ast

func Annotation ¶

func Annotation(key types.Ident, value types.String) *Annotations

Annotation allows AST constructors to make policy in a similar shape to textual Cedar with annotations appearing before the actual policy scope:

ast := Annotation("foo", "bar").
    Annotation("baz", "quux").
	Permit().
	PrincipalEq(superUser)

func Action ¶

func Action() Node

Action represents the action in the request

func Boolean ¶

func Boolean[T ~bool](b T) Node

Boolean creates a value node containing a Boolean.

func Context ¶

func Context() Node

Context represents the context in the request

func Datetime ¶ added in v1.0.0

func Datetime(t time.Time) Node

Datetime creates a value node containing a timestamp

func DatetimeExtensionCall ¶ added in v1.0.0

func DatetimeExtensionCall(rhs Node) Node

DatetimeExtensionCall wraps a node with the cedar `datetime()` extension call

func DecimalExtensionCall ¶ added in v1.0.0

func DecimalExtensionCall(rhs Node) Node

DecimalExtensionCall wraps a node with the cedar `decimal()` extension call

func Duration ¶ added in v1.0.0

func Duration(d time.Duration) Node

Duration creates a value node containing a duration

func DurationExtensionCall ¶ added in v1.0.0

func DurationExtensionCall(rhs Node) Node

DurationExtensionCall wraps a node with the cedar `duration()` extension call

func EntityUID ¶

func EntityUID(typ types.Ident, id types.String) Node

EntityUID creates a value node containing an EntityUID.

func False ¶

func False() Node

False creates a value node containing False.

func IPAddr ¶

func IPAddr[T netip.Prefix | types.IPAddr](i T) Node

IPAddr creates a value node containing an IPAddr.

func IPExtensionCall ¶ added in v1.0.0

func IPExtensionCall(rhs Node) Node

IPExtensionCall wraps a node with the cedar `ip()` extension call

func IfThenElse ¶

func IfThenElse(condition Node, thenNode Node, elseNode Node) Node

IfThenElse builds an AST node representing the if (CONDITIONAL) operator

func Long ¶

func Long[T ~int | ~int64](l T) Node

Long creates a value node containing a Long.

func Negate ¶

func Negate(rhs Node) Node

Negate builds an AST node representing the ! operator

func Not ¶

func Not(rhs Node) Node

Not builds an AST node representing the ! operator

func Principal ¶

func Principal() Node

Principal represents the principal in the request

func Record ¶

func Record(elements Pairs) Node

Record creates a record node. In the case where duplicate keys exist, the latter value will be preserved.

package main

import (
	"fmt"

	"github.com/cedar-policy/cedar-go/ast"
	"github.com/cedar-policy/cedar-go/types"
)

func main() {
	// Literal records can be constructed and passed via the ast.Value() builder
	literalRecord := types.NewRecord(types.RecordMap{
		"x": types.String("value1"),
		"y": types.String("value2"),
	})

	// Records with internal expressions are constructed via the ast.Record() builder
	exprRecord := ast.Record(ast.Pairs{
		{
			Key:   "x",
			Value: ast.Long(1).Add(ast.Context().Access("fooCount")),
		},
		{
			Key:   "y",
			Value: ast.Long(8),
		},
	})

	policy := ast.Forbid().
		When(
			ast.Value(literalRecord).Access("x").Equal(ast.String("value1")),
		).
		When(
			exprRecord.Access("x").Equal(ast.Long(3)),
		)

	fmt.Println(string(policy.MarshalCedar()))

}

Output:

forbid ( principal, action, resource )
when { {"x":"value1", "y":"value2"}.x == "value1" }
when { {"x":(1 + context.fooCount), "y":8}.x == 3 };

func Resource ¶

func Resource() Node

Resource represents the resource in the request

func Set ¶

func Set(nodes ...Node) Node

Set allows for a complex set definition with values potentially being Cedar expressions of their own. For example, this Cedar text:

[1, 2 + 3, context.fooCount]

could be expressed in Golang as:

ast.Set(
    ast.Long(1),
    ast.Long(2).Plus(ast.Long(3)),
    ast.Context().Access("fooCount"),
)

func String ¶

func String[T ~string](s T) Node

String creates a value node containing a String.

func True ¶

func True() Node

True creates a value node containing True.

func Value ¶

func Value(v types.Value) Node

Value creates a value node from any value.

func Forbid ¶

func Forbid() *Policy

Forbid creates a new Forbid policy.

func Permit ¶

func Permit() *Policy

Permit creates a new Permit policy.