedar-dafny-java-wrapper && ./gradlew build dumpClasspath +cd cedar-dafny-java-wrapper +./gradlew build dumpClasspath cd .. # Build the Lean formalization and extract to static C libraries -cd cedar-lean && \ -lake exe cache get && \ +cd cedar-lean lake build Cedar:static DiffTest:static Std:static Mathlib:static Qq:static Aesop:static ProofWidgets:static cd .. # Build DRT cd cedar-drt cargo build -cd fuzz && RUSTFLAGS="--cfg=fuzzing" cargo build # Run integration tests -cargo test -- --nocapture \ No newline at end of file +cargo test -- --nocapture + +# Build inner fuzz crate +cd fuzz && RUSTFLAGS="--cfg=fuzzing" cargo build +cargo test \ No newline at end of file From 2247432063a741583fc620d3bdcc486d4fc31300 Mon Sep 17 00:00:00 2001 From: Kesha Hietala Date: Wed, 6 Dec 2023 18:05:18 +0000 Subject: [PATCH 48/57] more nits --- build.sh | 6 +++--- cedar-lean/README.md | 3 +-- 2 files changed, 4 insertions(+), 5 deletions(-) diff --git a/build.sh b/build.sh index 5733b6ed6..90aec62e7 100755 --- a/build.sh +++ b/build.sh @@ -9,9 +9,9 @@ source ./set_env_vars.sh cd .. # Build the Dafny formalization and extract to Java code -# cd cedar-dafny -# make compile-difftest -# cd .. +cd cedar-dafny +make compile-difftest +cd .. # Build the Dafny Java wrapper cd cedar-dafny-java-wrapper diff --git a/cedar-lean/README.md b/cedar-lean/README.md index b7607d7be..7a258439d 100644 --- a/cedar-lean/README.md +++ b/cedar-lean/README.md @@ -14,11 +14,10 @@ To build code and proofs from the command line: ```shell cd cedar-lean +lake exe cache get # gets pre-built libraries for `mathlib4` lake build Cedar ``` -The the first build may take a while because it builds the `mathlib4` library that Cedar depends on. Subsequent builds will be fast. - To run the unit tests: ```shell From 628cbf889fb371588a2626d697d8ef6d8ed7760b Mon Sep 17 00:00:00 2001 From: Kesha Hietala Date: Wed, 6 Dec 2023 18:30:21 +0000 Subject: [PATCH 49/57] remove mathlib --- build.sh | 2 +- cedar-drt/build.rs | 4 ---- cedar-drt/fuzz/build.rs | 6 ------ cedar-drt/src/lean_impl.rs | 5 ----- 4 files changed, 1 insertion(+), 16 deletions(-) diff --git a/build.sh b/build.sh index 90aec62e7..4ec6cc2c3 100755 --- a/build.sh +++ b/build.sh @@ -20,7 +20,7 @@ cd .. # Build the Lean formalization and extract to static C libraries cd cedar-lean -lake build Cedar:static DiffTest:static Std:static Mathlib:static Qq:static Aesop:static ProofWidgets:static +lake build Cedar:static DiffTest:static Std:static cd .. # Build DRT diff --git a/cedar-drt/build.rs b/cedar-drt/build.rs index 1d22876a7..82ed0b3c8 100644 --- a/cedar-drt/build.rs +++ b/cedar-drt/build.rs @@ -4,8 +4,4 @@ fn main() { println!("cargo:rustc-link-search=native=../cedar-lean/build/lib"); println!("cargo:rustc-link-search=native={lean_dir}"); println!("cargo:rustc-link-search=native=../cedar-lean/lake-packages/std/build/lib"); - println!("cargo:rustc-link-search=native=../cedar-lean/lake-packages/mathlib/build/lib"); - println!("cargo:rustc-link-search=native=../cedar-lean/lake-packages/Qq/build/lib"); - println!("cargo:rustc-link-search=native=../cedar-lean/lake-packages/aesop/build/lib"); - println!("cargo:rustc-link-search=native=../cedar-lean/lake-packages/proofwidgets/build/lib"); } diff --git a/cedar-drt/fuzz/build.rs b/cedar-drt/fuzz/build.rs index 70b318cad..0c92dca61 100644 --- a/cedar-drt/fuzz/build.rs +++ b/cedar-drt/fuzz/build.rs @@ -4,10 +4,4 @@ fn main() { println!