Release v0.2.0 · praxis-proxy/policy

Upgrading from 0.1.0? Configurations require changes: see docs/upgrade-apl.md.

docs/content/apl/apl-grammar.md documents the APL grammar.

assertions: controls headers at trust boundaries. (#56)
The normative APL grammar and custom response: denial block are now documented. (#55)
Differential tests cover Cedar, CEL, and OPA. (#43)
Delegated tokens can be cached until expiry, with warnings for routes that delegate unvalidated credentials. (#36)
http: routes generic HTTP requests, with http.response and http.status supporting response policy. (#42)
Hook declarations now include their routing metadata. (#38)
Hosts provide the transport used by PPE plugins, gated by the perform_http capability. (#32)
Outbound HTTP gains body limits, HTTP/2, safe retries, explicit egress-denial codes, prohibited-address data, and a deterministic test transport. (#32)
JWT claim mapping is configurable through presets or inline maps, with claim inclusion and exclusion controls. (#31)
Roles and permissions are readable as whole sets. (#7)

APL now treats require(P) as !P, permits only run(name) for plugin invocation, and rejects field operations in rule position or empty pipe stages. (#55)
Quoted literals, attribute paths, reserved words, boolean operators, numbers, and lexer positions now follow one strict grammar. (#55)
Dispatch defaults to policy; unreachable plugins fail loading, narrowed plugins raise an alarm, and requests without resolvable context are denied. (#55)
The compiled IR, group authorization, plugin reachability, and policy-term compilation now follow the canonical configuration model. (#55)
Dispatch-specific and unknown keys are rejected at every scope; global-only keys, authentication replacement, and response: resolution are enforced consistently. (#55)
Generic HTTP has typed request and response hooks; incompatible handlers and message-only field pipelines are rejected. (#42)
HTTP route resolvers use the matched route, report annotation replacement, expose integration errors, and reject unread route keys. (#42)
Hook names are validated on every load path, and metadata lookup now returns Option<HookMetadata>. (#38)
Plugins initialize through Plugin::initialize_with, and identity-jwt refreshes JWKS on demand. (#32)
JWT configuration rejects unknown keys and invalid SPIFFE trust domains; workload trust domains are derived rather than mapped. (#31)
Unused items now fail the build. (#44)

The legacy compile_config path, its alternate route shape, and its catch-all are gone. (#55)
Policy-mode activation lists, the HTTP inertness alarm, route when:, and other parsed-but-inert settings are gone. (#55)
Legacy policy keys, flat phase keys, the apl: wrapper, global field pipelines, and unknown top-level keys are rejected. (#55)
Unused hook-name modules and AplRouteHandler::with_pdp_router were removed. (#38, #44)

Praxis integration fixes cover false narrowed-plugin alarms, explicit ring selection, and policy evaluation on glob entity routes. (#72)
Bundles joined through both tags and groups run authentication only once. (#56)
Policy layers now account for above-route delegation and elicitation, entity-default authentication, and empty authorization phases. (#55)
HTTP matching now uses the host path exactly and validates duplicate routes, absolute paths, reserved names, and method tokens and precedence. (#42)
HTTP dispatch preserves response and post-phase handlers while avoiding repeated normalization, path cloning, and authentication scans. (#42)
Concurrent plugin registration no longer loses plugins. (#41)
HTTP and elicitation hooks now report complete routing metadata, which MessageView uses for phase detection. (#42)
Subject claims preserve JSON shape, scalar arrays become StringSet values, and float claims work with Cedar. (#9)
JWKS rotation no longer depends on a background runtime. (#32)
Empty sets no longer read as missing attributes. (#7)

New Contributors

Contributors

Full Changelog: v0.1.0...v0.2.0

Navigation Menu