Crate didbot_policy_cedar 

The Cedar policy engine, behind the same Evaluator contract as didbot-policy-regex.

A document is Cedar text. Document::load holds it to three rules before it can judge anything: every statement carries an @id unique within the document, every statement is a forbid with a @reason, and every statement validates in strict mode against the schema of each collection it can reach (see schema). A refusal is the statement’s @id and @reason.

Cedar treats a policy that errors as not satisfied. For a forbid that means a misspelled field, or a missing has guard, would permit the request and tuck the error into the diagnostics. Document::decide reads the diagnostics after every decision and turns any error into a refusal naming the statement, so a document with a typo refuses everything in its scope rather than permitting it silently.

Through the Evaluator contract the engine sees a didbot_policy::Subject. A write becomes a record.write request whose value and existing are reassembled from the diff, so an update carries only the fields it changed; a grant becomes an oauth.authorize request with no principal; a token becomes an oauth.token request for the account, with no grant; a create becomes an account.create request for one pool and zone, whose Name carries name and label only when the create gave a name. A statement that needs what the gate does not carry refuses rather than failing to match — see Principal.

A write’s context.client is the same Client entity the two OAuth actions take as their resource, so the rule refusing an app its writes reads like the one refusing it sign-in:

@id("no-app-writes")
@reason("This app may not write here.")
forbid(principal, action == Didbot::Action::"record.write", resource)
when { context has client && context.client.id like "https://app.example/*" };

A write made with the account’s own credential has no client, so a statement reads context.client only after context has client. Without that guard it fails to load, or, where it is unvalidated, refuses every write that has no client.

Re-exports

pub use schema::ActionName;

pub use schema::Field;

pub use schema::FieldType;

pub use schema::Shape;

pub use schema::ShapeError;

pub use schema::Shapes;

Modules

load 🔒

Loading a document: Cedar splits it into statements, and this module holds each to the three rules plan/cedar-engine.md sets — every statement carries a unique @id, every statement is a forbid with a @reason, and every statement validates in strict mode against the schema of each collection it can reach.

request 🔒

One request to judge, and how it becomes Cedar’s principal, action, resource, context and entity store.

schema

The Didbot namespace a document is written against: the entity types, the four actions with their contexts, and the per-collection record shapes that give context.value and context.existing a type.

shared 🔒

One request per subject, shared by every statement asked about it.

Structs

AccountAttributes

What the gate knows about the account beyond its DID. Each is absent when the gate does not carry it, and a statement guards it with has.

CedarEvaluator

The engine: one set of shapes, and every document compiled against it.

Document

A loaded document: its statements keyed by @id, and the policy set the authorizer runs, which is those statements plus the baseline permit.

Failure

Why one statement, or the document as a whole, did not load.

LoadError

A document that did not load. Every failure the loader found, so the dashboard shows all of them at once.

Request

One request for a document to judge.

RequestError

The request could not be turned into something Cedar can judge. The caller refuses: nothing was evaluated, so nothing was permitted.

Statement

One loaded forbid.

Enums

Action

The action being asked about, with its resource and context.

Decision

What a document decided about one request.

Operation

What a record.write does to the record.

Principal

Who is asking, as much of it as the gate knows.

PrincipalNeed

How much a statement’s scope says about principal, and therefore how much the gate must know about the account for the statement to be judged at all.

Constants

BASELINE_ID

The id of the permit(principal, action, resource) the server adds beside every document, so that a document’s forbids are the only thing that can turn a request down. Reserved: a statement may not use it.

Functions

outcome 🔒

What the evaluator contract returns for a document’s decision.

source_of

The source text a bot.did.policy#cedar document’s predicate carries.