Allow principal resource slots in condition #1722

alanwang67 · 2025-07-29T15:11:45Z

Description of changes

Removes the check that prevents ?principal and ?resource slots from appearing in the scope of the policy. Instead now these slots can be used in the condition of the template as long as they also appear in the scope. Since we are not longer going with having user defined slots in the scope of the template, the only way to allow using the slots in the scope in the condition of the template will be to use ?principal and ?resource.

Issue #, if available

cedar-policy/rfcs#98

Checklist for requesting a review

The change in this PR is (choose one, and delete the other options):

A breaking change requiring a major version bump to cedar-policy (e.g., changes to the signature of an existing API).
A backwards-compatible change requiring a minor version bump to cedar-policy (e.g., addition of a new API).
A bug fix or other functionality change requiring a patch to cedar-policy.
A change "invisible" to users (e.g., documentation, changes to "internal" crates like cedar-policy-core, cedar-validator, etc.)
A change (breaking or otherwise) that only impacts unreleased or experimental code.

I confirm that this PR (choose one, and delete the other options):

Updates the "Unreleased" section of the CHANGELOG with a description of my change (required for major/minor version bumps).
Does not update the CHANGELOG because my change does not significantly impact released code.

I confirm that cedar-spec (choose one, and delete the other options):

Does not require updates because my change does not impact the Cedar formal model or DRT infrastructure.
Requires updates, and I have made / will make these updates myself. (Please include in your description a timeline or link to the relevant PR in cedar-spec, and how you have tested that your updates are correct.)
Requires updates, but I do not plan to make them in the near future. (Make sure that your changes are hidden behind a feature flag to mark them as experimental.)
I'm not sure how my change impacts cedar-spec. (Post your PR anyways, and we'll discuss in the comments.)

I confirm that docs.cedarpolicy.com (choose one, and delete the other options):

Does not require updates because my change does not impact the Cedar language specification.
Requires updates, and I have made / will make these updates myself. (Please include in your description a timeline or link to the relevant PR in cedar-docs. PRs should be targeted at a staging-X.Y branch, not main.)
I'm not sure how my change impacts the documentation. (Post your PR anyways, and we'll discuss in the comments.)

Signed-off-by: Alan Wang <[email protected]>

github-actions · 2025-07-29T15:30:10Z

Coverage Report

Head Commit: 4934e516578f3b9dde918a86040122bafade2c6e

Base Commit: 6760e58f3d29cbbe696d3806ac19d1354dafeaf9

Download the full coverage report.

Coverage of Added or Modified Lines of Rust Code

Required coverage: 80.00%

Actual coverage: 83.70%

Status: PASSED ✅

Details

File	Status	Covered	Coverage	Missed Lines
cedar-policy-core/src/est.rs	🟢	26/27	96.30%	326
cedar-policy-core/src/parser/cst_to_ast.rs	🟡	46/60	76.67%	353, 395-399, 448-451, 453, 455-456, 459
cedar-policy-core/src/parser/err.rs	🟢	5/5	100.00%

Coverage of All Lines of Rust Code

Required coverage: 80.00%

Actual coverage: 81.57%

Status: PASSED ✅

Details

Package	Status	Covered	Coverage	Base Coverage
cedar-language-server	🟢	4472/5180	86.33%	86.33%
cedar-policy	🔴	3098/4633	66.87%	66.87%
cedar-policy-cli	🔴	675/1054	64.04%	64.04%
cedar-policy-core	🟢	20561/24448	84.10%	84.09%
cedar-policy-formatter	🟢	928/1110	83.60%	83.60%
cedar-wasm	🔴	0/28	0.00%	0.00%

cedar-policy-core/src/est.rs

Signed-off-by: Alan Wang <[email protected]>

github-actions · 2025-07-29T21:38:45Z

Coverage Report

Head Commit: b0e6683aa878a0c41359c6ba0f68026eea15a208

Base Commit: 6760e58f3d29cbbe696d3806ac19d1354dafeaf9

Download the full coverage report.

