Skip to content

Commit 1472e3c

Browse files
aws-sdk-dotnet-automationaws-sdk-dotnet-automation
committed
Adds Cedar JSON format support for entities and context data in authorization requests
1 parent 61ca821 commit 1472e3c

File tree

8 files changed

+113
-6
lines changed

8 files changed

+113
-6
lines changed

‎generator/ServiceModels/verifiedpermissions/verifiedpermissions-2021-12-01.api.json

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -737,6 +737,10 @@
737737
"box":true,
738738
"sensitive":true
739739
},
740+
"CedarJson":{
741+
"type":"string",
742+
"sensitive":true
743+
},
740744
"Claim":{
741745
"type":"string",
742746
"min":1,
@@ -850,7 +854,8 @@
850854
"ContextDefinition":{
851855
"type":"structure",
852856
"members":{
853-
"contextMap":{"shape":"ContextMap"}
857+
"contextMap":{"shape":"ContextMap"},
858+
"cedarJson":{"shape":"CedarJson"}
854859
},
855860
"union":true
856861
},
@@ -1079,7 +1084,8 @@
10791084
"EntitiesDefinition":{
10801085
"type":"structure",
10811086
"members":{
1082-
"entityList":{"shape":"EntityList"}
1087+
"entityList":{"shape":"EntityList"},
1088+
"cedarJson":{"shape":"CedarJson"}
10831089
},
10841090
"union":true
10851091
},

‎generator/ServiceModels/verifiedpermissions/verifiedpermissions-2021-12-01.docs.json

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -225,6 +225,13 @@
225225
"AttributeValue$boolean": "<p>An attribute value of <a href=\"https://docs.cedarpolicy.com/policies/syntax-datatypes.html#boolean\">Boolean</a> type.</p> <p>Example: <code>{\"boolean\": true}</code> </p>"
226226
}
227227
},
228+
"CedarJson": {
229+
"base": null,
230+
"refs": {
231+
"ContextDefinition$cedarJson": "<p>A Cedar JSON string representation of the context needed to successfully evaluate an authorization request.</p> <p>Example: <code>{\"cedarJson\":\"{\\\"&lt;KeyName1&gt;\\\": true, \\\"&lt;KeyName2&gt;\\\": 1234}\" }</code> </p>",
232+
"EntitiesDefinition$cedarJson": "<p>A Cedar JSON string representation of the entities needed to successfully evaluate an authorization request.</p> <p>Example: <code>{\"cedarJson\": \"[{\\\"uid\\\":{\\\"type\\\":\\\"Photo\\\",\\\"id\\\":\\\"VacationPhoto94.jpg\\\"},\\\"attrs\\\":{\\\"accessLevel\\\":\\\"public\\\"},\\\"parents\\\":[]}]\"}</code> </p>"
233+
}
234+
},
228235
"Claim": {
229236
"base": null,
230237
"refs": {
@@ -323,7 +330,7 @@
323330
}
324331
},
325332
"ContextDefinition": {
326-
"base": "<p>Contains additional details about the context of the request. Verified Permissions evaluates this information in an authorization request as part of the <code>when</code> and <code>unless</code> clauses in a policy.</p> <p>This data type is used as a request parameter for the <a href=\"https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_IsAuthorized.html\">IsAuthorized</a>, <a href=\"https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_BatchIsAuthorized.html\">BatchIsAuthorized</a>, and <a href=\"https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_IsAuthorizedWithToken.html\">IsAuthorizedWithToken</a> operations.</p> <p>Example: <code>\"context\":{\"contextMap\":{\"&lt;KeyName1&gt;\":{\"boolean\":true},\"&lt;KeyName2&gt;\":{\"long\":1234}}}</code> </p>",
333+
"base": "<p>Contains additional details about the context of the request. Verified Permissions evaluates this information in an authorization request as part of the <code>when</code> and <code>unless</code> clauses in a policy.</p> <p>This data type is used as a request parameter for the <a href=\"https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_IsAuthorized.html\">IsAuthorized</a>, <a href=\"https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_BatchIsAuthorized.html\">BatchIsAuthorized</a>, and <a href=\"https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_IsAuthorizedWithToken.html\">IsAuthorizedWithToken</a> operations.</p> <p>If you're passing context as part of the request, exactly one instance of <code>context</code> must be passed. If you don't want to pass context, omit the <code>context</code> parameter from your request rather than sending <code>context {}</code>.</p> <p>Example: <code>\"context\":{\"contextMap\":{\"&lt;KeyName1&gt;\":{\"boolean\":true},\"&lt;KeyName2&gt;\":{\"long\":1234}}}</code> </p>",
327334
"refs": {
328335
"BatchIsAuthorizedInputItem$context": "<p>Specifies additional context that can be used to make more granular authorization decisions.</p>",
329336
"BatchIsAuthorizedWithTokenInputItem$context": "<p>Specifies additional context that can be used to make more granular authorization decisions.</p>",
@@ -524,7 +531,7 @@
524531
"EntityList": {
525532
"base": null,
526533
"refs": {
527-
"EntitiesDefinition$entityList": "<p>An array of entities that are needed to successfully evaluate an authorization request. Each entity in this array must include an identifier for the entity, the attributes of the entity, and a list of any parent entities.</p>"
534+
"EntitiesDefinition$entityList": "<p>An array of entities that are needed to successfully evaluate an authorization request. Each entity in this array must include an identifier for the entity, the attributes of the entity, and a list of any parent entities.</p> <note> <p>If you include multiple entities with the same <code>identifier</code>, only the last one is processed in the request.</p> </note>"
528535
}
529536
},
530537
"EntityReference": {

