v4.14.0

Release 4.14.0, available on crates.io

Added

• Cedar now supports the external keyword to declare undefined entity type and action.
• Schema can now hold a partial schema, one that still has external declarations.
• Schema::is_complete reports whether any external entity type or action remain.
• Schema::external_entity_types,
  Schema::defined_entity_types, Schema::external_actions and Schema::defined_actions list the
  declarations on each side of that split (#2615).
• Schema::schema_link links any number of schemas, resolving each external declaration against a
  definition of the same name, and may itself return a partial schema that holds external entity type or action. Schema::schema_link_complete
  additionally requires the result to be complete. Both report the new LinkError (#2615).
• The new ValidationError::IncompleteSchema reports that policy validation was given a partial
  schema (#2615).
• The FFI gains link_schemas and schema_completeness, with the usual _json and _json_str
  variants, exposed to JavaScript as linkSchemas and schemaCompleteness (#2615).
• The protobuf encoding of a schema now carries external declarations, so a partial schema can be
  encoded and decoded (#2621).
• For the experimental tpe feature, TPE now reduces has, hasTag, in and == applied to non-erroring but unknown expressions when the schema provides enough information to determine the concrete value of the operation.

Changed

• All existing API behavior remain unchanged for inputs that do not involve the new external keyword.
• Several Schema methods now have a defined behavior for external declarations: Schema::entity_types
  and Schema::actions list them, Schema::action_entities excludes external actions, Schema::principals_for_action and
  Schema::resources_for_action return Some with an empty iterator for external actions
  and Schema::ancestors finds an external entity type and includes its declared parent types
  in the hierarchy (#2615).
• Validator::validate and Validator::validate_with_level refuse a partial schema, reporting
  ValidationError::IncompleteSchema. Only a complete schema can be used to validate policies (#2615).
• Request::new accepts a partial schema that holds external declarations, and refuses a request whose
  action is external.
• Entities::from_json_value and friends likewise accept a partial schema and
  refuse an entity whose own type is external, while an entity of a defined type may refer to an
  external type in its attributes, tags and ancestors (#2615).
• Context::from_json_value and friends report ContextJsonError::MissingAction for an external
  action, as they already did for an absent one, and the error message changed accordingly (#2615).
• EntityUid::from_str() is faster (~15-30x on the EntityUid parsing benchmark), as it no longer
  parses the string and renders the result back out to check that the input was normalized. The same
  optimization was applied to from_normalized_str() for InternalName, UnreservedId and AnyId.
• Remove support for policy templates in the deprecated entity-manifest feature. Policy templates
  were previously accepted, but slots were not included in the manifest.