Coverage of Added or Modified Lines of Rust Code

Required coverage: 80.00%

Actual coverage: 83.70%

Status: PASSED ✅

Details

File	Status	Covered	Coverage	Missed Lines
cedar-policy-core/src/est.rs	🟢	26/27	96.30%	326
cedar-policy-core/src/parser/cst_to_ast.rs	🟡	46/60	76.67%	353, 395-399, 448-451, 453, 455-456, 459
cedar-policy-core/src/parser/err.rs	🟢	5/5	100.00%

Coverage of All Lines of Rust Code

Required coverage: 80.00%

Actual coverage: 81.57%

Status: PASSED ✅

Details

Package	Status	Covered	Coverage	Base Coverage
cedar-language-server	🟢	4472/5180	86.33%	86.33%
cedar-policy	🔴	3104/4639	66.91%	66.87%
cedar-policy-cli	🔴	675/1054	64.04%	64.04%
cedar-policy-core	🟢	20571/24459	84.10%	84.09%
cedar-policy-formatter	🟢	928/1110	83.60%	83.60%
cedar-wasm	🔴	0/28	0.00%	0.00%

john-h-kastner-aws

noticed this which probably needs to change

cedar/cedar-policy-core/src/est.rs

Lines 159 to 162 in b0e6683

    
               pub fn has_slot(&self) -> bool { 
        
                   // currently, slots are not allowed in clauses 
        
                   false 
        
               }

cedar-policy-core/src/est.rs

cedar-policy-core/src/parser/cst_to_ast.rs

Signed-off-by: Alan Wang <[email protected]>

alanwang67 · 2025-07-30T16:55:06Z

noticed this which probably needs to change

cedar/cedar-policy-core/src/est.rs

Lines 159 to 162 in b0e6683

pub fn has_slot(&self) -> bool {

// currently, slots are not allowed in clauses

false

}

Thanks for pointing that out, just updated it.

cedar-policy-core/src/ast/policy.rs

github-actions · 2025-07-30T17:13:24Z

Coverage Report

Head Commit: 41804ab2f304ef343d5c9d581818f1f35ac8c24a

Base Commit: 6760e58f3d29cbbe696d3806ac19d1354dafeaf9

Download the full coverage report.

Coverage of Added or Modified Lines of Rust Code

Required coverage: 80.00%

Actual coverage: 63.91%

Status: FAILED ❌

Details

File	Status	Covered	Coverage	Missed Lines
cedar-policy-core/src/ast/policy.rs	🟢	18/18	100.00%
cedar-policy-core/src/est.rs	🟢	30/32	93.75%	162, 328
cedar-policy-core/src/est/expr.rs	🔴	9/54	16.67%	1067, 1070-1071, 1073-1074, 1077-1079, 1081-1082, 1084-1085, 1088-1093, 1095-1096, 1098-1099, 1101-1103, 1105-1106, 1109-1113, 1116-1121, 1123-1128, 1130
cedar-policy-core/src/parser/cst_to_ast.rs	🟡	46/60	76.67%	354, 396-400, 449-452, 454, 456-457, 460
cedar-policy-core/src/parser/err.rs	🟢	5/5	100.00%

Coverage of All Lines of Rust Code

Required coverage: 80.00%

Actual coverage: 81.49%

Status: PASSED ✅

Details

Package	Status	Covered	Coverage	Base Coverage
cedar-language-server	🟢	4472/5180	86.33%	--
cedar-policy	🔴	3104/4639	66.91%	--
cedar-policy-cli	🔴	675/1054	64.04%	--
cedar-policy-core	🟢	20602/24535	83.97%	--
cedar-policy-formatter	🟢	928/1110	83.60%	--
cedar-wasm	🔴	0/28	0.00%	--

Signed-off-by: Alan Wang <[email protected]>

github-actions · 2025-07-30T18:21:47Z

Coverage Report

Head Commit: 4a7e2f5b156c2a1b086c82de71fef5184e7a668d

Base Commit: 6760e58f3d29cbbe696d3806ac19d1354dafeaf9

Download the full coverage report.

Coverage of Added or Modified Lines of Rust Code

Required coverage: 80.00%

Actual coverage: 64.33%

Status: FAILED ❌

Details

File	Status	Covered	Coverage	Missed Lines
cedar-policy-core/src/ast/policy.rs	🟢	20/20	100.00%
cedar-policy-core/src/est.rs	🟢	30/32	93.75%	162, 328
cedar-policy-core/src/est/expr.rs	🔴	9/54	16.67%	1067, 1070-1071, 1073-1074, 1077-1079, 1081-1082, 1084-1085, 1088-1093, 1095-1096, 1098-1099, 1101-1103, 1105-1106, 1109-1113, 1116-1121, 1123-1128, 1130
cedar-policy-core/src/parser/cst_to_ast.rs	🟡	46/60	76.67%	354, 396-400, 449-452, 454, 456-457, 460
cedar-policy-core/src/parser/err.rs	🟢	5/5	100.00%