("cargo:rustc-link-search=native=../../cedar-lean/build/lib"); println!("cargo:rustc-link-search=native={lean_dir}"); println!("cargo:rustc-link-search=native=../../cedar-lean/lake-packages/std/build/lib"); - println!("cargo:rustc-link-search=native=../../cedar-lean/lake-packages/mathlib/build/lib"); - println!("cargo:rustc-link-search=native=../../cedar-lean/lake-packages/Qq/build/lib"); - println!("cargo:rustc-link-search=native=../../cedar-lean/lake-packages/aesop/build/lib"); - println!( - "cargo:rustc-link-search=native=../../cedar-lean/lake-packages/proofwidgets/build/lib" - ); } diff --git a/cedar-drt/src/lean_impl.rs b/cedar-drt/src/lean_impl.rs index 4125f5be0..39d734b31 100644 --- a/cedar-drt/src/lean_impl.rs +++ b/cedar-drt/src/lean_impl.rs @@ -46,11 +46,6 @@ use std::str::FromStr; #[link(name = "Cedar", kind = "static")] #[link(name = "Std", kind = "static")] #[link(name = "DiffTest", kind = "static")] -#[link(name = "leanshared", kind = "dylib")] -#[link(name = "Mathlib", kind = "static")] -#[link(name = "Qq", kind = "static")] -#[link(name = "ProofWidgets", kind = "static")] -#[link(name = "Aesop", kind = "static")] extern "C" { fn isAuthorizedDRT(req: *mut lean_object) -> *mut lean_object; fn validateDRT(req: *mut lean_object) -> *mut lean_object; From 17600fdc9e8542579c0bccb7c36e345e0431a02b Mon Sep 17 00:00:00 2001 From: Kesha Hietala Date: Wed, 6 Dec 2023 18:49:01 +0000 Subject: [PATCH 50/57] upterm --- .github/workflows/ci.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 79382ac4f..27da67790 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -109,6 +109,8 @@ jobs: - name: cargo test (cedar-policy-generators) working-directory: ./cedar-policy-generators run: cargo test --verbose + - name: upterm + uses: lhotari/action-upterm@v1 - name: build.sh shell: bash run: source ~/.profile && ./build.sh From b677417e59c2d6b6a36e97b5f41fe3c8f5e8f2dd Mon Sep 17 00:00:00 2001 From: Kesha Hietala Date: Wed, 6 Dec 2023 19:06:35 +0000 Subject: [PATCH 51/57] fix ci? --- .github/workflows/ci.yml | 2 -- README.md | 2 ++ cedar-drt/lakefile.lean | 1 + 3 files changed, 3 insertions(+), 2 deletions(-) create mode 120000 cedar-drt/lakefile.lean diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 27da67790..79382ac4f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -109,8 +109,6 @@ jobs: - name: cargo test (cedar-policy-generators) working-directory: ./cedar-policy-generators run: cargo test --verbose - - name: upterm - uses: lhotari/action-upterm@v1 - name: build.sh shell: bash run: source ~/.profile && ./build.sh diff --git a/README.md b/README.md index 59151c35c..c7913d339 100644 --- a/README.md +++ b/README.md @@ -28,6 +28,8 @@ To build the DRT framework: * Install Dafny and Lean, following the instructions above. * `./build.sh` +Note that the build for DRT has only been tested on **Amazon Linux 2**. + ## Run To run DRT: diff --git a/cedar-drt/lakefile.lean b/cedar-drt/lakefile.lean new file mode 120000 index 000000000..68cc7712e --- /dev/null +++ b/cedar-drt/lakefile.lean @@ -0,0 +1 @@ +../cedar-lean/lakefile.lean \ No newline at end of file From 28e6ac58fc01f454be2afee763382aa7ae519717 Mon Sep 