Module load 

Loading a document: Cedar splits it into statements, and this module holds each to the three rules plan/cedar-engine.md sets — every statement carries a unique @id, every statement is a forbid with a @reason, and every statement validates in strict mode against the schema of each collection it can reach.

Structs

Document

A loaded document: its statements keyed by @id, and the policy set the authorizer runs, which is those statements plus the baseline permit.

Failure

Why one statement, or the document as a whole, did not load.

LoadError

A document that did not load. Every failure the loader found, so the dashboard shows all of them at once.

Statement

One loaded forbid.

Enums

PrincipalNeed

How much a statement’s scope says about principal, and therefore how much the gate must know about the account for the statement to be judged at all.

Constants

BASELINE_ID

The id of the permit(principal, action, resource) the server adds beside every document, so that a document’s forbids are the only thing that can turn a request down. Reserved: a statement may not use it.

Functions

actions_of 🔒

compared_to 🔒

Collect every string literal the expression compares resource.<attr> to, by one of ops on either side or by [..].contains(resource.<attr>).

is_resource_attr 🔒

reads_context 🔒

Whether the expression reads or tests any of attrs on context.

string_literal 🔒

unvalidated_for 🔒

The collections a statement reads records of without a shape to check them against, as the warning names them: each undescribed collection it names, or “any collection without a shape” when it names none.

validation_targets 🔒

The schemas a statement is validated against, each labelled with the collection whose record type it carries (None for the base schema).