Comprehension indexing feature
Some embodiments of the invention provide a method for defining code-based policies. The method generates a policy-builder first view of a policy for display in a graphical user interface (GUI) by processing a syntax tree that is generated from a code second view of the policy. The method receives, through the policy-builder first view, a modification to a portion of the policy. To reflect the modification, the method updates a portion of the syntax tree that corresponds to the portion of the policy that is affected by the modification. Based on the updating of the syntax tree, the method updates the code second view by modifying a portion of the code second view that corresponds to the updated portion of the syntax tree.
1. For a policy agent that executes on a host computer to process API-authorization requests from at least one application executing on the host computer, a method for optimizing performance for policies that perform search operations on datasets, the method comprising:
for a particular API-authorization policy, performing an offline first process (i) to identify one or more statements in the particular API-authorization policy that can be indexed and (ii) to generate an index for the particular API-authorization policy to map each identified statement to a set of associated index keys; and
for each statement in the generated index, performing an online second process (i) to evaluate the statement using available input data and (ii) to generate a tree structure comprising results of the evaluation, wherein the tree structure is keyed by the set of associated index keys from the index.
2. The method of claim 1 , wherein the set of associated index keys correspond to names of variables in the particular policy.
3. The method of claim 1 , wherein the set of associated index keys are organized in a deterministic order.
4. The method of claim 1 , wherein performing the first process to identify one or more statements in the particular policy that can be indexed comprises analyzing the particular policy to identify statements that match a particular pattern.
5. The method of claim 1 , wherein the policy agent builds a tree structure for each statement in the particular policy once.
6. The method of claim 1 , wherein performing the second process to evaluate each statement comprises evaluating each statement in full using the available input data.
7. The method of claim 1 , wherein the tree structure comprises (i) subtrees for each variable in the statement and (ii) leaves corresponding to possible values of each variable.
8. A non-transitory machine readable medium storing a comprehension indexing program for execution by at least one processing unit, the program for optimizing performance for policies that perform search operations on datasets, the program comprising sets of instructions for:
performing, for a particular API-authorization policy, an offline first process (i) to identify one or more statements in the particular API-authorization policy that can be indexed and (ii) to generate an index for the particular API-authorization policy to map each identified statement to a set of associated index keys; and
for each statement in the generated index, performing an online second process (i) to evaluate the statement using available input data and (ii) to generate a tree structure comprising results of the evaluation, wherein the tree structure is keyed by the set of associated index keys from the index.
9. The non-transitory machine readable medium of claim 8 , wherein the set of associated index keys correspond to names of variables in the particular policy.
10. The non-transitory machine readable medium of claim 8 , wherein the set of associated index keys are organized in a deterministic order.
11. The non-transitory machine readable medium of claim 8 , wherein the set of instructions for performing the first process to identify one or more statements in the particular policy that can be indexed comprises a set of instructions for analyzing the particular policy to identify statements that match a particular pattern.
12. The non-transitory machine readable medium of claim 8 , wherein a tree structure is built for each statement in the particular policy once.
13. The non-transitory machine readable medium of claim 8 , wherein the set of instructions for performing the second process to evaluate each statement further comprises a set of instructions for evaluating each statement in full using the available input data.
14. The non-transitory machine readable medium of claim 8 , wherein the tree structure comprises (i) subtrees for each variable in the statement and (ii) leaves corresponding to possible values of each variable.