Warning This project is experimental and is not recommended for use
This project was an experimental project to understand the complexity of the Cedar policy language. The project is incomplete and doesn't feature the automated reasoning guarantees that the official engine has. For use in a production context, consume the official engine directly or via one of the bindings.
A Cedar policy language lexer, parser & evaluator.
go get github.com/iann0036/polaiPlease add -u flag to update in the future.
package main
import (
"fmt"
"strings"
"github.com/iann0036/polai"
)
func main() {
e := polai.NewEvaluator(strings.NewReader(`
permit (
principal,
action,
resource == Folder::"My Folder"
) when {
context.ssl == true
};`))
result, _ := e.Evaluate(`User::"alice"`, `Action::"listFiles"`, `Folder::"My Folder"`, `{
"ssl": true
}`)
if result {
fmt.Println("Authorized")
} else {
fmt.Println("Not Authorized")
}
}package main
import (
"fmt"
"strings"
"github.com/iann0036/polai"
)
func main() {
e := polai.NewEvaluator(strings.NewReader(`
permit (
principal,
action,
resource == Folder::"My Folder"
) when {
if context.ssl == true && principal.hasTraining
then true
else principal.invalidproperty
};`))
e.AllowShortCircuiting = true // evaluation will fail when set to false
e.SetEntities(strings.NewReader(`
[
{
"uid": "User::\"alice\"",
"attrs": {
"hasTraining": true
}
},
{
"uid": "User::\"kate\"",
"attrs": {
"hasTraining": false
}
}
]`))
result, _ := e.Evaluate(`User::"alice"`, `Action::"listFiles"`, `Folder::"My Folder"`, `{
"ssl": true
}`)
if result {
fmt.Println("Authorized")
} else {
fmt.Println("Not Authorized")
}
}- Policy language interpreter
- Basic permit and forbid evaluation logic
- Equality / inequality operator within
principal,action, andresourcewithin the scope block - Inheritance (
in) within scope block - Basic set (
in) foractionwithin scope block - Basic when and unless evaluation logic
- Logical operators for basic types (string, long, boolean) within condition block
- Entity store interpreter
- Inheritance (
in) within condition block - Entity attributes evaluation
- IP and Decimal extensions
- Context object
- Set operations
-
hasoperation - Logical not
!operation -
likeoperator - if-then-else ternary
- Enforce
Action::namespace for actions -
&&and||short-circuiting -
if-then-elseshort-circuiting - Embedded
if-then-else - 4x limit on unary
- Syntactic constraint on multiply operator
- Anonymous records / sets
-
__entity/__extnsyntax in context / entities - Policy templates
This project is under MIT license. See the LICENSE file for the full license text.