Cedar (AWS): a alternativa nova de policy language

// Permit explícito com scope e condições
permit (
  principal in Group::"engineering",
  action in [Action::"viewDocument", Action::"editDocument"],
  resource in Folder::"engineering-docs"
)
when {
  resource.owner == principal ||
  principal in resource.collaborators
}
unless {
  resource.classification == "secret" &&
  !context.mfa_authenticated
};

// Forbid sempre vence — guard absoluto
forbid (
  principal,
  action,
  resource
)
when {
  context.ip_address.isInRange("0.0.0.0/0") &&
  resource.classification in ["secret", "top-secret"]
};

// Policy template (parametrizada)
permit (
  principal == ?principal,
  action in [Action::"viewDocument"],
  resource == ?resource
);

{
  "FFV": {
    "entityTypes": {
      "User": {
        "memberOfTypes": ["Group", "Organization"],
        "shape": {
          "type": "Record",
          "attributes": {
            "department": { "type": "String" },
            "level": { "type": "Long" }
          }
        }
      },
      "Group": { "memberOfTypes": ["Organization"] },
      "Organization": {},
      "Document": {
        "memberOfTypes": ["Folder"],
        "shape": {
          "type": "Record",
          "attributes": {
            "owner": { "type": "Entity", "name": "User" },
            "collaborators": { "type": "Set", "element": { "type": "Entity", "name": "User" } },
            "classification": { "type": "String" }
          }
        }
      }
    },
    "actions": {
      "viewDocument": {
        "appliesTo": {
          "principalTypes": ["User"],
          "resourceTypes": ["Document"],
          "context": {
            "type": "Record",
            "attributes": {
              "mfa_authenticated": { "type": "Boolean" },
              "ip_address": { "type": "String" }
            }
          }
        }
      }
    }
  }
}

use cedar_policy::{Authorizer, Context, Entities, PolicySet, Request, Schema};

let schema: Schema = serde_json::from_str(SCHEMA_JSON)?.try_into()?;
let policies: PolicySet = POLICIES_TEXT.parse()?;
let entities: Entities = Entities::from_json_str(ENTITIES_JSON, Some(&schema))?;

let request = Request::new(
    Some(r#"User::"alice""#.parse()?),
    Some(r#"Action::"viewDocument""#.parse()?),
    Some(r#"Document::"report-q1""#.parse()?),
    Context::from_json_value(json!({
        "mfa_authenticated": true,
        "ip_address": "10.0.0.5"
    }), Some((&schema, &"Action::\"viewDocument\"".parse()?)))?,
    Some(&schema),
)?;

let authorizer = Authorizer::new();
let response = authorizer.is_authorized(&request, &policies, &entities);

match response.decision() {
    Decision::Allow => println!("granted"),
    Decision::Deny => println!("denied: {:?}", response.diagnostics().reason()),
}