dogwood.policy

dogwood.policy#

Python policy lifecycle objects modeled after dogwood_language.

The high-level SDK follows the Rust workflow:

ServiceSchema + PolicySchema -> ParsedPolicySet -> LoweredPolicySet -> Validator.

When a non-empty Cedar action schema is supplied, operations delegate to the native PyO3 binding and therefore to Rust dogwood_language. The pure-Python path is a temporary schema-less fallback for simple examples.

class dogwood.policy.ServiceSchema[source]#

Dogwood service schema inputs.

Rust mapping: dogwood_language::ServiceSchema. In Rust this is built with ServiceSchema::defaults() or ServiceSchema::builder() and can contain an event-schema DSL, provider declarations, and macro source.

In dogwood-py, event_schema is passed through to the native binding as ServiceSchema::builder().event_schema_str(...).build(). macros and providers are reserved for future binding support.

event_schema: str | None = None#
macros: str | None = None#
providers: dict[str, Any] | None = None#
classmethod defaults()[source]#

Return the default Dogwood service schema.

Rust mapping: ServiceSchema::defaults().

Return type:

ServiceSchema

class dogwood.policy.PolicySchema[source]#

Cedar action schema text used to lower Dogwood policies.

Rust mapping: dogwood_language::PolicySchema constructed with PolicySchema::from_cedarschema_str.

source: str#
classmethod from_cedarschema_str(source)[source]#

Create a policy schema from Cedar .cedarschema source.

Rust mapping: PolicySchema::from_cedarschema_str(source).

Parameters:

source (str)

Return type:

PolicySchema

class dogwood.policy.ParsedPolicy[source]#

Schema-free parsed policy summary.

Rust mapping: one policy inside dogwood_language::ParsedPolicySet. The Python fallback stores only a lightweight summary; native schema-backed parsing/lowering is handled by Rust.

id: str#
effect: str#
action: str | None#
when: tuple[str, ...] = ()#
unless: tuple[str, ...] = ()#
temporal: tuple[str, ...] = ()#
index: int = 0#
uses_temporal()[source]#
Return type:

bool

uses_providers()[source]#
Return type:

bool

class dogwood.policy.ParsedPolicySet[source]#

Dogwood policy source after schema-free parse.

Rust mapping: dogwood_language::ParsedPolicySet. The Rust split is ParsedPolicySet::parse(source, &service_schema) followed later by ParsedPolicySet::lower(&policy_schema) when the Cedar action schema is available.

source: str#
service_schema: ServiceSchema#
classmethod parse(source, service_schema=None)[source]#

Parse policy source without a Cedar action schema.

Rust mapping: ParsedPolicySet::parse(source, &service_schema).

Parameters:
Return type:

ParsedPolicySet

lower(policy_schema)[source]#

Lower this parsed policy set against a Cedar action schema.

Rust mapping: ParsedPolicySet::lower(&policy_schema).

Parameters:

policy_schema (PolicySchema)

Return type:

LoweredPolicySet

lower_with_distincter(policy_schema, distincter)[source]#

Lower with a caller-supplied Cedar identifier namespace.

Rust mapping: ParsedPolicySet::lower_with_distincter. The current Python fallback uses distincter for generated fallback Cedar ids; native distincter support is not yet exposed through PyO3.

Parameters:
Return type:

LoweredPolicySet

policy_count()[source]#
Return type:

int

policies()[source]#
Return type:

tuple[ParsedPolicy, …]

class dogwood.policy.ValidationResult[source]#

Validation findings for a lowered policy set.

Rust mapping: dogwood_language::ValidationResult. Errors make validation_passed false; warnings are reported separately.

errors: tuple[str, ...] = ()#
warnings: tuple[str, ...] = ()#
validation_passed()[source]#

Return true when validation has no errors.

Rust mapping: ValidationResult::validation_passed().

Return type:

bool

class dogwood.policy.Validator[source]#

Validate a lowered Dogwood policy set.

Rust mapping: dogwood_language::Validator. Unlike Cedar’s validator, Dogwood’s Rust Validator::new() takes no schema because the effective augmented schema travels on LoweredPolicySet.

validate(policies)[source]#

Validate policies and return accumulated errors/warnings.

Rust mapping: Validator::new().validate(&policies).

Parameters:

policies (LoweredPolicySet)

Return type:

ValidationResult

class dogwood.policy.LoweredPolicySet[source]#

Policy set lowered against Dogwood service and Cedar action schemas.

Rust mapping: dogwood_language::LoweredPolicySet. For schema-backed workflows, construction delegates to Rust LoweredPolicySet::from_str. The lowered set is schema-bound; validation and Cedar export use the same schemas it was lowered against.

parsed: ParsedPolicySet#
policy_schema: PolicySchema#
distincter: str = 'policy'#
cedar_policies: str#
source: str#
classmethod from_str(source, service_schema=None, policy_schema=None)[source]#

Parse and lower policy source in one step.

Rust mapping: LoweredPolicySet::from_str(source, &service_schema, &policy_schema). This is the fused parse/lower form.

Parameters:
Return type:

LoweredPolicySet

as_cedar()[source]#

Return lowered Cedar policy text.

Rust mapping: LoweredPolicySet::as_cedar() rendered to text.

Return type:

str

cedar_schema()[source]#

Return the augmented Cedar schema text.

Rust mapping: LoweredPolicySet::cedar_schema_str().

Return type:

str

is_self_contained_cedar()[source]#

Return whether exported Cedar is self-contained.

Rust mapping: LoweredPolicySet::is_self_contained_cedar(). Native support is not fully exposed yet; the Python fallback approximates this by checking whether parsed policies contain temporal clauses.

Return type:

bool

decide(event, history)[source]#
Parameters:

  • event (Any)

  • history (list[Any])

Return type:

Response