‎generator/ServiceModels/verifiedpermissions/verifiedpermissions-2021-12-01.normal.json

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -927,6 +927,10 @@
927927
"box":true,
928928
"sensitive":true
929929
},
930+
"CedarJson":{
931+
"type":"string",
932+
"sensitive":true
933+
},
930934
"Claim":{
931935
"type":"string",
932936
"min":1,
@@ -1116,9 +1120,13 @@
11161120
"contextMap":{
11171121
"shape":"ContextMap",
11181122
"documentation":"<p>An list of attributes that are needed to successfully evaluate an authorization request. Each attribute in this array must include a map of a data type and its value.</p> <p>Example: <code>\"contextMap\":{\"&lt;KeyName1&gt;\":{\"boolean\":true},\"&lt;KeyName2&gt;\":{\"long\":1234}}</code> </p>"
1123+
},
1124+
"cedarJson":{
1125+
"shape":"CedarJson",
1126+
"documentation":"<p>A Cedar JSON string representation of the context needed to successfully evaluate an authorization request.</p> <p>Example: <code>{\"cedarJson\":\"{\\\"&lt;KeyName1&gt;\\\": true, \\\"&lt;KeyName2&gt;\\\": 1234}\" }</code> </p>"
11191127
}
11201128
},
1121-
"documentation":"<p>Contains additional details about the context of the request. Verified Permissions evaluates this information in an authorization request as part of the <code>when</code> and <code>unless</code> clauses in a policy.</p> <p>This data type is used as a request parameter for the <a href=\"https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_IsAuthorized.html\">IsAuthorized</a>, <a href=\"https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_BatchIsAuthorized.html\">BatchIsAuthorized</a>, and <a href=\"https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_IsAuthorizedWithToken.html\">IsAuthorizedWithToken</a> operations.</p> <p>Example: <code>\"context\":{\"contextMap\":{\"&lt;KeyName1&gt;\":{\"boolean\":true},\"&lt;KeyName2&gt;\":{\"long\":1234}}}</code> </p>",
1129+
"documentation":"<p>Contains additional details about the context of the request. Verified Permissions evaluates this information in an authorization request as part of the <code>when</code> and <code>unless</code> clauses in a policy.</p> <p>This data type is used as a request parameter for the <a href=\"https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_IsAuthorized.html\">IsAuthorized</a>, <a href=\"https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_BatchIsAuthorized.html\">BatchIsAuthorized</a>, and <a href=\"https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_IsAuthorizedWithToken.html\">IsAuthorizedWithToken</a> operations.</p> <p>If you're passing context as part of the request, exactly one instance of <code>context</code> must be passed. If you don't want to pass context, omit the <code>context</code> parameter from your request rather than sending <code>context {}</code>.</p> <p>Example: <code>\"context\":{\"contextMap\":{\"&lt;KeyName1&gt;\":{\"boolean\":true},\"&lt;KeyName2&gt;\":{\"long\":1234}}}</code> </p>",
11221130
"union":true
11231131
},
11241132
"ContextMap":{
@@ -1470,7 +1478,11 @@
14701478
"members":{
14711479
"entityList":{
14721480
"shape":"EntityList",
1473-
"documentation":"<p>An array of entities that are needed to successfully evaluate an authorization request. Each entity in this array must include an identifier for the entity, the attributes of the entity, and a list of any parent entities.</p>"
1481+
"documentation":"<p>An array of entities that are needed to successfully evaluate an authorization request. Each entity in this array must include an identifier for the entity, the attributes of the entity, and a list of any parent entities.</p> <note> <p>If you include multiple entities with the same <code>identifier</code>, only the last one is processed in the request.</p> </note>"
1482+
},
1483+
"cedarJson":{
1484+
"shape":"CedarJson",
1485+
"documentation":"<p>A Cedar JSON string representation of the entities needed to successfully evaluate an authorization request.</p> <p>Example: <code>{\"cedarJson\": \"[{\\\"uid\\\":{\\\"type\\\":\\\"Photo\\\",\\\"id\\\":\\\"VacationPhoto94.jpg\\\"},\\\"attrs\\\":{\\\"accessLevel\\\":\\\"public\\\"},\\\"parents\\\":[]}]\"}</code> </p>"
14741486
}
14751487
},
14761488
"documentation":"<p>Contains the list of entities to be considered during an authorization request. This includes all principals, resources, and actions required to successfully evaluate the request.</p> <p>This data type is used as a field in the response parameter for the <a href=\"https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_IsAuthorized.html\">IsAuthorized</a> and <a href=\"https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_IsAuthorizedWithToken.html\">IsAuthorizedWithToken</a> operations.</p>",

‎sdk/src/Services/VerifiedPermissions/Generated/Model/ContextDefinition.cs

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,14 +43,46 @@ namespace Amazon.VerifiedPermissions.Model
4343
/// </para>
4444
///
4545
/// <para>
46+
/// If you're passing context as part of the request, exactly one instance of <c>context</c>
47+
/// must be passed. If you don't want to pass context, omit the <c>context</c> parameter
48+
/// from your request rather than sending <c>context {}</c>.
49+
/// </para>
50+
///
51+
/// <para>
4652
/// Example: <c>"context":{"contextMap":{"&lt;KeyName1&gt;":{"boolean":true},"&lt;KeyName2&gt;":{"long":1234}}}</c>
4753
///
4854
/// </para>
4955
/// </summary>
5056
public partial class ContextDefinition
5157
{
58+
private string _cedarJson;
5259
private Dictionary<string, AttributeValue> _contextMap = AWSConfigs.InitializeCollections ? new Dictionary<string, AttributeValue>() : null;
5360

61+
/// <summary>
62+
/// Gets and sets the property CedarJson.
63+
/// <para>
64+
/// A Cedar JSON string representation of the context needed to successfully evaluate
65+
/// an authorization request.
66+
/// </para>
67+
///
68+
/// <para>
69+
/// Example: <c>{"cedarJson":"{\"&lt;KeyName1&gt;\": true, \"&lt;KeyName2&gt;\": 1234}"
70+
/// }</c>
71+
/// </para>
72+
/// </summary>
73+
[AWSProperty(Sensitive=true)]
74+
public string CedarJson
75+
{
76+
get { return this._cedarJson; }
77+
set { this._cedarJson = value; }
78+
}
79+
80+
// Check to see if CedarJson property is set
81+
internal bool IsSetCedarJson()
82+
{
83+
return this._cedarJson != null;
84+
}
85+
5486
/// <summary>
5587
/// Gets and sets the property ContextMap.
5688
/// <para>

‎sdk/src/Services/VerifiedPermissions/Generated/Model/EntitiesDefinition.cs

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,15 +43,47 @@ namespace Amazon.VerifiedPermissions.Model
4343
/// </summary>
4444
public partial class EntitiesDefinition
4545
{
46+
private string _cedarJson;
4647
private List<EntityItem> _entityList = AWSConfigs.InitializeCollections ? new List<EntityItem>() : null;
4748

49+
/// <summary>
50+
/// Gets and sets the property CedarJson.
51+
/// <para>
52+
/// A Cedar JSON string representation of the entities needed to successfully evaluate
53+
/// an authorization request.
54+
/// </para>
55+
///
56+
/// <para>
57+
/// Example: <c>{"cedarJson": "[{\"uid\":{\"type\":\"Photo\",\"id\":\"VacationPhoto94.jpg\"},\"attrs\":{\"accessLevel\":\"public\"},\"parents\":[]}]"}</c>
58+
///
59+
/// </para>
60+
/// </summary>
61+
[AWSProperty(Sensitive=true)]
62+
public string CedarJson
63+
{
64+
get { return this._cedarJson; }
65+
set { this._cedarJson = value; }
66+
}
67+
68+
// Check to see if CedarJson property is set
69+
internal bool IsSetCedarJson()
70+
{
71+
return this._cedarJson != null;
72+
}
73+
4874
/// <summary>
4975
/// Gets and sets the property EntityList.
5076
/// <para>
5177
/// An array of entities that are needed to successfully evaluate an authorization request.
5278
/// Each entity in this array must include an identifier for the entity, the attributes
5379
/// of the entity, and a list of any parent entities.
5480
/// </para>
81+
/// <note>
82+
/// <para>
83+
/// If you include multiple entities with the same <c>identifier</c>, only the last one
84+
/// is processed in the request.
85+
/// </para>
86+
/// </note>
5587
/// </summary>
5688
public List<EntityItem> EntityList
5789
{

‎sdk/src/Services/VerifiedPermissions/Generated/Model/Internal/MarshallTransformations/ContextDefinitionMarshaller.cs

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,12 @@ public void Marshall(ContextDefinition requestObject, JsonMarshallerContext cont
4848
{
4949
if(requestObject == null)
5050
return;
51+
if(requestObject.IsSetCedarJson())
52+
{
53+
context.Writer.WritePropertyName("cedarJson");
54+
context.Writer.Write(requestObject.CedarJson);
55+
}
56+
5157
if(requestObject.IsSetContextMap())
5258
{
5359
context.Writer.WritePropertyName("contextMap");

‎sdk/src/Services/VerifiedPermissions/Generated/Model/Internal/MarshallTransformations/ContextDefinitionUnmarshaller.cs

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,12 @@ public ContextDefinition Unmarshall(JsonUnmarshallerContext context)
6666
int targetDepth = context.CurrentDepth;
6767
while (context.ReadAtDepth(targetDepth))
6868
{
69+
if (context.TestExpression("cedarJson", targetDepth))
70+
{
71+
var unmarshaller = StringUnmarshaller.Instance;
72+
unmarshalledObject.CedarJson = unmarshaller.Unmarshall(context);
73+
continue;
74+
}
6975
if (context.TestExpression("contextMap", targetDepth))
7076
{
7177
var unmarshaller = new DictionaryUnmarshaller<string, AttributeValue, StringUnmarshaller, AttributeValueUnmarshaller>(StringUnmarshaller.Instance, AttributeValueUnmarshaller.Instance);

‎sdk/src/Services/VerifiedPermissions/Generated/Model/Internal/MarshallTransformations/EntitiesDefinitionMarshaller.cs

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,12 @@ public void Marshall(EntitiesDefinition requestObject, JsonMarshallerContext con
4848
{
4949
if(requestObject == null)
5050
return;
51+
if(requestObject.IsSetCedarJson())
52+
{
53+
context.Writer.WritePropertyName("cedarJson");
54+
context.Writer.Write(requestObject.CedarJson);
55+
}
56+
5157
if(requestObject.IsSetEntityList())
5258
{
5359
context.Writer.WritePropertyName("entityList");

0 commit comments

Comments
 (0)