Coverage of All Lines of Rust Code

Required coverage: 80.00%

Actual coverage: 81.49%

Status: PASSED ✅

Details

Package	Status	Covered	Coverage	Base Coverage
cedar-language-server	🟢	4472/5180	86.33%	--
cedar-policy	🔴	3104/4639	66.91%	--
cedar-policy-cli	🔴	675/1054	64.04%	--
cedar-policy-core	🟢	20604/24537	83.97%	--
cedar-policy-formatter	🟢	928/1110	83.60%	--
cedar-wasm	🔴	0/28	0.00%	--

Signed-off-by: Alan Wang <[email protected]>

github-actions · 2025-07-30T20:49:42Z

Coverage Report

Head Commit: d2967dedcf2b769ed2da5673e39b841a3d133235

Base Commit: 6760e58f3d29cbbe696d3806ac19d1354dafeaf9

Download the full coverage report.

Coverage of Added or Modified Lines of Rust Code

Required coverage: 80.00%

Actual coverage: 44.71%

Status: FAILED ❌

Details

File	Status	Covered	Coverage	Missed Lines
cedar-policy-core/src/ast/policy.rs	🟢	20/20	100.00%
cedar-policy-core/src/est.rs	🟢	33/36	91.67%	144, 164, 330
cedar-policy-core/src/est/expr.rs	🔴	27/172	15.70%	886, 897, 899-900, 902-903, 905-907, 909-911, 917-919, 921-923, 925-927, 929-931, 933-935, 937-939, 941-943, 945-947, 949-951, 953-955, 957, 959-960, 963, 965-966, 969-970, 972-974, 976-978, 984-986, 988-990, 993-1000, 1003-1005, 1009-1011, 1013-1015, 1017-1020, 1022, 1024-1027, 1029, 1032-1034, 1036-1041, 1043, 1045, 1236, 1239-1240, 1242-1243, 1246-1248, 1250-1251, 1253-1254, 1257-1262, 1264-1265, 1267-1268, 1270-1272, 1274-1275, 1278-1282, 1285-1290, 1292-1297, 1299
cedar-policy-core/src/parser/cst_to_ast.rs	🟡	46/60	76.67%	354, 396-400, 449-452, 454, 456-457, 460
cedar-policy-core/src/parser/err.rs	🟢	5/5	100.00%

Coverage of All Lines of Rust Code

Required coverage: 80.00%

Actual coverage: 81.28%

Status: PASSED ✅

Details

Package	Status	Covered	Coverage	Base Coverage
cedar-language-server	🟢	4472/5180	86.33%	--
cedar-policy	🔴	3104/4639	66.91%	--
cedar-policy-cli	🔴	675/1054	64.04%	--
cedar-policy-core	🟢	20623/24657	83.64%	--
cedar-policy-formatter	🟢	928/1110	83.60%	--
cedar-wasm	🔴	0/28	0.00%	--

Signed-off-by: Alan Wang <[email protected]>

github-actions · 2025-07-31T03:09:38Z

Coverage Report

Head Commit: 538b81e9792b9ac98280a4b4e53c8f8682c65e02

Base Commit: 6760e58f3d29cbbe696d3806ac19d1354dafeaf9

Download the full coverage report.

Coverage of Added or Modified Lines of Rust Code

Required coverage: 80.00%

Actual coverage: 77.47%

Status: FAILED ❌

Details

File	Status	Covered	Coverage	Missed Lines
cedar-policy-core/src/ast/policy.rs	🟢	20/20	100.00%
cedar-policy-core/src/est.rs	🟢	33/36	91.67%	144, 164, 330
cedar-policy-core/src/est/expr.rs	🟡	123/172	71.51%	897, 1032-1034, 1236, 1239-1240, 1242-1243, 1246-1248, 1250-1251, 1253-1254, 1257-1262, 1264-1265, 1267-1268, 1270-1272, 1274-1275, 1278-1282, 1285-1290, 1292-1297, 1299
cedar-policy-core/src/parser/cst_to_ast.rs	🟡	46/60	76.67%	354, 396-400, 449-452, 454, 456-457, 460
cedar-policy-core/src/parser/err.rs	🟢	5/5	100.00%

