@highflame/policy 2.2.37 → 2.2.38

package/dist/engine.d.ts

@@ -80,6 +80,16 @@ export interface EvaluateRequest {
     resource: EntityUID;
     context?: Record<string, unknown>;
     entities?: Entity[];
+    /**
+     * Narrows evaluation to the policies this predicate accepts, keyed by policy
+     * id. Cedar evaluates everything it is handed, so selecting the relevant
+     * subset is the caller's job.
+     *
+     * Omit to evaluate everything. That is also the correct fallback when a
+     * caller cannot resolve a subset: a predicate matching nothing leaves Cedar
+     * with no policies, and Cedar is default-deny.
+     */
+    policyFilter?: (policyId: string) => boolean;
 }
 /**
  * PolicyEngine wraps cedar-wasm with Highflame schema types.

package/dist/engine.js

@@ -186,6 +186,30 @@ function extractPolicies(policyText) {
     }
     return { policySet: policyMap, annotations: annotationsMap };
 }
+/**
+ * Narrow a policy set to the ids `keep` accepts. Returns the set unchanged when
+ * no predicate is given, so the unfiltered path is untouched.
+ *
+ * Throws on a string-form set, which cannot be split by id. Returning it whole
+ * would silently evaluate every policy while the caller believed it had asked
+ * for a subset — the one behaviour the filter contract must never have.
+ */
+function filterPolicySet(set, keep) {
+    if (!keep) {
+        return set;
+    }
+    if (typeof set === "string") {
+        throw new Error("policyFilter cannot be applied: policies are loaded in string form, " +
+            "which has no per-policy ids. Load via loadPoliciesWithIds().");
+    }
+    const out = {};
+    for (const [id, policy] of Object.entries(set)) {
+        if (keep(id)) {
+            out[id] = policy;
+        }
+    }
+    return out;
+}
 /**
  * PolicyEngine wraps cedar-wasm with Highflame schema types.
  */
@@ -346,7 +370,7 @@ export class PolicyEngine {
             action,
             resource,
             context,
-            policies: { staticPolicies: this.policySet },
+            policies: { staticPolicies: filterPolicySet(this.policySet, req.policyFilter) },
             entities,
         };
         // Add schema if available

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@highflame/policy",
-  "version": "2.2.37",
+  "version": "2.2.38",
   "engines": {
     "node": ">=18"
   },