Module set 

Reading one observation of the operator’s two collections into the declarations a tree is built from, and the checks that need nothing but the records themselves.

didbot-pds’s policy_bindings::resolve runs read, adds the checks that ask its account registry who is above whom, then runs compile. A browser runs the same two without the registry.

Structs

BuildFailure

One record a build could not honour, and why.

Declared

One policy record as the tree registers it.

Observed

Both collections as one listing of one repository observed them, complete. Constructed only once both listings have been read to their last page: a poll that could read one and not the other has nothing to build from.

PolicyRevision

One revision of the operator’s records, as this deployment holds it.

Read

What read made of one observation.

RejectedBuild

A build refused: every record it could not honour. The set last built keeps serving.

Split 🔒

One statement of a policy record, split out by its engine: what the tree registers, and which subject shapes it decides.

Enums

DeclarationError

Why a policy record yields no declaration a tree can register.

StatementLabel

One statement of a policy’s document, as its declaration ids name it.

Constants

CEDAR_SOURCE 🔒

Where a #cedar document’s text is. Its statements share it.

Functions

answers

Whether this server answers action. A policy naming any other action is refused whole, at DeclarationError::Action.

applicability_of 🔒

The applicability an action selects, or None for an action this server does not answer.

compile

Compiles declared beside the two sources that are not the operator’s, whole.

declarations

Declares record, written at key.

key_of

The record key a declaration id was minted from — see declarations.

reach

Whether a binding written in author’s repository reaches policy. A binding reaches only the policies written beside it; written says whether a policy is written at a key there.

read

Reads both collections, declares every policy, and checks that each binding reaches the policies it names.

refused

Every record a compile refused, under the record’s own key.

split 🔒

A record’s statements, each on its own, with the language that compiles them. Each engine splits its own document: the regex engine holds one compiled statement apiece, and the Cedar engine keys a refusal by the statement’s @id, which the tree can only report if the statement is registered under it.

statement_of

The statement of document a declaration id was minted from — see declarations.