-
Notifications
You must be signed in to change notification settings - Fork 103
Improve substitution #1387
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Improve substitution #1387
Conversation
Signed-off-by: Lőrinc Bódy <lorinc.body@devrev.ai>
9099469
to
ac7de7d
Compare
LGTM. Nit: I prefer the new API to be named like |
I can do that. |
Yes, we theoretically can. You can go ahead to mark it in the PR and other team members can weigh in when they review it. |
propose deprecation of old reauthorize Signed-off-by: Lőrinc Bódy <lorinc.body@devrev.ai>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good. One comment.
|
||
/// Attempt to re-authorize this response given a mapping from unknowns to values, provided as an iterator. | ||
/// Exhausts the iterator, returning any evaluation errors in the restricted expressions, regardless whether there is a matching unknown. | ||
pub fn reauthorize_with_bindings<'m>( |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Does it need this explicit lifetime?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Without it, I get an error:
anonymous lifetimes in `impl Trait` are unstable
expected named lifetime parameter
api.rs(1075, 51): consider introducing a named lifetime parameter: `'a `, `<'a>`
Signed-off-by: Shaobo He <shaobohe@amazon.com>
Description of changes
Adds a new function
reauthorize_with_iter
toPartialResponse
, that takes anIntoIterator
instead of theHashMap<SmolString, RestrictedExpression>
. This has two advantages:reauthorize
immediately consumes the hashmap, the new api removes the need to allocate it if the remappings are already available in some other format.I'm considering to add one that takes a Fn(&str) -> Option too, that one would remove the need to iterate them all.
In fact the whole substitution infrastructure in -core could be using such a function, but the current reauthorize API is not (easily) implementable in those terms, because of the fallibility of conversion from RestrictedExpression to Value.
However, I believe the most common case will be when the caller provides literal types in the substitutions: If we make a specialized method that takes only valid values, the need to evaluate the 'restricted expression' disappears.
But I suppose ast::Value shoudn't be exposed in the public API, instead EvalResult or a similar wrapper would be needed?
Issue #, if available
Checklist for requesting a review
The change in this PR is (choose one, and delete the other options):
I confirm that this PR (choose one, and delete the other options):
I confirm that
cedar-spec
(choose one, and delete the other options):I confirm that
docs.cedarpolicy.com
(choose one, and delete the other options):