Skip to content

Conversation

B-Lorentz
Copy link
Contributor

@B-Lorentz B-Lorentz commented Dec 20, 2024

Description of changes

Adds a new function reauthorize_with_iter to PartialResponse, that takes an IntoIterator instead of the HashMap<SmolString, RestrictedExpression>. This has two advantages:

  • The SmolStr, which is an implementation detail of the cedar-policy-core crate is not exposed to the callers, instead &str is used. This in in line with the apparent policy of the api in cedar-policy.
  • reauthorize immediately consumes the hashmap, the new api removes the need to allocate it if the remappings are already available in some other format.

I'm considering to add one that takes a Fn(&str) -> Option too, that one would remove the need to iterate them all.
In fact the whole substitution infrastructure in -core could be using such a function, but the current reauthorize API is not (easily) implementable in those terms, because of the fallibility of conversion from RestrictedExpression to Value.

However, I believe the most common case will be when the caller provides literal types in the substitutions: If we make a specialized method that takes only valid values, the need to evaluate the 'restricted expression' disappears.
But I suppose ast::Value shoudn't be exposed in the public API, instead EvalResult or a similar wrapper would be needed?

Issue #, if available

Checklist for requesting a review

The change in this PR is (choose one, and delete the other options):

  • A change (breaking or otherwise) that only impacts unreleased or experimental code.

I confirm that this PR (choose one, and delete the other options):

  • Updates the "Unreleased" section of the CHANGELOG with a description of my change (required for major/minor version bumps).

I confirm that cedar-spec (choose one, and delete the other options):

  • Does not require updates because my change does not impact the Cedar formal model or DRT infrastructure.

I confirm that docs.cedarpolicy.com (choose one, and delete the other options):

  • Does not require updates because my change does not impact the Cedar language specification.

Signed-off-by: Lőrinc Bódy <lorinc.body@devrev.ai>
@B-Lorentz B-Lorentz force-pushed the improve-substitution branch from 9099469 to ac7de7d Compare December 20, 2024 19:53
@shaobo-he-aws
Copy link
Contributor

LGTM. Nit: I prefer the new API to be named like reauthorize_with_bindings.

@B-Lorentz
Copy link
Contributor Author

B-Lorentz commented Dec 23, 2024

LGTM. Nit: I prefer the new API to be named like reauthorize_with_bindings.

I can do that. with_iter seems to suggest some 'deeper' reliance on iteration than it being just the form the bindings are supplied. But I think with_bindings is also suboptimal, since the old reauthorize also uses bindings just as much, just takes them as a map. Can we deprecate the old method?

@shaobo-he-aws
Copy link
Contributor

shaobo-he-aws commented Dec 23, 2024

Can we deprecate the old method?

Yes, we theoretically can. You can go ahead to mark it in the PR and other team members can weigh in when they review it.

propose deprecation of old reauthorize

Signed-off-by: Lőrinc Bódy <lorinc.body@devrev.ai>
Copy link
Contributor

@john-h-kastner-aws john-h-kastner-aws left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good. One comment.


/// Attempt to re-authorize this response given a mapping from unknowns to values, provided as an iterator.
/// Exhausts the iterator, returning any evaluation errors in the restricted expressions, regardless whether there is a matching unknown.
pub fn reauthorize_with_bindings<'m>(
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does it need this explicit lifetime?

Copy link
Contributor Author

@B-Lorentz B-Lorentz Jan 1, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Without it, I get an error:

anonymous lifetimes in `impl Trait` are unstable
expected named lifetime parameter
api.rs(1075, 51): consider introducing a named lifetime parameter: `'a `, `<'a>`

@shaobo-he-aws shaobo-he-aws merged commit bbf7813 into cedar-policy:main Jan 2, 2025
18 of 19 checks passed
shaobo-he-aws added a commit to cedar-policy/cedar-examples that referenced this pull request Jan 2, 2025
Signed-off-by: Shaobo He <shaobohe@amazon.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants