RFC 53 implementation

cedar-policy-core/Cargo.toml

@@ -27,7 +27,7 @@ smol_str = { version = "0.3", features = ["serde"] }
 stacker = "0.1.15"
 arbitrary = { version = "1", features = ["derive"], optional = true }
 miette = { version = "7.4.0", features = ["serde"] }
-nonempty = "0.10.0"
+nonempty = { version = "0.10.0", features = ["serialize"] }
 educe = "0.6.0"
 
 # decimal extension requires regex

cedar-policy-core/src/entities.rs

@@ -2060,6 +2060,7 @@ mod schema_based_parsing_tests {
     use crate::extensions::Extensions;
     use crate::test_utils::*;
     use cool_asserts::assert_matches;
+    use nonempty::NonEmpty;
     use serde_json::json;
     use smol_str::SmolStr;
     use std::collections::HashSet;
@@ -2149,6 +2150,9 @@ mod schema_based_parsing_tests {
     /// Mock schema impl for the `Employee` type used in most of these tests
     struct MockEmployeeDescription;
     impl EntityTypeDescription for MockEmployeeDescription {
+        fn enum_enity_eids(&self) -> Option<NonEmpty<Eid>> {
+            None
+        }
         fn entity_type(&self) -> EntityType {
             EntityType::from(Name::parse_unqualified_name("Employee").expect("valid"))
         }
@@ -3398,6 +3402,9 @@ mod schema_based_parsing_tests {
 
         struct MockEmployeeDescription;
         impl EntityTypeDescription for MockEmployeeDescription {
+            fn enum_enity_eids(&self) -> Option<NonEmpty<Eid>> {
+                None
+            }
             fn entity_type(&self) -> EntityType {
                 "XYZCorp::Employee".parse().expect("valid")
             }

cedar-policy-core/src/entities/conformance/err.rs

@@ -15,8 +15,10 @@
  */
 //! This module cotnains errors around entities not conforming to schemas
 use super::TypeMismatchError;
-use crate::ast::{EntityType, EntityUID};
+use crate::ast::{Eid, EntityType, EntityUID};
 use crate::extensions::ExtensionFunctionLookupError;
+use crate::impl_diagnostic_from_method_on_field;
+use itertools::Itertools;
 use miette::Diagnostic;
 use smol_str::SmolStr;
 use thiserror::Error;
@@ -70,6 +72,10 @@ pub enum EntitySchemaConformanceError {
     #[error(transparent)]
     #[diagnostic(transparent)]
     ExtensionFunctionLookup(ExtensionFunctionLookup),
+    /// Returned when an entity is of an enumerated entity type but has invalid EID
+    #[error(transparent)]
+    #[diagnostic(transparent)]
+    InvalidEnumEntity(#[from] InvalidEnumEntity),
 }
 
 impl EntitySchemaConformanceError {
@@ -132,6 +138,19 @@ impl EntitySchemaConformanceError {
             err,
         })
     }
+
+    pub(crate) fn invalid_enum_entity(
+        uid: EntityUID,
+        choices: impl IntoIterator<Item = Eid>,
+    ) -> Self {
+        Self::InvalidEnumEntity(
+            InvalidEnumEntityError {
+                uid,
+                choices: choices.into_iter().collect(),
+            }
+            .into(),
+        )
+    }
 }
 
 /// Error looking up an extension function. This error can occur when
@@ -277,3 +296,45 @@ impl Diagnostic for UnexpectedEntityTypeError {
         }
     }
 }
+
+/// Returned when an entity is of an enumerated entity type but has invalid EID
+//
+// CAUTION: this type is publicly exported in `cedar-policy`.
+// Don't make fields `pub`, don't make breaking changes, and use caution
+// when adding public methods.
+#[derive(Debug, Error, Diagnostic)]
+#[error(transparent)]
+#[diagnostic(transparent)]
+pub struct InvalidEnumEntity {
+    err: InvalidEnumEntityError,
+}
+
+impl From<InvalidEnumEntityError> for InvalidEnumEntity {
+    fn from(value: InvalidEnumEntityError) -> Self {
+        Self { err: value }
+    }
+}
+
+/// Returned when an entity is of an enumerated entity type but has invalid EID
+#[derive(Debug, Error, Clone, PartialEq, Eq, Hash)]
+#[error("entity `{uid}` is of an enumerated entity type, but `\"{}\"` is not declared as a valid eid", uid.eid().escaped())]
+pub struct InvalidEnumEntityError {
+    /// Entity where the error occurred
+    pub uid: EntityUID,
+    /// Name of the attribute where the error occurred
+    pub choices: Vec<Eid>,
+}
+
+impl Diagnostic for InvalidEnumEntityError {
+    impl_diagnostic_from_method_on_field!(uid, loc);
+
+    fn help<'a>(&'a self) -> Option<Box<dyn std::fmt::Display + 'a>> {
+        Some(Box::new(format!(
+            "valid entity eids: {}",
+            self.choices
+                .iter()
+                .map(|e| format!("\"{}\"", e.escaped()))
+                .join(", ")
+        )))
+    }
+}