17 00:00:00 2001 From: Kesha Hietala Date: Wed, 6 Dec 2023 19:20:52 +0000 Subject: [PATCH 52/57] oops --- cedar-drt/lakefile.lean | 1 - cedar-drt/lean-toolchain | 1 + cedar-drt/src/dafny_java_impl.rs | 29 ----------------------------- 3 files changed, 1 insertion(+), 30 deletions(-) delete mode 120000 cedar-drt/lakefile.lean create mode 120000 cedar-drt/lean-toolchain diff --git a/cedar-drt/lakefile.lean b/cedar-drt/lakefile.lean deleted file mode 120000 index 68cc7712e..000000000 --- a/cedar-drt/lakefile.lean +++ /dev/null @@ -1 +0,0 @@ -../cedar-lean/lakefile.lean \ No newline at end of file diff --git a/cedar-drt/lean-toolchain b/cedar-drt/lean-toolchain new file mode 120000 index 000000000..0eae579b0 --- /dev/null +++ b/cedar-drt/lean-toolchain @@ -0,0 +1 @@ +../cedar-lean/lean-toolchain \ No newline at end of file diff --git a/cedar-drt/src/dafny_java_impl.rs b/cedar-drt/src/dafny_java_impl.rs index 37c031566..b415dc129 100644 --- a/cedar-drt/src/dafny_java_impl.rs +++ b/cedar-drt/src/dafny_java_impl.rs @@ -31,7 +31,6 @@ use jni::objects::{JObject, JString, JValue}; use jni::{JNIVersion, JavaVM}; use lazy_static::lazy_static; use log::info; -use serde::{Deserialize, Serialize}; /// Times to (de)serialize JSON content sent to / received from the Dafny-Java /// implementation. @@ -68,34 +67,6 @@ lazy_static! { }; } -#[derive(Debug, Serialize)] -struct RequestForDefEngine<'a> { - request: &'a ast::Request, - policies: &'a ast::PolicySet, - entities: &'a Entities, -} - -#[derive(Debug, Serialize)] -struct EvalRequestForDefEngine<'a> { - request: &'a ast::Request, - entities: &'a Entities, - expr: &'a ast::Expr, - expected: Option<&'a ast::Expr>, -} - -#[derive(Debug, Serialize, Deserialize, Clone, Copy)] -#[repr(transparent)] -struct DefinitionalEvalResponse { - matches: bool, -} - -#[derive(Debug, Serialize)] -struct RequestForDefValidator<'a> { - schema: &'a ValidatorSchema, - policies: &'a ast::PolicySet, - mode: ValidationMode, -} - /// The lifetime parameter 'j is the lifetime of the JVM instance pub struct JavaDefinitionalEngine<'j> { /// Thread attached to the JVM From 0bf565bf77b4c37e0d46722c24abd02d0756e8ce Mon Sep 17 00:00:00 2001 From: Kesha Hietala Date: Wed, 6 Dec 2023 19:41:55 +0000 Subject: [PATCH 53/57] one more attempt --- build.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/build.sh b/build.sh index 4ec6cc2c3..1eb531966 100755 --- a/build.sh +++ b/build.sh @@ -5,7 +5,7 @@ git submodule update --init # Set environment variables cd cedar-drt -source ./set_env_vars.sh +source set_env_vars.sh cd .. # Build the Dafny formalization and extract to Java code @@ -28,6 +28,7 @@ cd cedar-drt cargo build # Run integration tests +source set_env_vars.sh cargo test -- --nocapture # Build inner fuzz crate From 1abd24829c4df49d59d661516efe05e9abdee6f6 Mon Sep 17 00:00:00 2001 From: Kesha Hietala Date: Thu, 7 Dec 2023 13:56:42 -0500 Subject: [PATCH 54/57] Update cedar-drt/README.md Co-authored-by: Craig Disselkoen --- cedar-drt/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cedar-drt/README.md b/cedar-drt/README.md index 13452f28a..32a3bf872 100644 --- a/cedar-drt/README.md +++ b/cedar-drt/README.md @@ -33,7 +33,7 @@ The sampling rate can be controlled by the `RATE` environment variable, which de ## Debugging build failures If you run into weird build issues, -1. Make sure you have run `source set_env_vars.sh`, which sets all the environment variables needed to run the Dafny & Lean definitional code. +1. Make sure you have run `source set_env_vars.sh`, which sets all the environment variables needed to run the Dafny and Lean definitional code. 2. Try a `cargo clean` and rebuild. 