feat: implement rfc 104 cedar entity syntax

cedar-policy-cli/CHANGELOG.md

@@ -10,6 +10,8 @@ Changes to the Cedar language, which are likely to affect users of the CLI, are
 - `cedar license` subcommand printing the project license and bundled third-party attributions.
 - Pre-built `cedar` binaries on GitHub releases for Linux (x86_64, aarch64), macOS (x86_64, aarch64), and Windows (x86_64), built via cargo-dist on `cedar-policy-cli-v*` tags.
 - Experimental archive `cedar-policy-cli-experimental-<target>` with `tpe` and `analyze` (`cedar symcc`) enabled. The `symcc` subcommands additionally require [cvc5](https://github.com/cvc5/cvc5) installed at runtime.
+- For the experimental `cedar-entity-syntax` feature, added `--entities-format cedar` option to load
+  entity data in the human-readable Cedar syntax instead of JSON.
 
 ### Changed
 

cedar-policy-cli/Cargo.toml

@@ -26,11 +26,12 @@ tokio = { version = "1.52", features = ["rt-multi-thread"], optional = true }
 
 [features]
 default = []
-experimental = ["permissive-validate", "partial-validate", "partial-eval", "tpe"]
+experimental = ["permissive-validate", "partial-validate", "partial-eval", "tpe", "cedar-entity-syntax"]
 permissive-validate = ["cedar-policy/permissive-validate"]
 partial-validate = ["cedar-policy/partial-validate"]
 partial-eval = ["cedar-policy/partial-eval"]
 tpe = ["cedar-policy/tpe", "cedar-policy/partial-eval"]
+cedar-entity-syntax = ["cedar-policy/cedar-entity-syntax"]
 analyze = ["dep:cedar-policy-symcc", "dep:tokio", "dep:itertools"]
 
 [dev-dependencies]

cedar-policy-cli/src/command/authorize.rs

@@ -14,13 +14,13 @@
  * limitations under the License.
  */
 
-use std::{path::Path, time::Instant};
+use std::time::Instant;
 
 use cedar_policy::{Authorizer, Decision, Entities, PolicySet, Response};
 use clap::Args;
 use miette::Report;
 
-use crate::{load_entities, CedarExitCode, OptionalSchemaArgs, PoliciesArgs, RequestArgs};
+use crate::{CedarExitCode, EntitiesArgs, OptionalSchemaArgs, PoliciesArgs, RequestArgs};
 
 #[derive(Args, Debug)]
 pub struct AuthorizeArgs {
@@ -36,9 +36,9 @@ pub struct AuthorizeArgs {
     /// parsing of entity hierarchy, if present
     #[command(flatten)]
     pub schema: OptionalSchemaArgs,
-    /// File containing JSON representation of the Cedar entity hierarchy
-    #[arg(long = "entities", value_name = "FILE")]
-    pub entities_file: String,
+    /// Entities args (incorporated by reference)
+    #[command(flatten)]
+    pub entities: EntitiesArgs,
     /// More verbose output. (For instance, indicate which policies applied to the request, if any.)
     #[arg(short, long)]
     pub verbose: bool,
@@ -52,7 +52,7 @@ pub fn authorize(args: &AuthorizeArgs) -> CedarExitCode {
     let ans = execute_request(
         &args.request,
         &args.policies,
-        &args.entities_file,
+        &args.entities,
         &args.schema,
         args.timing,
     );
@@ -101,7 +101,7 @@ pub fn authorize(args: &AuthorizeArgs) -> CedarExitCode {
 fn execute_request(
     request: &RequestArgs,
     policies: &PoliciesArgs,
-    entities_filename: impl AsRef<Path>,
+    entities: &EntitiesArgs,
     schema: &OptionalSchemaArgs,
     compute_duration: bool,
 ) -> Result<Response, Vec<Report>> {
@@ -120,7 +120,7 @@ fn execute_request(
             None
         }
     };
-    let entities = match load_entities(entities_filename, schema.as_ref()) {
+    let entities = match entities.get_entities(schema.as_ref()) {
         Ok(entities) => entities,
         Err(e) => {
             errs.push(e);

cedar-policy-cli/src/command/check_parse.rs

@@ -14,13 +14,15 @@
  * limitations under the License.
  */
 
-use std::{path::PathBuf, str::FromStr};
+use std::str::FromStr;
 
 use cedar_policy::Expression;
 use clap::Args;
 use miette::Report;
 