cedar-policy-core/src/entities/json/entities.rs

@@ -297,6 +297,18 @@ impl<'e, 's, S: Schema> EntityJsonParser<'e, 's, S> {
                 }
             }
         };
+        match &entity_schema_info {
+            EntitySchemaInfo::NonAction(desc) => {
+                if let Some(choices) = desc.enum_enity_eids() {
+                    if !choices.contains(&uid.eid()) {
+                        return Err(JsonDeserializationError::EntitySchemaConformance(
+                            EntitySchemaConformanceError::invalid_enum_entity(uid.clone(), choices),
+                        ));
+                    }
+                }
+            }
+            _ => {}
+        };
         let vparser = ValueParser::new(self.extensions);
         let attrs: HashMap<SmolStr, RestrictedExpr> = ejson
             .attrs

cedar-policy-core/src/entities/json/schema.rs

@@ -15,8 +15,9 @@
  */
 
 use super::SchemaType;
-use crate::ast::{Entity, EntityType, EntityUID};
+use crate::ast::{Eid, Entity, EntityType, EntityUID};
 use crate::entities::{Name, UnreservedId};
+use nonempty::NonEmpty;
 use smol_str::SmolStr;
 use std::collections::HashSet;
 use std::sync::Arc;
@@ -136,6 +137,10 @@ pub trait EntityTypeDescription {
     /// May entities with this type have attributes other than those specified
     /// in the schema
     fn open_attributes(&self) -> bool;
+
+    /// Return valid EID choices if the entity type is enumerated otherwise
+    /// return `None`
+    fn enum_enity_eids(&self) -> Option<NonEmpty<Eid>>;
 }
 
 /// Simple type that implements `EntityTypeDescription` by expecting no
@@ -164,6 +169,9 @@ impl EntityTypeDescription for NullEntityTypeDescription {
     fn open_attributes(&self) -> bool {
         false
     }
+    fn enum_enity_eids(&self) -> Option<NonEmpty<Eid>> {
+        None
+    }
 }
 impl NullEntityTypeDescription {
     /// Create a new [`NullEntityTypeDescription`] for the given entity typename

cedar-policy-validator/src/cedar_schema/ast.rs

@@ -249,9 +249,24 @@ impl Decl for TypeDecl {
     }
 }
 
+#[derive(Debug, Clone)]
+pub enum EntityDecl {
+    Standard(StandardEntityDecl),
+    Enum(EnumEntityDecl),
+}
+
+impl EntityDecl {
+    pub fn names(&self) -> impl Iterator<Item = &Node<Id>> + '_ {
+        match self {
+            Self::Enum(d) => d.names.iter(),
+            Self::Standard(d) => d.names.iter(),
+        }
+    }
+}
+
 /// Declaration of an entity type
 #[derive(Debug, Clone)]
-pub struct EntityDecl {
+pub struct StandardEntityDecl {
     /// Entity Type Names bound by this declaration.
     /// More than one name can be bound if they have the same definition, for convenience
     pub names: NonEmpty<Node<Id>>,
@@ -263,6 +278,13 @@ pub struct EntityDecl {
     pub tags: Option<Node<Type>>,
 }
 
+/// Declaration of an entity type
+#[derive(Debug, Clone)]
+pub struct EnumEntityDecl {
+    pub names: NonEmpty<Node<Id>>,
+    pub choices: NonEmpty<Node<SmolStr>>,
+}
+
 /// Type definitions
 #[derive(Debug, Clone)]
 pub enum Type {

cedar-policy-validator/src/cedar_schema/err.rs

@@ -89,6 +89,7 @@ lazy_static! {
             ("SET", "`Set`"),
             ("IDENTIFIER", "identifier"),
             ("TAGS", "`tags`"),
+            ("ENUM", "`enum`"),
         ]),
         impossible_tokens: HashSet::new(),
         special_identifier_tokens: HashSet::from([
@@ -106,6 +107,7 @@ lazy_static! {
             "LONG",
             "STRING",
             "BOOL",
+            "ENUM",
         ]),
         identifier_sentinel: "IDENTIFIER",
         first_set_identifier_tokens: HashSet::from(["SET"]),

