Documentation

Cedar.Thm.Validation.Levels

theorem Cedar.Thm.level_based_slicing_is_sound_expr {e : Spec.Expr} {n : Nat} {tx : Validation.TypedExpr} {c c₁ : Validation.Capabilities} {env : Validation.TypeEnv} {request : Spec.Request} {entities : Spec.Entities} (hc : CapabilitiesInvariant c request entities) (hr : InstanceOfWellFormedEnvironment request entities env) (ht : Validation.typeOf e c env = Except.ok (tx, c₁)) (hl : Validation.TypedExpr.AtLevel env tx n) :
Spec.evaluate e request entities = Spec.evaluate e request (entities.sliceAtLevel request n)
theorem Cedar.Thm.typecheck_policy_with_level_is_sound {p : Spec.Policy} {tx : Validation.TypedExpr} {n : Nat} {env : Validation.TypeEnv} {request : Spec.Request} {entities : Spec.Entities} (hr : InstanceOfWellFormedEnvironment request entities env) (htl : Validation.typecheckPolicyWithLevel p n env = Except.ok tx) :
Spec.evaluate p.toExpr request entities = Spec.evaluate p.toExpr request (entities.sliceAtLevel request n)

The sliced variant of typecheck_policy_with_level_no_dne (issue #642): evaluating a level-checked policy against the level-n slice of a closed store also never produces entityDoesNotExist. Follows trivially by transporting the full-store result across the semantic-equivalence soundness theorem.

theorem Cedar.Thm.validate_with_level_is_sound_wf {ps : Spec.Policies} {schema : Validation.Schema} {n : Nat} {request : Spec.Request} {entities : Spec.Entities} (hwf : InstanceOfWellFormedSchema schema request entities) (htl : Validation.validateWithLevel ps schema n = Except.ok ()) :
Spec.isAuthorized request entities ps = Spec.isAuthorized request (entities.sliceAtLevel request n) ps

The _no_dne analogue of typecheck_policy_at_level_with_environments_is_sound: a policy that level-checks against every environment of the schema (and so, in particular, the one the request inhabits), evaluated against a store closed at that level, never produces entityDoesNotExist.

theorem Cedar.Thm.validate_with_level_no_dne_wf {ps : Spec.Policies} {schema : Validation.Schema} {n : Nat} {request : Spec.Request} {entities : Spec.Entities} (hwf : InstanceOfWellFormedSchema schema request entities) (hcl : EntitiesClosedAtLevel entities request n) (htl : Validation.validateWithLevel ps schema n = Except.ok ()) (p : Spec.Policy) :

Validator-level statement of issue #642: if every policy in ps validates at level n and entities is closed at level n for the request, then no policy evaluates to an entityDoesNotExist error. This is exactly the family of evaluations isAuthorized performs, so it is the closure guarantee isAuthorized inherits (the authorizer surfaces evaluation results only through the kind-agnostic errorPolicies / satisfiedPolicies, and never introduces a entityDoesNotExist of its own). Mirrors validate_with_level_is_sound_wf.