Singleton types for action hierarchy expressions

[mwhicks1]

Category

Cedar validation features

Describe the feature you'd like to request

The validator should give expressions like Action::"getList" in Action::"listActions" type True and expressions like Action::"updateTask" in Action::"listActions" type False based on action hierarchy information kept in the schema, e.g., that Action::"getList" has Action::"listActions" as a parent (but Action::"updateTask" does not).

This can be important for short-circuiting. For example, suppose that I have a policy

permit(principal, action in Action::"listActions",resource)
when {
  principal.owner == resource ||
  resource.isPublic == true
}

Here we assume that listActions is meant to be used with List objects, and such objects have a isPublic attribute. But suppose we also have Task objects that don't have such an attribute. Then if we type check action Action::"updateTask" with a Task object as a resource, then when considering the above policy we will get a false alarm because after substituting Action::"updateTask" for action we will get action expression Action::"updateTask" in Action::"listActions" with type Boolean. Typechecking will proceed to the when clause and fail due to the missing attribute. Giving the action expression type False solves this issue.

Describe alternatives you've considered

You could manually add is List to the resource constraint once we support that.

Additional context

No response

Is this something that you'd be interested in working on?

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

[john-h-kastner-aws]

Some overlap with #105

[mwhicks1]

Some overlap with #105

Can we merge this into #105 and close this one, once done?

I observe that #105 is not very prescriptive -- it enumerates a problem, but not the solution. You could steal some text from this issue and generalize it in that one.

[john-h-kastner-aws]

Closing in favor of #105