cedar-policy-validator/src/cedar_schema/fmt.rs

@@ -107,6 +107,22 @@ fn fmt_non_empty_slice<T: Display>(
 }
 
 impl<N: Display> Display for json_schema::EntityType<N> {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match &self.kind {
+            json_schema::EntityTypeKind::Standard(ty) => ty.fmt(f),
+            json_schema::EntityTypeKind::Enum { choices } => write!(
+                f,
+                "[{}]",
+                choices
+                    .iter()
+                    .map(|e| format!("\"{}\"", e.escape_debug()))
+                    .join(", ")
+            ),
+        }
+    }
+}
+
+impl<N: Display> Display for json_schema::StandardEntityType<N> {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         if let Some(non_empty) = self.member_of_types.split_first() {
             write!(f, " in ")?;

cedar-policy-validator/src/cedar_schema/grammar.lalrpop

@@ -24,6 +24,8 @@ use smol_str::ToSmolStr;
 use crate::cedar_schema::ast::{
     Path,
     EntityDecl,
+    StandardEntityDecl,
+    EnumEntityDecl,
     Declaration,
     Namespace,
     Schema as ASchema,
@@ -76,6 +78,7 @@ match {
     "Long" => LONG,
     "String" => STRING,
     "Bool" => BOOL,
+    "enum" => ENUM,
 
     // data input
     r"[_a-zA-Z][_a-zA-Z0-9]*" => IDENTIFIER,
@@ -128,12 +131,16 @@ Decl: Node<Declaration> = {
 // Entity := 'entity' Idents ['in' EntTypes] [['='] RecType] ';' <r:@R>
 Entity: Node<Declaration> = {
     <l1:@L> ENTITY <ets: Idents> <ps:(IN <EntTypes>)?> <l2:@L> <ds:("="? "{" <AttrDecls?> "}")?> <r2:@R> <ts:(TAGS <Type>)?> ";" <r1:@R>
-        => Node::with_source_loc(Declaration::Entity(EntityDecl {
+        => Node::with_source_loc(Declaration::Entity(EntityDecl::Standard(StandardEntityDecl {
             names: ets,
             member_of_types: ps.unwrap_or_default(),
             attrs: Node::with_source_loc(ds.map(|ds| ds.unwrap_or_default()).unwrap_or_default(), Loc::new(l2..r2, Arc::clone(src))),
             tags: ts,
-            }), Loc::new(l1..r1, Arc::clone(src))),
+            })), Loc::new(l1..r1, Arc::clone(src))),
+    <l:@L> ENTITY <ets: Idents> ENUM "[" <choices: STRs> "]" ";" <r:@R> => Node::with_source_loc(Declaration::Entity(EntityDecl::Enum(EnumEntityDecl {
+        names: ets,
+        choices,
+    })), Loc::new(l..r, Arc::clone(src))),
 }
 
 // Action := 'action' Names ['in' QualNameOrNames]
@@ -262,6 +269,8 @@ AnyIdent: Node<AnyId> = {
         => Node::with_source_loc("type".parse().unwrap(), Loc::new(l..r, Arc::clone(src))),
     <l:@L> IN <r:@R>
         => Node::with_source_loc("in".parse().unwrap(), Loc::new(l..r, Arc::clone(src))),
+    <l:@L> ENUM <r:@R>
+        => Node::with_source_loc("enum".parse().unwrap(), Loc::new(l..r, Arc::clone(src))),
     <l:@L> <i:IDENTIFIER> <r:@R>
         => Node::with_source_loc(i.parse().unwrap(), Loc::new(l..r, Arc::clone(src))),
 }
@@ -296,9 +305,9 @@ PathInline: Path = {
 
 NonEmptyComma<E>: NonEmpty<E> = {
     <e:E> => NonEmpty::singleton(e),
-    <mut es:(<E> ",")+> <e:E> => {
-        let mut all = NonEmpty::singleton(e);
-        all.append(&mut es);
+    <es:(<E> ",")+> <e:E> => {
+        let mut all = NonEmpty::from_vec(es).unwrap();
+        all.push(e);
         all
     },
 }
@@ -312,6 +321,9 @@ Names: NonEmpty<Node<SmolStr>> = NonEmptyComma<Name>;
 // Qualnames := Qualname {',' Qualname }
 QualNames : NonEmpty<Node<QualName>> = NonEmptyComma<QualName>;
 
+// STRs := STR {',' STR}
+STRs: NonEmpty<Node<SmolStr>> = NonEmptyComma<STR>;
+
 PrincipalOrResource: Node<PR> = {
     <l:@L> PRINCIPAL <r:@R> => Node::with_source_loc(PR::Principal, Loc::new(l..r, Arc::clone(src))),
     <l:@L> RESOURCE <r:@R> => Node::with_source_loc(PR::Resource, Loc::new(l..r, Arc::clone(src))),