3. If the steps above don't help, then file [an issue](https://github.com/cedar-policy/cedar-spec/issues). From 122afc08403c2817a1a2890be824a496f80afff4 Mon Sep 17 00:00:00 2001 From: Kesha Hietala Date: Thu, 7 Dec 2023 21:32:11 +0000 Subject: [PATCH 55/57] merge with main + some cleanup --- cedar-drt/src/dafny_java_impl.rs | 3 +- cedar-drt/src/definitional_request_types.rs | 3 +- cedar-drt/src/lean_impl.rs | 113 +++++++++++++------- 3 files changed, 74 insertions(+), 45 deletions(-) diff --git a/cedar-drt/src/dafny_java_impl.rs b/cedar-drt/src/dafny_java_impl.rs index b415dc129..04b052551 100644 --- a/cedar-drt/src/dafny_java_impl.rs +++ b/cedar-drt/src/dafny_java_impl.rs @@ -22,10 +22,9 @@ use crate::definitional_request_types::*; use crate::logger::*; use cedar_policy::frontend::is_authorized::InterfaceResponse; use cedar_policy::integration_testing::{CustomCedarImpl, IntegrationTestValidationResult}; -pub use cedar_policy::Response; use cedar_policy_core::ast::{Expr, Value}; pub use cedar_policy_core::*; -pub use cedar_policy_validator::{ValidationMode, ValidationResult, ValidatorSchema}; +pub use cedar_policy_validator::{ValidationMode, ValidatorSchema}; pub use entities::Entities; use jni::objects::{JObject, JString, JValue}; use jni::{JNIVersion, JavaVM}; diff --git a/cedar-drt/src/definitional_request_types.rs b/cedar-drt/src/definitional_request_types.rs index 7d96880e0..5a0bc00aa 100644 --- a/cedar-drt/src/definitional_request_types.rs +++ b/cedar-drt/src/definitional_request_types.rs @@ -16,9 +16,8 @@ use crate::cedar_test_impl::*; use cedar_policy::frontend::is_authorized::InterfaceResponse; -pub use cedar_policy::Response; pub use cedar_policy_core::*; -pub use cedar_policy_validator::{ValidationMode, ValidationResult, ValidatorSchema}; +pub use cedar_policy_validator::{ValidationMode, ValidatorSchema}; pub use entities::Entities; use serde::{Deserialize, Serialize}; diff --git a/cedar-drt/src/lean_impl.rs b/cedar-drt/src/lean_impl.rs index 39d734b31..2864498b9 100644 --- a/cedar-drt/src/lean_impl.rs +++ b/cedar-drt/src/lean_impl.rs @@ -17,8 +17,8 @@ //! Implementation of the [`CedarTestImplementation`] trait for the Cedar Lean //! implementation. -//NOTE: We use the env var RUST_LEAN_INTERFACE_INIT to save the fact that -//we've already initialized +// NOTE: We use the env var RUST_LEAN_INTERFACE_INIT to save the fact that +// we've already initialized. use core::panic; use std::{collections::HashSet, env, ffi::CString}; @@ -27,10 +27,9 @@ use crate::cedar_test_impl::*; use crate::definitional_request_types::*; use cedar_policy::frontend::is_authorized::InterfaceResponse; use cedar_policy::integration_testing::{CustomCedarImpl, IntegrationTestValidationResult}; -pub use cedar_policy::Response; use cedar_policy_core::ast::{Expr, Value}; pub use cedar_policy_core::*; -pub use cedar_policy_validator::{ValidationMode, ValidationResult, ValidatorSchema}; +pub use