@o3co/auth.policy-verifier.cedar-wasm 0.11.0 → 0.12.0

package/README.md

@@ -18,6 +18,13 @@ same choice out — that setting refuses to start when this package was not
 imported, naming it. Nothing else about the collector's config changes with the
 engine; see cedar's README for the whole of it.
 
+It also vouches for the policy revision behind every answer
+(`confirmsRevision`, #244): the set is compiled in this process, from the files
+the revision was computed over, under an id nothing else holds — so an answer
+cannot have come from any other policies. It is the engine
+`requireConfirmedRevision = true` boots over; see cedar's [Policy
+revision](../cedar/README.md#policy-revision-which-policies-decided).
+
 ## What it costs, and when to choose it
 
 The policy set is compiled once, at boot, into wasm memory; each request

package/dist/wasmEngine.d.mts

@@ -19,6 +19,15 @@ export interface CedarWasmEngine extends CedarEngine {
  * What this engine costs is paid at import: the wasm module (about 12 MB on
  * disk) is instantiated when the bindings load. That is why it lives in its
  * own package — a deployment that evaluates out of process never carries it.
+ *
+ * It vouches for the revision it evaluated (`confirmsRevision`, #244), and can:
+ * the set is compiled here, from the source `load` was handed, under an id
+ * minted here and known to nothing else. An answer through that id cannot have
+ * come from any other policies, so every answer names the revision of that
+ * source — read once, at `load`, beside the compile. `PolicySource` is a plain
+ * object the caller still holds; reading `source.revision` when answering would
+ * be reading "the current revision", which is a claim about the object and not
+ * about the policies that were compiled.
  */
 export declare const cedarWasmEngine: CedarWasmEngine;
 //# sourceMappingURL=wasmEngine.d.mts.map

package/dist/wasmEngine.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"wasmEngine.d.mts","sourceRoot":"","sources":["../src/wasmEngine.mts"],"names":[],"mappings":"AASA,OAAO,EAEN,KAAK,WAAW,EAGhB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,MAAM,kCAAkC,CAAC;AAE1C,kFAAkF;AAClF,eAAO,MAAM,sBAAsB,EAAG,MAAe,CAAC;AAEtD,oFAAoF;AACpF,MAAM,WAAW,eAAgB,SAAQ,WAAW;IACnD,QAAQ,CAAC,IAAI,EAAE,OAAO,sBAAsB,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,YAAY,GAAG,kBAAkB,CAAC;CAC/C;AAKD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,eAAe,EAAE,eAsC7B,CAAC"}
+{"version":3,"file":"wasmEngine.d.mts","sourceRoot":"","sources":["../src/wasmEngine.mts"],"names":[],"mappings":"AASA,OAAO,EAEN,KAAK,WAAW,EAGhB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,MAAM,kCAAkC,CAAC;AAE1C,kFAAkF;AAClF,eAAO,MAAM,sBAAsB,EAAG,MAAe,CAAC;AAEtD,oFAAoF;AACpF,MAAM,WAAW,eAAgB,SAAQ,WAAW;IACnD,QAAQ,CAAC,IAAI,EAAE,OAAO,sBAAsB,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,YAAY,GAAG,kBAAkB,CAAC;CAC/C;AAKD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,eAAe,EAAE,eA0C7B,CAAC"}

package/dist/wasmEngine.mjs

@@ -19,10 +19,20 @@ let policySetCounter = 0;
  * What this engine costs is paid at import: the wasm module (about 12 MB on
  * disk) is instantiated when the bindings load. That is why it lives in its
  * own package — a deployment that evaluates out of process never carries it.
+ *
+ * It vouches for the revision it evaluated (`confirmsRevision`, #244), and can:
+ * the set is compiled here, from the source `load` was handed, under an id
+ * minted here and known to nothing else. An answer through that id cannot have
+ * come from any other policies, so every answer names the revision of that
+ * source — read once, at `load`, beside the compile. `PolicySource` is a plain
+ * object the caller still holds; reading `source.revision` when answering would
+ * be reading "the current revision", which is a claim about the object and not
+ * about the policies that were compiled.
  */
 export const cedarWasmEngine = {
     name: CEDAR_WASM_ENGINE_NAME,
     async: false,
+    confirmsRevision: true,
     load(source) {
         for (const file of source.files) {
             const answer = checkParsePolicySet({ staticPolicies: file.text });
@@ -30,6 +40,8 @@ export const cedarWasmEngine = {
                 throw new CedarEngineError(`${file.source} failed to parse: ${details(answer.errors)}`);
             }
         }
+        // Captured with the compile below, not read per answer — see the doc comment.
+        const { revision } = source;
         const policySetId = `auth.policy-verifier.cedar-wasm:${policySetCounter++}`;
         const compiled = preparsePolicySet(policySetId, { staticPolicies: source.text });
         if (compiled.type === "failure") {
@@ -47,6 +59,7 @@ export const cedarWasmEngine = {
                     decision,
                     reason: diagnostics.reason,
                     errors: diagnostics.errors.map((error) => `${error.policyId}: ${error.error.message}`),
+                    revision,
                 };
             },
         };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@o3co/auth.policy-verifier.cedar-wasm",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "license": "Apache-2.0",
   "type": "module",
   "engines": {
@@ -26,13 +26,13 @@
   },
   "dependencies": {
     "@cedar-policy/cedar-wasm": "4.12.0",
-    "@o3co/auth.policy-verifier.cedar": "0.11.0"
+    "@o3co/auth.policy-verifier.cedar": "0.12.0"
   },
   "devDependencies": {
     "@types/node": "^26.5.1",
     "@vitest/coverage-v8": "^5.0.0",
     "vitest": "^5.0.0",
-    "@o3co/auth.policy-verifier.core": "0.11.0"
+    "@o3co/auth.policy-verifier.core": "0.12.0"
   },
   "scripts": {
     "prebuild": "rimraf dist",