Add support for generic policy iteration when authorizing a request by patjakdev · Pull Request #85 · cedar-policy/cedar-go

patjakdev · 2025-04-17T21:45:09Z

Issue #, if available:

Description of changes: Adds a new top-level Authorize() function which accepts a generic iterator of policies.

This functionality supersedes the existing PolicySet.IsAuthorized() method (which is now implemented in terms of Authorize()) and allows for more exotic policy injection a la the EntityGetter interface. This means that policy can be lazily loaded from an external source and passed to the Authorize() function via the iterator or policy sets can be combined for authorization without having to Clone() them into a new PolicySet.

Authorize() can only be called from packages built using Go 1.23 or later.

Also, several other types have gotten some iterator love:

types.EntityUIDSet gets an All() method that returns an iterator over the entity UIDs
types.Set gets an All() method that returns an iterator over the Values in the set
types.Record gets three new methods that return iterators: All(), Keys(), and Values() which behave similarly to maps.All(), maps.Keys(), and maps.Values().
types.PolicySet gets an All() method that returns an iterator over the PolicyIDs and *Policys in the PolicySet.

This function is identical to PolicySet.IsAuthorized(), but allows a generic iterator of (PolicyID, *Policy) tuples to be passed. This allows for flexibility at the callsite if the caller wants to use some other data structure to hold on to a map of PolicyIDs to *Policy. Note: an All() method is also added to PolicySet which returns an iterator over the internal policy map. Signed-off-by: Patrick Jakubowski <patrick.jakubowski@strongdm.com>

…dule. Signed-off-by: Patrick Jakubowski <patrick.jakubowski@strongdm.com>

Signed-off-by: Patrick Jakubowski <patrick.jakubowski@strongdm.com>

…uthorized() Signed-off-by: Patrick Jakubowski <patrick.jakubowski@strongdm.com>

Signed-off-by: Patrick Jakubowski <patrick.jakubowski@strongdm.com>

patjakdev · 2025-04-18T20:53:37Z

.github/workflows/build_and_test.yml

-# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-go
-
-name: Go
+name: Verify


I combined build_and_test.yml and golangci-lint.yml (we weren't getting much value out of the parallelism anyway) and switched to using go-version-file so that we only have to update the Go version in one place.

patjakdev · 2025-04-18T20:55:46Z

ast/ast_test.go

 			internalast.Permit().When(internalast.Long(42).ContainsAny(internalast.Long(43))),
 		},
+		{
+			"opContainsIsEmpty",


This is an unrelated change that I made in order to get test coverage back up to 100%

patjakdev · 2025-04-18T20:56:02Z

x/exp/ast/ast_test.go

 				Conditions: []ast.ConditionType{{Condition: ast.ConditionWhen, Body: ast.NodeTypeHasTag{BinaryNode: ast.BinaryNode{Left: ast.NodeValue{Value: types.Long(42)}, Right: ast.NodeValue{Value: types.String("key")}}}}}},
 		},
+		{
+			"opIsEmpty",


More test coverage improvements

patjakdev · 2025-04-18T20:56:15Z

x/exp/ast/internal_test.go

+	NodeTypeExtensionCall{}.isNode()
 	NodeTypeIfThenElse{}.isNode()
-	NodeTypeLike{}.isNode()
+	NodeTypeIsEmpty{}.isNode()


More unrelated test improvements.

patjakdev · 2025-04-18T20:57:05Z

ast/policy_test.go


-	p := ast.Permit().PrincipalEq(types.NewEntityUID("Foo::Bar", "Baz"))
-	expected := `{
+	t.Run("roundtrip", func(t *testing.T) {


More unrelated changes to get test coverage to 100%

…rator as well Signed-off-by: Patrick Jakubowski <patrick.jakubowski@strongdm.com>

README.md

authorize.go

internal/mapset/immutable.go

policy_set.go

types/record_test.go

types/set_test.go

x/exp/batch/batch.go

philhassey

Let's chat a bit about my comments and see what changes we want. Overall looks good!

Also, add some dummy statements to otherwise empty functions so that they're counted for code coverage purposes. Signed-off-by: Patrick Jakubowski <patrick.jakubowski@strongdm.com>

… method rather than a bare iter.Seq2 Signed-off-by: Patrick Jakubowski <patrick.jakubowski@strongdm.com>

… Authorize() Signed-off-by: Patrick Jakubowski <patrick.jakubowski@strongdm.com>

Signed-off-by: Patrick Jakubowski <patrick.jakubowski@strongdm.com>

…rary Signed-off-by: Patrick Jakubowski <patrick.jakubowski@strongdm.com>

…n of golang.org/x/exp that introduces constraints Signed-off-by: Patrick Jakubowski <patrick.jakubowski@strongdm.com>

README.md

authorize.go

policy_set.go

x/exp/ast/node.go

philhassey

LGTM, with allowance for some brief bike-shedding

policy_set.go

patjakdev force-pushed the add-support-for-generic-authorize branch from a03f59f to 1845891 Compare April 17, 2025 23:26

patjakdev added 2 commits April 18, 2025 11:23

types: add iterators to each of the container types defined in the mo…

4b1e2a3

…dule. Signed-off-by: Patrick Jakubowski <patrick.jakubowski@strongdm.com>

patjakdev force-pushed the add-support-for-generic-authorize branch from 1845891 to 4b1e2a3 Compare April 18, 2025 18:27

cedar-go: consolidate Github workflows

adc25f6

Signed-off-by: Patrick Jakubowski <patrick.jakubowski@strongdm.com>

patjakdev force-pushed the add-support-for-generic-authorize branch from b5b1822 to adc25f6 Compare April 18, 2025 18:39

patjakdev added 3 commits April 18, 2025 12:03

cedar-go: use the PolicySet.All() iterator to implement PolicySet.IsA…

f7a7622

…uthorized() Signed-off-by: Patrick Jakubowski <patrick.jakubowski@strongdm.com>

cedar-go: advertize new features in README.md

f48b2dc

Signed-off-by: Patrick Jakubowski <patrick.jakubowski@strongdm.com>

cedar-go: get test coverage up to 100%

d733ce4

Signed-off-by: Patrick Jakubowski <patrick.jakubowski@strongdm.com>

patjakdev commented Apr 18, 2025

View reviewed changes

patjakdev marked this pull request as ready for review April 18, 2025 20:57

patjakdev changed the title ~~Add support for generic authorize~~ Add support for generic policy iteration when authorizing a request Apr 18, 2025

x/exp/batch: change the batch Authorize function to take a policy ite…

922a4e8

…rator as well Signed-off-by: Patrick Jakubowski <patrick.jakubowski@strongdm.com>