@intentius/chant-lexicon-cedar 0.44.8

package/src/lint/post-synth/cede011.ts

@@ -0,0 +1,58 @@
+/**
+ * CEDE011: surface the Cedar validator's warnings
+ *
+ * `validate()` returns two arrays, and the second one is the interesting one
+ * for a policy nobody has noticed is dead. The validator's warnings are the
+ * findings that do not make the set invalid but do mean it is not doing what it
+ * says: "policy is impossible: the policy expression evaluates to false for all
+ * valid requests" is the one that matters most — a guard whose attribute
+ * comparison can never hold, so the grant it wraps never fires and the access
+ * it was written to give quietly does not exist.
+ *
+ * Split from CEDE010 rather than folded into it because the two mean different
+ * things: an error is a policy no evaluator will accept, a warning is a policy
+ * that will be accepted and will not work. They deserve different severities
+ * and, in a report, different lines.
+ *
+ * Same two traps as CEDE010 — findings live under `type: "success"`, and their
+ * order is not stable, so `validatePolicySet` sorts before returning.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parsedPolicySets } from "./cedar-helpers";
+import { findSchema, loadWasm, normalizePolicySet, validatePolicySet } from "./wasm-helpers";
+
+export const cede011: PostSynthCheck = {
+  id: "CEDE011",
+  description: "Cedar validation warnings (impossible policies, shadowed conditions) on an emitted policy set",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    const sets = parsedPolicySets(ctx);
+    if (sets.length === 0) return diagnostics;
+
+    // Both "no validator" and "no schema" are already reported once by
+    // CEDC010/CEDE010; repeating them here would triple the same line.
+    const wasm = loadWasm();
+    if (!wasm) return diagnostics;
+    const schema = findSchema(ctx);
+    if (!schema) return diagnostics;
+
+    for (const set of sets) {
+      const { policySet } = normalizePolicySet(wasm, set);
+      const outcome = validatePolicySet(wasm, policySet, schema.schema);
+      if (outcome.failure) continue; // CEDE010 reports the failed call
+
+      for (const finding of outcome.warnings) {
+        diagnostics.push({
+          checkId: "CEDE011",
+          severity: "warning",
+          message: `Policy "${finding.policyId}" validates but Cedar warns about it: ${finding.message}`,
+          entity: finding.policyId,
+          lexicon: set.lexicon,
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/ceds010.ts

@@ -0,0 +1,57 @@
+/**
+ * CEDS010: a bare `permit(principal, action, resource);` is a standing grant
+ *
+ * The one policy that permits everything to everyone on everything. It is
+ * valid Cedar, it is what a scaffolded policy looks like before anyone has
+ * written the real one, and the Cedar validator says nothing about it — checked
+ * directly against 4.12.0 (chant #1648): a schema-clean run over exactly this
+ * policy returns zero errors, zero warnings, zero other warnings. There is no
+ * upstream tool that will catch it, which is why the epic names this wall as a
+ * definition-of-done item and why it lives here.
+ *
+ * The shape is unambiguous in the JSON: all three scopes unconstrained
+ * (`op: "All"`) and no `when`/`unless` clause to narrow it. Anything with even
+ * one constraint or one guard is somebody's deliberate decision and is not this
+ * check's business (an unconstrained *action* alone is CEDS012).
+ *
+ * Severity is env-gated on the same `ctx.env` seam the k8s org-policy example
+ * and the aws tier checks use: a production build fails, everything else warns,
+ * so the scaffold-and-iterate loop stays workable while the thing that ships
+ * cannot carry it.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { conditionsOf, effectOf, isProdLikeEnv, parsedPolicySets, scopeIsAll } from "./cedar-helpers";
+
+export const ceds010: PostSynthCheck = {
+  id: "CEDS010",
+  description: "A bare permit(principal, action, resource) with no scope constraints and no conditions grants everything",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    const prod = isProdLikeEnv(ctx.env);
+    const severity = prod ? "error" : "warning";
+
+    for (const set of parsedPolicySets(ctx)) {
+      for (const entry of set.entries) {
+        if (effectOf(entry.policy) !== "permit") continue;
+        const policy = entry.policy;
+        const bare =
+          scopeIsAll(policy.principal) &&
+          scopeIsAll(policy.action) &&
+          scopeIsAll(policy.resource) &&
+          conditionsOf(policy).length === 0;
+        if (!bare) continue;
+
+        diagnostics.push({
+          checkId: "CEDS010",
+          severity,
+          message: `Policy "${entry.key}" is a bare permit(principal, action, resource) — every principal may take every action on every resource.${prod ? "" : " This is an error in a production build."} Constrain a scope or add a when/unless guard.`,
+          entity: entry.key,
+          lexicon: set.lexicon,
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/ceds011.ts