-use crate::{load_entities, CedarExitCode, OptionalPoliciesArgs, OptionalSchemaArgs, PoliciesArgs};
+use crate::{
+    CedarExitCode, OptionalEntitiesArgs, OptionalPoliciesArgs, OptionalSchemaArgs, PoliciesArgs,
+};
 
 #[derive(Args, Debug)]
 pub struct CheckParseArgs {
@@ -33,17 +35,17 @@ pub struct CheckParseArgs {
     /// Schema args (incorporated by reference)
     #[command(flatten)]
     pub schema: OptionalSchemaArgs,
-    /// File containing JSON representation of a Cedar entity hierarchy
-    #[arg(long = "entities", value_name = "FILE")]
-    pub entities_file: Option<PathBuf>,
+    /// Entities args (incorporated by reference)
+    #[command(flatten)]
+    pub entities: OptionalEntitiesArgs,
 }
 
 pub fn check_parse(args: &CheckParseArgs) -> CedarExitCode {
     // for backwards compatibility: if no policies/schema/entities/expression
     // are provided, read policies from stdin and check that they parse
     if args.policies.policies_file.is_none()
         && args.schema.schema_file.is_none()
-        && args.entities_file.is_none()
+        && args.entities.entities_file.is_none()
         && args.expression.is_none()
     {
         let pargs = PoliciesArgs {
@@ -85,11 +87,7 @@ pub fn check_parse(args: &CheckParseArgs) -> CedarExitCode {
             None
         }
     };
-    if let Some(e) = args
-        .entities_file
-        .as_ref()
-        .and_then(|e| load_entities(e, schema.as_ref()).err())
-    {
+    if let Some(e) = args.entities.get_entities(schema.as_ref()).err() {
         println!("{e:?}");
         exit_code = CedarExitCode::Failure;
     }

cedar-policy-cli/src/command/evaluate.rs

@@ -19,7 +19,7 @@ use clap::Args;
 use miette::WrapErr;
 use std::str::FromStr;
 
-use crate::{load_entities, CedarExitCode, OptionalSchemaArgs, RequestArgs};
+use crate::{CedarExitCode, OptionalEntitiesArgs, OptionalSchemaArgs, RequestArgs};
 
 #[derive(Args, Debug)]
 pub struct EvaluateArgs {
@@ -32,10 +32,10 @@ pub struct EvaluateArgs {
     /// parsing of entity hierarchy, if present
     #[command(flatten)]
     pub schema: OptionalSchemaArgs,
-    /// File containing JSON representation of the Cedar entity hierarchy.
+    /// Entities args (incorporated by reference).
     /// This is optional; if not present, we'll just use an empty hierarchy.
-    #[arg(long = "entities", value_name = "FILE")]
-    pub entities_file: Option<String>,
+    #[command(flatten)]
+    pub entities: OptionalEntitiesArgs,
     /// Expression to evaluate
     #[arg(value_name = "EXPRESSION")]
     pub expression: String,
@@ -65,15 +65,13 @@ pub fn evaluate(args: &EvaluateArgs) -> (CedarExitCode, EvalResult) {
                 return (CedarExitCode::Failure, EvalResult::Bool(false));
             }
         };
-    let entities = match &args.entities_file {
-        None => Entities::empty(),
-        Some(file) => match load_entities(file, schema.as_ref()) {
-            Ok(entities) => entities,
-            Err(e) => {
-                println!("{e:?}");
-                return (CedarExitCode::Failure, EvalResult::Bool(false));
-            }
-        },
+    let entities = match args.entities.get_entities(schema.as_ref()) {
+        Ok(Some(entities)) => entities,
+        Ok(None) => Entities::empty(),
+        Err(e) => {
+            println!("{e:?}");
+            return (CedarExitCode::Failure, EvalResult::Bool(false));
+        }
     };
     match eval_expression(&request, &entities, &expr).wrap_err("failed to evaluate the expression")
     {

