feat(tpe): add type-aware partial evaluation entity model and validation - #370
Conversation
Introduces the entity-side foundation for Cedar's type-aware partial evaluation (TPE), where an entity's attributes, parents, and tags may each be independently unknown. Signed-off-by: Mudit Chaudhary <chmudit@amazon.com>
0469e31 to
b3c5f6f
Compare
Signed-off-by: Mudit Chaudhary <chmudit@amazon.com>
05e2876 to
34aca08
Compare
| * @throws MissingExperimentalFeatureException If the native library was built without the {@code tpe} feature. | ||
| * @throws NullPointerException If the schema is null. |
There was a problem hiding this comment.
Are these applicable any more?
Same with below
There was a problem hiding this comment.
Still applicable. validate(...) uses Objects.requireNonNull(schema, ...) which can throw NullPointerException and ends by routing any native error to MissingExperimentalFeatureException. MissingExperimentalFeatureException is a subclass of InternalException.
| /** Tests for {@link PartialEntities}, a collection of partially known entities. */ | ||
| public class PartialEntitiesTests { | ||
| /** See {@link PartialEntityTests} for what this schema is shaped to catch. */ | ||
| private static final Schema TPE_SCHEMA = TestUtil.loadSchemaResource("/tpe_schema.json"); |
There was a problem hiding this comment.
Maybe this matches the existing pattern, but should this be TPE_SCHEMA_JSON?
There was a problem hiding this comment.
Yeah, it matches the existing pattern in other test suites where we use *_SCHEMA for JSON schemas as *_SCHEMA_CEDAR for Cedar schemas
| "#; | ||
|
|
||
| fn schema_json() -> String { | ||
| json!(SCHEMA).to_string() |
There was a problem hiding this comment.
Nit: Could be worth being consistent with interface.rs above which uses serde_json::json!(SCHEMA).to_string(). Or perhaps the SCHEMA could be shared in both
| * rules that span the collection. In practice that means {@link PartialEntities}, on both the JSON and the concrete | ||
| * path. | ||
| */ | ||
| PartialEntity(EntityUID euid, Optional<Map<String, Value>> attrs, Optional<Set<EntityUID>> parents, |
There was a problem hiding this comment.
Nit: should we add the explicit public here?
There was a problem hiding this comment.
I deliberately did not make it public here as it is used to create non-Schema validated PartialEntity which should not happen (for consumers). This method exists merely to be used by PartialEntities constructors to avoid duplicate validations. So, keeping it package-private
3 participants
Summary
Adds the entity model for Cedar's type-aware partial evaluation (TPE) to CedarJava: entities whose attributes, parents, and tags may each be independently unknown. Everything is
@Experimentaland purely additive — no existing API changes.This is the entity half of the foundation. The TPE request/response types and the authorization call itself follow in a separate PR.
What
CedarJava
PartialEntity— EUID always known; attrs, parents, and tags each either absent (unknown) or present and complete.PartialEntities— the collection, carrying the two checks that only make sense over the whole set: no duplicate UIDs, and no in-collection parent whose own parents are unknown.PartialEntityUID— partial counterpart toEntityUID, reusingEntityTypeNameandEntityIdentifier. The type is always known, since TPE needs it to type check a request.Schemaand validate eagerly, so a value in hand has already been checked.CedarJavaFFI
tpeCargo feature andsrc/tpe.rswith two validators, accepting a schema in either Cedar or JSON format.Why
TPE evaluates policies against incomplete data, which needs a way to say "this entity exists but I don't know its attributes" — distinct from "I don't know whether this entity exists at all," which is expressed by leaving it out of the collection.
Validation happens at construction rather than at authorize time so that a bad entity fails where the mistake was made, with a message naming the offending attribute, instead of surfacing later as an opaque error from a call that looks unrelated.
Issue: #364