Release 4.13.0, available on crates.io

Changed

• *A has expression with a chain of attributes (e has a.b.c) now converts to JSON as a
  single has node whose attr field is an array (["a", "b", "c"]), instead of a
  conjunction of one-attribute has checks ((e has a) && (e.a has b) && (e.a.b has c)).
  A single-attribute has still converts with attr as a string. The evaluation result is
  unchanged (#2560).
• Invalid action application errors ("Unable to find an applicable action given the policy scope constraints")
  are now reported as validation warnings instead of errors. These do not indicate that a run-time
  error may exist in the policy. They are similar to the impossible policy warning, indicating that a policy
  cannot apply to any request. This change makes it possible to remove entries from an appliesTo list
  without introducing validation errors. Callers that want to keep rejecting these policies should check
  ValidationResult::validation_warnings for ValidationWarning::InvalidActionApplication (#2545).
• For the tpe experimental feature, is_authorized_batched now automatically loads actions
  entities from the schema, and will now return immediately on reaching a concrete authorization decision (#2554).
• For the tpe experimental feature, removed the BatchedEvalError::MissingEntities error variant
  which was never constructed (#2554).
• For the tpe experimental feature, PolicySet::tpe is faster on large policy sets
  (~1.4x on a 25,000-policy set) (#2558).

Fixed

• Fixed Policy::try_into_pst() and Template::try_into_pst() to preserve policy IDs for text- and JSON-backed values, restoring PolicySet::try_into_pst() / PolicySet::from_pst() round trips (#2543).
• In the experimental protobufs feature, the Schema::decode function now accepts schemas that reference Action entity types not defined in the schema. This was previously rejected (#2491).
• For the experimental tpe feature, fixed TpeResponse::policy_set to return the residual policies, matching TpeResponse::policies as documented. Previously it returned the original policies (#2540).
• For the experimental tpe feature, partial entity validation now accept action entities with unknown components. The UnknownActionComponent is now never returned and is deleted (#2555).

Release 0.7.0 of cedar-policy-symcc, available on crates.io

Added

• ResetMode and CedarSymCompiler::with_reset_mode(), controlling whether the (reset)
  at the start of each query is emitted as an SMTLib command (ResetMode::Emit, the
  default and previous behavior) or as a comment (ResetMode::Comment). The latter is for
  Solver implementations that send each query as a standalone script, where a real
  (reset) is unnecessary and hides accidental reuse of a solver session.

Changed

• The emitted SMT-LIB now names each entity type's eid selector after the entity type
  (E_eid instead of eid). SMT-LIB requires selector names to be unique across all
  datatypes, although solvers typically support the old naming scheme (#2529).

Install cedar-policy-cli 4.13.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/cedar-policy/cedar/releases/download/cedar-policy-cli-v4.13.0/cedar-policy-cli-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/cedar-policy/cedar/releases/download/cedar-policy-cli-v4.13.0/cedar-policy-cli-installer.ps1 | iex"

Download cedar-policy-cli 4.13.0

Release 4.12.0, available on crates.io

Fixed

• Fixed schema_to_json_with_resolved_types to support converting schemas that use the Action entity type as an attribute type.
  Previously this was reported as an error; it now converts to a correct JSON schema. (#2400)
• Added missing validation check when decoding a protobuf policy set that template-linked policy IDs do not collide with template IDs. (#2441)
• PolicySet::from_pst now returns an error if a map key doesn't match the id of its corresponding template or policy, instead of silently accepting the malformed input (#2444).
• For the experimental tpe feature, fixed PartialEntities::from_json_value to return an error given two entities with duplicate ids.
• Fixed issue where the derived implementations of Ord and PartialOrd for EntityUids did not order instances lexicographically by type, then by entity id (#2463, #2483).

Added

• Public syntax tree (pst) support for variadic-is-in-range feature: a variadic isInRange is modelled by a pst::Expr::VariadicOp{...} in the PST (#2380).
• For the experimental tpe feature, added functions for inspecting partial evaluation results. Adds TpeResponse::reason to get the ids for policies
  contributing to the authorization decision, and specific iterators to list true/false/error/residual permit/forbid policy IDs. Also adds TpeResponse::get_policy
  to lookup a partially evaluated policy by id, and TpeResponse::policy_set to retrieve all partial evaluated policies as a PolicySet.

Changed

• The experimental protobuf encode method now returns Result<Vec<u8>, EncodeError> instead of Vec<u8>. Encoding rejects expressions and schema types whose nesting depth would exceed prost's decode recursion limit, returning EncodeError::MaxDepthExceeded. This prevents a class of bugs where successfully encoded data could not be decoded.
• The experimental protobuf decoding API now validates its inputs, checking structural invariants on entities, expressions, templates, policy sets, and schemas. Additionally, Entities::decode now computes the transitive closure instead of assuming it is already computed. These changes may result in lower performance for protobuf decoding. The previous, unvalidated behavior is available via the new decode_unchecked methods (e.g., Entities::decode_unchecked) for trusted encoded data.
• For the experimental tpe feature, TpeResponse::residual_policies is updated to return only non-trivial residuals and
  TpeResponse::nontrivial_residual_policies is deprecated. The previous behavior (iterating all residuals including trivial ones)
  is available via TpeResponse::policies.
• Validating policies with Validator against a Schema with a large action set now uses substantially less peak memory and avoids redundant per-request work, especially under concurrent load. (#2439)

Release 0.6.0 of cedar-policy-symcc, available on crates.io

Added

• CompiledSchema type that precomputes symbolic entities once per schema and produces
  SymEnv instances via sym_env(), avoiding expensive per-environment rebuilds.

Fixed

• Fix errors decoding models from Z3. The model decoder now accepts hexadecimal bitvectors
  in solver output (e.g., #xff). It also handles an option literal none
  without an explicit type annotation, as long as it can infer the type. Finally, it accepts
  models for UUFs with equality operands in either order.
• Fix errors decoding models for entities with Bool typed tags.

Install cedar-policy-cli 4.12.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/cedar-policy/cedar/releases/download/cedar-policy-cli-v4.12.0/cedar-policy-cli-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/cedar-policy/cedar/releases/download/cedar-policy-cli-v4.12.0/cedar-policy-cli-installer.ps1 | iex"

Download cedar-policy-cli 4.12.0

Release 3.4.3, available on crates.io

Fixed

• Slot identifiers are now checked for JSON policy templates using slots in is Type in ?slot scope constraints. Loading a JSON format policy using principal is Type in ?resource or resource is Type in ?principal. (#2351)

Fixed

• Fixed transitive closure computation for schemas with cyclic entity type hierarchies of length ≥ 3 (introduced in 4.11.0).

Full Changelog: v4.11.1...v4.11.2

Full Changelog: cedar-policy-symcc-v0.5.2...cedar-policy-symcc-v0.5.3

Release 0.5.2 of cedar-policy-symcc, available on crates.io