cedar-policy-cli/src/command/partial_eval.rs

@@ -21,12 +21,12 @@
 use clap::Args;
 use miette::{IntoDiagnostic, Report, Result, WrapErr};
 use serde::Deserialize;
-use std::{path::Path, time::Instant};
+use std::time::Instant;
 
 use cedar_policy::*;
 
 use crate::CedarExitCode;
-use crate::{load_entities, OptionalSchemaArgs, PoliciesArgs};
+use crate::{EntitiesArgs, OptionalSchemaArgs, PoliciesArgs};
 
 #[derive(Args, Debug)]
 pub struct PartiallyAuthorizeArgs {
@@ -42,9 +42,9 @@ pub struct PartiallyAuthorizeArgs {
     /// parsing of entity hierarchy, if present
     #[command(flatten)]
     pub schema: OptionalSchemaArgs,
-    /// File containing JSON representation of the Cedar entity hierarchy
-    #[arg(long = "entities", value_name = "FILE")]
-    pub entities_file: String,
+    /// Entities args (incorporated by reference)
+    #[command(flatten)]
+    pub entities: EntitiesArgs,
     /// Time authorization and report timing information
     #[arg(short, long)]
     pub timing: bool,
@@ -186,7 +186,7 @@ pub fn partial_authorize(args: &PartiallyAuthorizeArgs) -> CedarExitCode {
     let ans = execute_partial_request(
         &args.request,
         &args.policies,
-        &args.entities_file,
+        &args.entities,
         &args.schema,
         args.timing,
     );
@@ -221,7 +221,7 @@ pub fn partial_authorize(args: &PartiallyAuthorizeArgs) -> CedarExitCode {
 fn execute_partial_request(
     request: &PartialRequestArgs,
     policies: &PoliciesArgs,
-    entities_filename: impl AsRef<Path>,
+    entities: &EntitiesArgs,
     schema: &OptionalSchemaArgs,
     compute_duration: bool,
 ) -> Result<PartialResponse, Vec<Report>> {
@@ -240,7 +240,7 @@ fn execute_partial_request(
             None
         }
     };
-    let entities = match load_entities(entities_filename, schema.as_ref()) {
+    let entities = match entities.get_entities(schema.as_ref()) {
         Ok(entities) => entities,
         Err(e) => {
             errs.push(e);

cedar-policy-cli/src/command/visualize.rs

@@ -16,16 +16,17 @@
 
 use clap::Args;
 
-use crate::{load_entities, CedarExitCode};
+use crate::{CedarExitCode, EntitiesArgs};
 
 #[derive(Args, Debug)]
 pub struct VisualizeArgs {
-    #[arg(long = "entities", value_name = "FILE")]
-    pub entities_file: String,
+    /// Entities args (incorporated by reference)
+    #[command(flatten)]
+    pub entities: EntitiesArgs,
 }
 
 pub fn visualize(args: &VisualizeArgs) -> CedarExitCode {
-    match load_entities(&args.entities_file, None) {
+    match args.entities.get_entities(None) {
         Ok(entities) => {
             println!("{}", entities.to_dot_str());
             CedarExitCode::Success

cedar-policy-cli/src/utils.rs

@@ -26,7 +26,7 @@ pub use request::*;
 mod schema;
 pub use schema::*;
 mod entities;
-pub(crate) use entities::*;
+pub use entities::*;
 
 // Read from a file (when `filename` is a `Some`) or stdin (when `filename` is `None`) to a `String`
 pub(crate) fn read_from_file_or_stdin(