Coverage of All Lines of Rust Code

Required coverage: 80.00%

Actual coverage: 81.53%

Status: PASSED ✅

Details

Package	Status	Covered	Coverage	Base Coverage
cedar-language-server	🟢	4472/5180	86.33%	--
cedar-policy	🔴	3104/4639	66.91%	--
cedar-policy-cli	🔴	675/1054	64.04%	--
cedar-policy-core	🟢	20718/24657	84.02%	--
cedar-policy-formatter	🟢	928/1110	83.60%	--
cedar-wasm	🔴	0/28	0.00%	--

alanwang67 added 2 commits July 29, 2025 09:59

slots in the condition of template

3149180

Signed-off-by: Alan Wang <[email protected]>

fixed + added testcases

4934e51

Signed-off-by: Alan Wang <[email protected]>

cdisselkoen approved these changes Jul 29, 2025

View reviewed changes

cedar-policy-core/src/est.rs Show resolved Hide resolved

alanwang67 added 2 commits July 29, 2025 16:15

improved comments

e3a96b5

Signed-off-by: Alan Wang <[email protected]>

fmt

b0e6683

Signed-off-by: Alan Wang <[email protected]>

john-h-kastner-aws reviewed Jul 30, 2025

View reviewed changes

cedar-policy-core/src/est.rs Outdated Show resolved Hide resolved

cedar-policy-core/src/parser/cst_to_ast.rs Show resolved Hide resolved

added has_slot for est & refactored

41804ab

Signed-off-by: Alan Wang <[email protected]>

john-h-kastner-aws reviewed Jul 30, 2025

View reviewed changes

cedar-policy-core/src/ast/policy.rs Outdated Show resolved Hide resolved

added missing match arm

4a7e2f5

Signed-off-by: Alan Wang <[email protected]>

added linking with slots in the condition for the EST data structure

d2967de

Signed-off-by: Alan Wang <[email protected]>

added test cases for filling in est slot

538b81e

Signed-off-by: Alan Wang <[email protected]>

alanwang67 mentioned this pull request Jul 31, 2025

Internal data structures for Generalized templates #1732

Open

14 tasks

john-h-kastner-aws mentioned this pull request Sep 18, 2025

Improve precision when typechecking in #105

Open

2 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Allow principal resource slots in condition #1722

Allow principal resource slots in condition #1722

Uh oh!

alanwang67 commented Jul 29, 2025

Uh oh!

github-actions bot commented Jul 29, 2025

Uh oh!

Uh oh!

github-actions bot commented Jul 29, 2025

Uh oh!

john-h-kastner-aws left a comment

Uh oh!

Uh oh!

Uh oh!

alanwang67 commented Jul 30, 2025

Uh oh!

Uh oh!

github-actions bot commented Jul 30, 2025

Uh oh!

github-actions bot commented Jul 30, 2025

Uh oh!

github-actions bot commented Jul 30, 2025

Uh oh!

github-actions bot commented Jul 31, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	pub fn has_slot(&self) -> bool {
	// currently, slots are not allowed in clauses
	false
	}

Allow principal resource slots in condition #1722

Are you sure you want to change the base?

Allow principal resource slots in condition #1722

Uh oh!

Conversation

alanwang67 commented Jul 29, 2025

Description of changes

Issue #, if available

Checklist for requesting a review

Uh oh!

github-actions bot commented Jul 29, 2025

Coverage Report

Coverage of Added or Modified Lines of Rust Code

Coverage of All Lines of Rust Code

Uh oh!

Uh oh!

github-actions bot commented Jul 29, 2025

Coverage Report

Coverage of Added or Modified Lines of Rust Code

Coverage of All Lines of Rust Code

Uh oh!

john-h-kastner-aws left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

alanwang67 commented Jul 30, 2025

Uh oh!

Uh oh!

github-actions bot commented Jul 30, 2025

Coverage Report

Coverage of Added or Modified Lines of Rust Code

Coverage of All Lines of Rust Code

Uh oh!

github-actions bot commented Jul 30, 2025

Coverage Report

Coverage of Added or Modified Lines of Rust Code

Coverage of All Lines of Rust Code

Uh oh!

github-actions bot commented Jul 30, 2025

Coverage Report

Coverage of Added or Modified Lines of Rust Code

Coverage of All Lines of Rust Code

Uh oh!

github-actions bot commented Jul 31, 2025

Coverage Report

Coverage of Added or Modified Lines of Rust Code

Coverage of All Lines of Rust Code

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants