Research proof index

Let ps be Cedar policies and εnv a symbolic environment, where ps and εnv are a well-formed input to the symbolic authorizer, i.e., εnv.WellFormedForPolicies ps. Let t the outcome of symbolically authorizing ps with respect to εnv, and d a concrete authorization decision represented by t. Then, the completeness theorem says that there...

Let ps be Cedar policies, env a concrete evaluation environment (request and entities), εnv a symbolic environment, and t the term resulting from symbolically authorizing ps with respect to εnv, i.e., SymCC.isAuthorized ps εnv = .ok t. Let ps and env be a well-formed input to the concrete authorizer, i.e., env.WellFormedForPolicies ps....

Meaty case. Dispatches on whether the receiver has entity or record type (type_of_getAttr_inversion); the entity branch is where entityDoesNotExist can fire and where EntitiesClosedAtLevel is consumed. -/ theorem level_based_no_dne_get_attr {e : Expr} {a : Attr} {n : Nat} {c₀ c₁ : Capabilities} {env : TypeEnv} {request : Request} {entities : Entitie...

Meaty case. Dispatches on whether the receiver has entity or record type (type_of_getAttr_inversion); the entity branch is where entityDoesNotExist can fire and where EntitiesClosedAtLevel is consumed.

Entity branch. getAttr (entity euid) a es = es.attrs euid >>= (·.findOrErr a attrDoesNotExist), which DNEs iff euid ∉ es. By soundness e evaluates to an entity (or errors, in which case the IH rules out a DNE error and the remaining error kinds are not entityDoesNotExist). When it evaluates to entity euid, checked_eval_entity_exists shows `eui...

Record branch. No entity is dereferenced, so the outer lookup is a record projection (attrDoesNotExist at worst). Only the inner expression e could DNE, and the IH rules that out.