diff --git a/cedar-policy-core/src/parser/cst_to_ast.rs b/cedar-policy-core/src/parser/cst_to_ast.rs index 48a4fd37c..957b0b867 100644 --- a/cedar-policy-core/src/parser/cst_to_ast.rs +++ b/cedar-policy-core/src/parser/cst_to_ast.rs @@ -915,7 +915,7 @@ impl RefKind for SingleEntity { impl RefKind for EntityReference { fn err_str() -> &'static str { - "entity uid or template slot" + "entity uid or matching template slot" } fn create_slot(_: &mut ParseErrors) -> Option { @@ -1639,7 +1639,7 @@ impl ASTNode> { if slot.matches(var) { Ok(T::create_slot(errs)) } else { - Err(format!("?{slot}")) + Err(format!("{slot} instead of ?{var}")) } } cst::Primary::Literal(_) => Err("literal".to_string()), @@ -3774,13 +3774,21 @@ mod tests { #[test] fn is_err() { let invalid_is_policies = [ + ( + r#"permit(principal == ?resource, action, resource);"#, + "?resource instead of ?principal", + ), + ( + r#"permit(principal, action, resource == ?principal);"#, + "?principal instead of ?resource", + ), ( r#"permit(principal in Group::"friends" is User, action, resource);"#, - "expected a entity uid or template slot", + "expected a entity uid or matching template slot", ), ( r#"permit(principal, action, resource in Folder::"folder" is File);"#, - "expected a entity uid or template slot", + "expected a entity uid or matching template slot", ), ( r#"permit(principal is User == User::"Alice", action, resource);"#, @@ -3800,11 +3808,11 @@ mod tests { ), ( r#"permit(principal is User in 1, action, resource);"#, - "expected a entity uid or template slot, found a `literal` statement", + "expected a entity uid or matching template slot, found a `literal` statement", ), ( r#"permit(principal, action, resource is File in 1);"#, - "expected a entity uid or template slot, found a `literal` statement", + "expected a entity uid or matching template slot, found a `literal` statement", ), ( r#"permit(principal is 1, action, resource);"#, @@ -3824,11 +3832,11 @@ mod tests { ), ( r#"permit(principal is User in ?resource, action, resource);"#, - "expected a entity uid or template slot", + "expected a entity uid or matching template slot", ), ( r#"permit(principal, action, resource is Folder in ?principal);"#, - "expected a entity uid or template slot", + "expected a entity uid or matching template slot", ), ( r#"permit(principal, action, resource) when { principal is 1 };"#,