Skip to content

remove LiteralPolicy for proto and merge validation steps#2475

Open
victornicolet wants to merge 4 commits into
mainfrom
victornicolet/refactor-protobuf-policyset-validation-part-2
Open

remove LiteralPolicy for proto and merge validation steps#2475
victornicolet wants to merge 4 commits into
mainfrom
victornicolet/refactor-protobuf-policyset-validation-part-2

Conversation

@victornicolet

@victornicolet victornicolet commented Jul 14, 2026

Copy link
Copy Markdown
Member

Description of changes

This part 2 of #2469:

  • removes the LiteralPolicySet struct that was used as an intermediate between models::PolicySet and ast::PolicySet.
  • merges the validation steps for PolicySet that were copy-pasted in the previous PR,
  • merges the validation steps for Policy that were separated by LiteralPolicy.

The Policy invariants on slot well formedness is now entirely in the Template to Policy conversion (try_as_policy enforces the same as link of ast::Template).

Issue #, if available

Checklist for requesting a review

The change in this PR is (choose one, and delete the other options):

  • A breaking change requiring a major version bump to cedar-policy (e.g., changes to the signature of an existing API).
  • A backwards-compatible change requiring a minor version bump to cedar-policy (e.g., addition of a new API).
  • A bug fix or other functionality change requiring a patch to cedar-policy.
  • A change "invisible" to users (e.g., documentation, changes to "internal" crates like cedar-policy-core, cedar-validator, etc.)
  • [] A change (breaking or otherwise) that only impacts unreleased or experimental code.

I confirm that this PR (choose one, and delete the other options):

  • Updates the "Unreleased" section of the CHANGELOG with a description of my change (required for major/minor version bumps).
  • Does not update the CHANGELOG because my change does not significantly impact released code.

I confirm that cedar-spec (choose one, and delete the other options):

  • Does not require updates because my change does not impact the Cedar formal model or DRT infrastructure.
  • Requires updates, and I have made / will make these updates myself. (Please include in your description a timeline or link to the relevant PR in cedar-spec, and how you have tested that your updates are correct.)
  • Requires updates, but I do not plan to make them in the near future. (Make sure that your changes are hidden behind a feature flag to mark them as experimental.)
  • I'm not sure how my change impacts cedar-spec. (Post your PR anyways, and we'll discuss in the comments.)

I confirm that docs.cedarpolicy.com (choose one, and delete the other options):

  • Does not require updates because my change does not impact the Cedar language specification.
  • Requires updates, and I have made / will make these updates myself. (Please include in your description a timeline or link to the relevant PR in cedar-docs. PRs should be targeted at a staging-X.Y branch, not main.)
  • I'm not sure how my change impacts the documentation. (Post your PR anyways, and we'll discuss in the comments.)

Signed-off-by: Victor Nicolet <victornl@amazon.com>
/// Convert a [`models::Policy`] to an [`ast::Policy`] given a set of `templates`.
/// Returns an error when any of the invariants of [`ast::Policy`] would be violated,
/// or the template references in the model doesn't exist in the set of templates.
fn reify(

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is similar to what LiteralPolicy::reify(self,... was doing.

Signed-off-by: Victor Nicolet <victornl@amazon.com>
@victornicolet victornicolet force-pushed the victornicolet/refactor-protobuf-policyset-validation-part-2 branch from 34cb0d1 to bd8a76e Compare July 14, 2026 20:31
make_linked_policy("template\0\n \' \"+-$^!", "link\0\n \' \"+-$^!", "A", "eid");
let model2 = models::Policy::from(&linked_policy2);
let roundtripped2 = reify(model2, &templates2).unwrap();
assert_eq!(linked_policy2, roundtripped2);

@victornicolet victornicolet Jul 14, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The test mostly change the input type and tests reify as opposed to try_from.

@github-actions

This comment was marked as outdated.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR completes the protobuf validation/refactor work started in #2469 by removing the LiteralPolicy / LiteralPolicySet intermediate representation and consolidating policy/policyset validation and reification directly into ast::Policy/ast::PolicySet conversion paths.

Changes:

  • Introduces a reify(models::Policy, templates) conversion flow to produce ast::Policy directly (removing ast::LiteralPolicy usage in protobuf code).
  • Refactors protobuf models::PolicySet -> ast::PolicySet conversion to build template/link maps in one pass with duplicate detection.
  • Removes LiteralPolicy (and associated reification error type) from cedar-policy-core, replacing static-policy creation with Template::try_as_policy.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File Description
cedar-policy/src/proto/policy.rs Switches protobuf policy conversion to direct ast::Policy reification and refactors PolicySet conversion + tests accordingly.
cedar-policy-core/src/ast/policy.rs Adds Template::try_as_policy and removes the LiteralPolicy IR and related reification logic/types.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread cedar-policy/src/proto/policy.rs Outdated
Comment thread cedar-policy-core/src/ast/policy.rs
Signed-off-by: Victor Nicolet <victornl@amazon.com>
@github-actions

This comment was marked as outdated.

Signed-off-by: Victor Nicolet <victornl@amazon.com>
@victornicolet victornicolet force-pushed the victornicolet/refactor-protobuf-policyset-validation-part-2 branch from 25727ce to b520054 Compare July 14, 2026 21:07
@victornicolet victornicolet marked this pull request as ready for review July 14, 2026 21:08
@github-actions

Copy link
Copy Markdown

Coverage Report

Head Commit: b520054e82f03f8b6c9a7c6c19a2455fa8fc25e4

Base Commit: e75a13b731928f70e80e75a859fb97fc47987737

Download the full coverage report.

Coverage of Added or Modified Lines of Rust Code

Required coverage: 80.00%

Actual coverage: 92.86%

Status: PASSED ✅

Details
File Status Covered Coverage Missed Lines
cedar-policy-core/src/ast/policy.rs 🔴 4/9 44.44% 723-727
cedar-policy/src/proto/policy.rs 🟢 61/61 100.00%

Coverage of All Lines of Rust Code

Required coverage: 80.00%

Actual coverage: 88.27%

Status: PASSED ✅

Details
Package Status Covered Coverage Base Coverage
cedar-language-server 🟢 4722/5102 92.55% --
cedar-policy 🟢 4635/5750 80.61% --
cedar-policy-cli 🟡 1286/1675 76.78% --
cedar-policy-core 🟢 24670/27826 88.66% --
cedar-policy-formatter 🟢 914/1088 84.01% --
cedar-policy-symcc 🟢 6833/7313 93.44% --
cedar-wasm 🔴 0/28 0.00% --

@cedar-policy cedar-policy deleted a comment from github-actions Bot Jul 14, 2026
@cedar-policy cedar-policy deleted a comment from github-actions Bot Jul 14, 2026
@victornicolet victornicolet changed the title remove LiteralPolicy ir for proto and merge validation steps remove LiteralPolicy for proto and merge validation steps Jul 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants