Skip to content

Fix validation for action entitites in TPE #1838

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

Fix validation for action entitites in TPE #1838

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 3 additions & 6 deletions cedar-policy-core/src/tpe/entities.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -355,12 +355,7 @@ impl PartialEntity {
let etype = uid.entity_type();

if self.uid.is_action() {
if self.attrs.is_none() || self.tags.is_none() {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe here none is used to denote unknown attributes / tags. Which is different from no attributes which would be represented as Some(Empty BTreeMap).

@shaobo-he-aws can confirm.

Copy link
Contributor

@chaluli chaluli Sep 23, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In the code you linked here, if you changed lines 425 and 434 to be Some(BTreeMap::new()) does it work as expected without this patch?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@chaluli is correct.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll check. Don't remember of the top of my head, it's a month or so since I looked at this, I just put a note to myself to check this later

return Err(UnknownActionComponentError {
action: uid.clone(),
}
.into());
}
// An Action entity cannot have attributes
if let Some(attrs) = &self.attrs {
if let Some((attr, _)) = attrs.first_key_value() {
return Err(EntitySchemaConformanceError::unexpected_entity_attr(
Expand All @@ -370,6 +365,7 @@ impl PartialEntity {
.into());
}
}
// An Action entity cannot have tags
if let Some(tags) = &self.tags {
if let Some((tag, _)) = tags.first_key_value() {
return Err(EntitySchemaConformanceError::unexpected_entity_tag(
Expand All @@ -379,6 +375,7 @@ impl PartialEntity {
.into());
}
}
// The Action must exist in the schema, and have the same ancestors as in the schema.
if let Some(action) = core_schema.action(uid) {
if let Some(ancestors) = &self.ancestors {
let schema_ancestors: HashSet<EntityUID> =
Expand Down