cedar

Module: cedar

Contents

Structs

• PolicyFiles
• ValidationError

Enums

• FirmaEntityUid - A typed Cedar entity UID in the Firma namespace.
• ResourceEntityError - Failure building a resource [Entity] with attributes.

Functions

• validate_policies - Strictly validate a parsed Cedar policy set against a schema.

Constants

• FIRMA_SCHEMA - Canonical Firma Cedar schema, embedded at compile time.

---

firma_core::cedar::FIRMA_SCHEMA

Constant: &str

Canonical Firma Cedar schema, embedded at compile time.

This is the single source of truth for the Cedar schema shared between the Authority (issuance) and the Sidecar (enforcement). Operators who extend the action registry can override the schema at runtime by configuring an explicit schema_path in the Authority config.

firma_core::cedar::FirmaEntityUid

Enum

A typed Cedar entity UID in the Firma namespace.

Variants:

• Agent(firma_identifiers::AgentId)
• Action(String)
• Resource(String)

Methods:

• fn resource_entity(resource: &str) -> Result<Entity, ResourceEntityError> - Build a Cedar [Entity] for the request resource, populating the

Trait Implementations:

• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Clone
  • fn clone(self: &Self) -> FirmaEntityUid

firma_core::cedar::PolicyFiles

Struct

Tuple Struct: ()

Methods:

• fn push(self: & mut Self, path: PathBuf, content: String)
• fn is_empty(self: &Self) -> bool
• fn concat(self: &Self) -> String

Trait Implementations:

• Default
  • fn default() -> PolicyFiles
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Clone
  • fn clone(self: &Self) -> PolicyFiles

firma_core::cedar::ResourceEntityError

Enum

Failure building a resource [Entity] with attributes.

Variants:

• Uid(cedar_policy::ParseErrors) - The resource UID string failed to parse into a Cedar entity type name.
• Attr(Box<cedar_policy::EntityAttrEvaluationError>) - Cedar rejected the resource entity’s attribute record.

Trait Implementations:

• Display
  • fn fmt(self: &Self, __formatter: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• From
  • fn from(source: cedar_policy::ParseErrors) -> Self
• Error
  • fn source(self: &Self) -> ::core::option::Option<&dyn ::thiserror::__private18::Error>

firma_core::cedar::ValidationError

Struct

Tuple Struct: ()

Traits: Error

Trait Implementations:

• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Display
  • fn fmt(self: &Self, f: & mut fmt::Formatter) -> fmt::Result

firma_core::cedar::validate_policies

Function

Strictly validate a parsed Cedar policy set against a schema.

Runs Cedar’s strict validation and returns every validation error as a human-readable string. An empty policy set is valid. The Authority’s bundle loader calls this to fail closed on an invalid bundle, applying the same strict-validation contract that the offline firma policy validate CLI enforces (the CLI runs the equivalent strict check separately so it can render located miette diagnostics).

Errors

Returns Err(messages) with one entry per validation error when the policy set does not strictly type-check against schema. Validation warnings are not treated as errors.

fn validate_policies(policies: &cedar_policy::PolicySet, schema: &cedar_policy::Schema, policy_files: Option<&PolicyFiles>) -> Result<(), ValidationError>