cedar_policy_validator::{ValidationMode, ValidatorSchema}; pub use entities::Entities; pub use lean_sys::init::lean_initialize; pub use lean_sys::lean_object; @@ -63,15 +62,37 @@ struct SetDef { } #[derive(Serialize, Deserialize)] -struct ResponseDef { +struct AuthorizationResponseInner { policies: SetDef, decision: String, } #[derive(Serialize, Deserialize)] -enum ValResponseDef { +enum AuthorizationResponse { + /// Successful execution of the `isAuthorized` function #[serde(rename = "ok")] - Ok, + Ok(AuthorizationResponseInner), + /// Failure due to an error in the testing harness (e.g., a parse error on the Lean side) + #[serde(rename = "error")] + Error(String), +} + +#[derive(Serialize, Deserialize)] +enum ValidationResponseInner { + /// Successful validation + #[serde(rename = "ok")] + Ok(()), + /// Validation error case + #[serde(rename = "error")] + Error(String), +} + +#[derive(Serialize, Deserialize)] +enum ValidationResponse { + /// Successful execution of the `validate` function + #[serde(rename = "ok")] + Ok(ValidationResponseInner), + /// Failure due to an error in the testing harness (e.g., a parse error on the Lean side) #[serde(rename = "error")] Error(String), } @@ -81,7 +102,7 @@ pub struct LeanDefinitionalEngine {} fn lean_obj_to_string(o: *mut lean_object) -> String { let lean_obj_p = unsafe { lean_string_cstr(o) }; let lean_obj_cstr = unsafe { CStr::from_ptr(lean_obj_p as *const i8) }; - lean_obj_cstr.to_string_lossy().into_owned() //TODO: lossy + lean_obj_cstr.to_string_lossy().into_owned() // TODO: lossy } impl LeanDefinitionalEngine { @@ -106,32 +127,38 @@ impl LeanDefinitionalEngine { policies, entities, }) - .expect("Failed to serialize request, policies, or entities"); - let cstring = CString::new(request).expect("CString::new failed"); - let s = unsafe { lean_mk_string(cstring.as_ptr() as *const u8) }; - return s; + .expect("failed to serialize request, policies, or entities"); + let cstring = CString::new(request).expect("`CString::new` failed"); + unsafe { lean_mk_string(cstring.as_ptr() as *const u8) } } fn deserialize_authorization_response(response: *mut lean_object) -> InterfaceResponse { let response_string = lean_obj_to_string(response); - let resp: ResponseDef = + let resp: AuthorizationResponse = serde_json::from_str(&response_string).expect("could not deserialize json"); - let dec: authorizer::Decision = if resp.decision == "allow" { - authorizer::Decision::Allow - } else if resp.decision == "deny" { - authorizer::Decision::Deny - } else { - panic!("unknown decision") - }; - - let reason = resp - .policies - .mk - .l - .into_iter() - .map(|x| cedar_policy::PolicyId::from_str(&x).expect("could not coerce policyId")) - .collect(); - InterfaceResponse::new(dec, reason, HashSet::new()) + match resp { + AuthorizationResponse::Ok(resp) => { + let dec: authorizer::Decision = if resp.decision == "allow" { + authorizer::Decision::Allow + } else if resp.decision == "deny" { + authorizer::Decision::Deny + } else { + panic!("Lean code returned unknown decision {}", resp.decision) + }; + + let reason = resp + .policies + .mk + .l + .into_iter() + .map(|x| { + cedar_policy::PolicyId::from_str(&x).expect("could not coerce policyId") + }) + .collect(); + InterfaceResponse::new(dec, reason, HashSet::new()) + } + AuthorizationResponse::Error(err) => panic!