@@ -0,0 +1,42 @@
+/**
+ * CEDS011: a policy set with no `forbid` has no floor
+ *
+ * Cedar's evaluation order is fixed and is the reason `forbid` exists: a
+ * `forbid` that matches beats every `permit`, no matter how the permits are
+ * written or in what order. That makes a `forbid` the only construct in the
+ * language that states an invariant — "never outside the corporate network",
+ * "never on a resource marked frozen" — which no later grant can widen.
+ *
+ * A set built only from permits has none. Every future policy is additive, and
+ * the blast radius of a careless one is bounded by nothing. This is a
+ * convention rather than a bug, so it warns; the fix is one `forbid` carrying
+ * whatever the set's real invariant is.
+ *
+ * Reported once per policy set, not once per permit.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { effectOf, parsedPolicySets } from "./cedar-helpers";
+
+export const ceds011: PostSynthCheck = {
+  id: "CEDS011",
+  description: "A policy set built entirely from permits carries no forbid to bound them",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const set of parsedPolicySets(ctx)) {
+      if (set.entries.length === 0) continue;
+      if (set.entries.some((entry) => effectOf(entry.policy) === "forbid")) continue;
+
+      diagnostics.push({
+        checkId: "CEDS011",
+        severity: "warning",
+        message: `Cedar policy set "${set.source}" has ${set.entries.length} policy/policies and no forbid. A forbid beats every permit regardless of order, so it is the only way to state an invariant a later grant cannot widen — add one for whatever this set must never allow.`,
+        entity: set.source,
+        lexicon: set.lexicon,
+      });
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/ceds012.ts

@@ -0,0 +1,50 @@
+/**
+ * CEDS012: a `permit` over every action is IAM's `"Action": "*"`
+ *
+ * A permit that names a principal or a resource but leaves `action`
+ * unconstrained grants every action Cedar's schema defines on that target —
+ * including the ones added next quarter, which is what makes it different from
+ * a wide-but-enumerated grant. The author almost always meant a specific verb
+ * or a group (`action in [Action::"read", Action::"list"]`).
+ *
+ * Scoped deliberately narrow so it does not double-report: a policy with *no*
+ * constraint anywhere and no guard is a bare permit, which is CEDS010's
+ * finding and a more serious one. This check speaks only to a policy that
+ * constrained something and then left the verb open.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { conditionsOf, effectOf, parsedPolicySets, scopeIsAll } from "./cedar-helpers";
+
+export const ceds012: PostSynthCheck = {
+  id: "CEDS012",
+  description: "A permit that leaves the action scope unconstrained grants every action, including future ones",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const set of parsedPolicySets(ctx)) {
+      for (const entry of set.entries) {
+        const policy = entry.policy;
+        if (effectOf(policy) !== "permit") continue;
+        if (!scopeIsAll(policy.action)) continue;
+
+        // The everything-permit belongs to CEDS010.
+        const narrowedElsewhere =
+          !scopeIsAll(policy.principal) ||
+          !scopeIsAll(policy.resource) ||
+          conditionsOf(policy).length > 0;
+        if (!narrowedElsewhere) continue;
+
+        diagnostics.push({
+          checkId: "CEDS012",
+          severity: "warning",
+          message: `Policy "${entry.key}" permits every action — the action scope is unconstrained, so the grant widens on its own as the schema gains actions. Name the actions it needs (action == Action::"read", or action in [ … ]).`,
+          entity: entry.key,
+          lexicon: set.lexicon,
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/index.ts

@@ -0,0 +1,25 @@
+// Code generated by chant generate. DO NOT EDIT.
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+import { cedc010 } from "./cedc010";
+import { cedc011 } from "./cedc011";
+import { cedc012 } from "./cedc012";
+import { cedc013 } from "./cedc013";
+import { cedc014 } from "./cedc014";
+import { cede010 } from "./cede010";
+import { cede011 } from "./cede011";
+import { ceds010 } from "./ceds010";
+import { ceds011 } from "./ceds011";
+import { ceds012 } from "./ceds012";
+
+export const postSynthChecks: PostSynthCheck[] = [
+  cedc010,
+  cedc011,
+  cedc012,
+  cedc013,
+  cedc014,
+  cede010,
+  cede011,
+  ceds010,
+  ceds011,
+  ceds012,
+];