@highflame/policy 2.0.1 → 2.0.3

package/src/palisade-entities.gen.ts

@@ -0,0 +1,49 @@
+// Code generated by highflame-policy-codegen. DO NOT EDIT.
+// Source: schemas/palisade/schema.cedarschema
+
+import type { ServiceEntityMetadata, ActionEntityMetadata } from './entity-metadata-types.gen.js';
+
+/**
+ * Palisade entity metadata for UI components.
+ * Extracted from Cedar schema appliesTo blocks.
+ */
+export const PALISADE_ENTITIES: ServiceEntityMetadata = {
+  principals: ['Scanner'],
+  resources: ['Artifact', 'Package'],
+  actions: ['deploy_model', 'load_model', 'quarantine_artifact', 'scan_artifact', 'scan_package', 'validate_integrity', 'validate_provenance'],
+} as const;
+
+/**
+ * Per-action entity mapping for Palisade.
+ * Maps action names to their valid principals and resources.
+ */
+export const PALISADE_ACTION_ENTITIES: Record<string, ActionEntityMetadata> = {
+  'deploy_model': {
+    principals: ['Scanner'],
+    resources: ['Artifact'],
+  },
+  'load_model': {
+    principals: ['Scanner'],
+    resources: ['Artifact'],
+  },
+  'quarantine_artifact': {
+    principals: ['Scanner'],
+    resources: ['Artifact'],
+  },
+  'scan_artifact': {
+    principals: ['Scanner'],
+    resources: ['Artifact'],
+  },
+  'scan_package': {
+    principals: ['Scanner'],
+    resources: ['Package'],
+  },
+  'validate_integrity': {
+    principals: ['Scanner'],
+    resources: ['Artifact'],
+  },
+  'validate_provenance': {
+    principals: ['Scanner'],
+    resources: ['Artifact'],
+  },
+} as const;

package/src/parser.test.ts

@@ -26,7 +26,7 @@ describe('parseCedarToRules', () => {
     expect(result.unstructured).toHaveLength(0);
 
     const rule = result.rules[0];
-    expect(rule.id).toBe('allow-read-files');
+    expect(rule.annotations.id).toBe('allow-read-files');
     expect(rule.effect).toBe('permit');
     expect(rule.principal).toEqual({ type: 'User' });
     expect(rule.action).toBe('read_file');
@@ -53,7 +53,7 @@ describe('parseCedarToRules', () => {
     expect(result.rules).toHaveLength(1);
 
     const rule = result.rules[0];
-    expect(rule.id).toBe('block-high-risk');
+    expect(rule.annotations.id).toBe('block-high-risk');
     expect(rule.effect).toBe('forbid');
     expect(rule.action).toBe('execute_tool');
 

package/src/parser.ts

@@ -6,11 +6,12 @@
  *
  * Architecture:
  * 1. Cedar text → Cedar JSON (via cedar-wasm policyToJson)
- * 2. Cedar JSON → PolicyRule (simple JSON mapping)
+ * 2. Cedar JSON → PolicyRule (simple JSON mapping with annotation extraction)
  */
 
 import * as cedar from "@cedar-policy/cedar-wasm/nodejs";
 import type { PolicyRule, PolicyCondition, PolicyEntity, PolicyEffect, ConditionOperator } from "./builder.js";
+import { parseAnnotations, generateRuleId } from "./annotations.js";
 import { ParserError, ErrorCodes } from "./errors.js";
 
 /**
@@ -145,10 +146,11 @@ export function parseCedarToRules(cedarText: string): ParseResult {
   // Check for duplicate policy IDs and add warnings
   const idOccurrences = new Map<string, number[]>();
   result.rules.forEach((rule, idx) => {
-    if (rule.id) {
-      const indices = idOccurrences.get(rule.id) || [];
+    const ruleId = rule.annotations.id;
+    if (ruleId) {
+      const indices = idOccurrences.get(ruleId) || [];
       indices.push(idx);
-      idOccurrences.set(rule.id, indices);
+      idOccurrences.set(ruleId, indices);
     }
   });
   for (const [id, indices] of idOccurrences) {
@@ -164,7 +166,7 @@ export function parseCedarToRules(cedarText: string): ParseResult {
 
 /**
  * Convert Cedar JSON policy to PolicyRule.
- * This is pure JSON mapping - no parsing logic.
+ * This is pure JSON mapping - uses parseAnnotations to extract structured annotations.
  */
 function cedarJsonToRule(
   policy: CedarPolicyJSON,
@@ -181,9 +183,20 @@ function cedarJsonToRule(
   }
 
   try {
+    // Parse annotations using the shared utility
+    const { annotations, customAnnotations } = parseAnnotations(policy.annotations);
+
+    // Ensure id and name have sensible defaults
+    if (!annotations.id) {
+      annotations.id = policyId || generateRuleId();
+    }
+    if (!annotations.name) {
+      annotations.name = annotations.id;
+    }
+
     const rule: PolicyRule = {
-      id: policy.annotations?.id || policyId,
-      name: policy.annotations?.name || policy.annotations?.id || policyId,
+      annotations,
+      customAnnotations,
       effect: policy.effect as PolicyEffect,
       principal: mapScopeToEntity(policy.principal, "principal"),
       action: mapActionScope(policy.action),
@@ -193,11 +206,6 @@ function cedarJsonToRule(
       order: index,
     };
 
-    // Map description from annotations
-    if (policy.annotations?.description) {
-      rule.description = policy.annotations.description;
-    }
-
     // Map conditions
     const { conditions, rawCondition } = mapConditions(policy.conditions);
     rule.conditions = conditions;