("Error returned by Lean code: {err}"), + } } /// Ask the definitional engine whether `isAuthorized` for the given `request`, @@ -156,23 +183,27 @@ impl LeanDefinitionalEngine { policies, mode: cedar_policy_validator::ValidationMode::default(), // == Strict }) - .expect("Failed to serialize schema or policies"); - let cstring = CString::new(request).expect("CString::new failed"); - let s = unsafe { lean_mk_string(cstring.as_ptr() as *const u8) }; - return s; + .expect("failed to serialize schema or policies"); + let cstring = CString::new(request).expect("`CString::new` failed"); + unsafe { lean_mk_string(cstring.as_ptr() as *const u8) } } fn deserialize_validation_response(response: *mut lean_object) -> ValidationInterfaceResponse { let response_string = lean_obj_to_string(response); - let resp: ValResponseDef = + let resp: ValidationResponse = serde_json::from_str(&response_string).expect("could not deserialize json"); - let validation_errors = match resp { - ValResponseDef::Ok => Vec::new(), - ValResponseDef::Error(err) => vec![err], - }; - ValidationInterfaceResponse { - validation_errors, - parse_errors: Vec::new(), + match resp { + ValidationResponse::Ok(resp) => { + let validation_errors = match resp { + ValidationResponseInner::Ok(_) => Vec::new(), + ValidationResponseInner::Error(err) => vec![err], + }; + ValidationInterfaceResponse { + validation_errors, + parse_errors: Vec::new(), + } + } + ValidationResponse::Error(err) => panic!("Error returned by Lean code: {err}"), } } From 0c0bf12a292365807c9e8c04a414dae3095ed2f1 Mon Sep 17 00:00:00 2001 From: Kesha Hietala Date: Thu, 7 Dec 2023 21:44:17 +0000 Subject: [PATCH 56/57] review comments --- README.md | 10 ++++++++++ cedar-drt/fuzz/fuzz_targets/abac-type-directed.rs | 5 ++--- cedar-drt/src/lean_impl.rs | 15 ++++++++------- 3 files changed, 20 insertions(+), 10 deletions(-) diff --git a/README.md b/README.md index c7913d339..e06511bc1 100644 --- a/README.md +++ b/README.md @@ -42,6 +42,16 @@ Available targets are described in the README in the `cedar-drt` directory. Additional commands available with `cargo fuzz help`. +## Checking Proof Stability + +You can measure the complexity of Dafny proofs using [dafny-reportgenerator](https://github.com/dafny-lang/dafny-reportgenerator/). +For example, the commands below check that all proofs have a [resource count](https://dafny.org/dafny/VerificationOptimization/VerificationOptimization#identifying-difficult-assertions) under 10M, which is our informal threshold for when a proof is "too expensive" and likely to break with future changes to Dafny and/or Z3. + +```bash +cd cedar-dafny && make verify GEN_STATS=1 +dotnet tool run dafny-reportgenerator summarize-csv-results --max-resource-count 10000000 . +``` + ## Security See [CONTRIBUTING](CONTRIBUTING.md#security-issue-notifications) for more information. diff --git a/cedar-drt/fuzz/fuzz_targets/abac-type-directed.rs b/cedar-drt/fuzz/fuzz_targets/abac-type-directed.rs index 3d9b990cf..1e834a84d 100644 --- a/cedar-drt/fuzz/fuzz_targets/abac-type-directed.rs +++ b/cedar-drt/fuzz/fuzz_targets/abac-type-directed.rs @@ -138,15 +138,14 @@ fuzz_target!(|input: FuzzTargetInput| { initialize_log(); let mut policyset = ast::PolicySet::new(); policyset.add_static(input.policy.into()).unwrap(); - let java_def_engine = - JavaDefinitionalEngine::new().expect("failed to create definitional engine"); + let lean_def_engine = LeanDefinitionalEngine::new(); debug!("Schema: {}\n", input.schema.schemafile_string()); debug!("Policies: {policyset}\n"); debug!("Entities: {}\n", input.entities); for request in input.requests.into_iter().map(Into::into) { debug!("Request : {request}"); let (rust_res, total_dur) = - time_function(|| run_auth_test(&java_def_engine, request, &policyset, &input.entities)); + time_function(|| run_auth_test(&lean_def_engine, request, &policyset, &input.entities)); info!("{}{}", TOTAL_MSG, total_dur.as_nanos()); diff --git a/cedar-drt/src/lean_impl.rs b/cedar-drt/src/lean_impl.rs index 2864498b9..4f31dd480 100644 --- a/cedar-drt/src/lean_impl.rs +++ b/cedar-drt/src/lean_impl.rs @@ -102,7 +102,10 @@ pub struct LeanDefinitionalEngine {} fn lean_obj_to_string(o: *mut lean_object) -> String { let lean_obj_p = unsafe { lean_string_cstr(o) }; let lean_obj_cstr = unsafe { CStr::from_ptr(lean_obj_p as *const i8) }; - lean_obj_cstr.to_string_lossy().into_owned() // TODO: lossy + lean_obj_cstr + .to_str() + .expect("failed to convert Lean object to string") + .to_owned() } impl LeanDefinitionalEngine { @@ -138,12 +141,10 @@ impl LeanDefinitionalEngine { serde_json::from_str(&response_string).expect("could not deserialize json"); match resp { AuthorizationResponse::Ok(resp) => { - let dec: authorizer::Decision = if resp.decision == "allow" { - authorizer::Decision::Allow - } else if resp.decision == "deny" { - authorizer::Decision::Deny - } else { - panic!("Lean code returned unknown decision {}", resp.decision) + let dec: authorizer::Decision = match resp.decision.as_str() { + "allow" => authorizer::Decision::Allow, + "deny" => authorizer::Decision::Deny, + _ => panic!("Lean code returned unknown decision {}", resp.decision), }; let reason = resp From c786d255c7134b84cc932afbf3516c1411eeb0b9 Mon Sep 17 00:00:00 2001 From: Kesha Hietala Date: Thu, 7 Dec 2023 21:55:43 +0000 Subject: [PATCH 57/57] oops - didn't mean to commit the fuzz target changes --- cedar-drt/fuzz/fuzz_targets/abac-type-directed.rs | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/cedar-drt/fuzz/fuzz_targets/abac-type-directed.rs b/cedar-drt/fuzz/fuzz_targets/abac-type-directed.rs index 1e834a84d..3d9b990cf 100644 --- a/cedar-drt/fuzz/fuzz_targets/abac-type-directed.rs +++ b/cedar-drt/fuzz/fuzz_targets/abac-type-directed.rs @@ -138,14 +138,15 @@ fuzz_target!(|input: FuzzTargetInput| { initialize_log(); let mut policyset = ast::PolicySet::new(); policyset.add_static(input.policy.into()).unwrap(); - let lean_def_engine = LeanDefinitionalEngine::new(); + let java_def_engine = + JavaDefinitionalEngine::new().expect("failed to create definitional engine"); debug!("Schema: {}\n", input.schema.schemafile_string()); debug!("Policies: {policyset}\n"); debug!("Entities: {}\n", input.entities); for request in input.requests.into_iter().map(Into::into) { debug!("Request : {request}"); let (rust_res, total_dur) = - time_function(|| run_auth_test(&lean_def_engine, request, &policyset, &input.entities)); + time_function(|| run_auth_test(&java_def_engine, request, &policyset, &input.entities)); info!("{}{}", TOTAL_MSG, total_dur.as_nanos());