Comprehension indexing feature
Some embodiments of the invention provide a method for defining code-based policies. The method generates a policy-builder first view of a policy for display in a graphical user interface (GUI) by processing a syntax tree that is generated from a code second view of the policy. The method receives, through the policy-builder first view, a modification to a portion of the policy. To reflect the modification, the method updates a portion of the syntax tree that corresponds to the portion of the policy that is affected by the modification. Based on the updating of the syntax tree, the method updates the code second view by modifying a portion of the code second view that corresponds to the updated portion of the syntax tree.
1. For a policy agent that executes on a host computer to process API-authorization requests from at least one application executing on the host computer, a method for optimizing performance for policies that perform search operations on datasets, the method comprising:
receiving an API-authorization request to authorize;
using a pre-generated index to generate a tree structure, wherein the pre-generated index is generated before the API-authorization request is received to speed up processing of the API-authorization request that is subsequently received; and
using the generated tree structure to evaluate whether the API-authorization request should be authorized.
2. The method of claim 1 , wherein the pre-generated index is associated with a particular API-authorization policy.
3. The method of claim 2 , wherein the pre-generated index is generated by performing an offline process for the particular API-authorization policy, wherein the offline process identifies one or more statements in the particular API-authorization policy that can be indexed.
4. The method of claim 3 , wherein the pre-generated index maps each identified statement in the particular API-authorization policy to a set of associated index keys.
5. The method of claim 4 , wherein the associated index keys of the set of associated index keys correspond to names of variables in the particular API-authorization policy.
6. The method of claim 3 , wherein identifying the one or more statements in the particular API-authorization policy that can be indexed comprises analyzing the particular API-authorization policy to identify statements that match a particular pattern.
7. The method of claim 4 , wherein the offline process is an offline first process, wherein generating the tree structure comprises, for each statement in the pre-generated index, performing an online second process (i) to evaluate the statement using available input data and (ii) to generate the tree structure comprising results of the evaluation.
8. The method of claim 7 , wherein the tree structure is keyed by the set of associated index keys from the index.
9. The method of claim 7 , wherein the tree structure comprises, for each statement in the pre-generated index, (i) subtrees for each variable in the statement and (ii) leaves corresponding to possible values of each variable.
10. The method of claim 7 , wherein performing the online second process to evaluate each statement comprises evaluating each statement in full using the available input data.
11. A non-transitory machine readable medium storing a comprehension indexing program for execution by at least one processing unit, the program for optimizing performance for policies that perform search operations on datasets, the program comprising sets of instructions for:
receiving an API-authorization request to authorize;
using a pre-generated index to generate a tree structure, wherein the pre-generated index is generated before the API-authorization request is received to speed up processing of the API-authorization request that is subsequently received; and
using the generated tree structure to evaluate whether the API-authorization request should be authorized.
12. The non-transitory machine readable medium of claim 11 , wherein the pre-generated index is associated with a particular API-authorization policy.
13. The non-transitory machine readable medium of claim 12 , wherein the pre-generated index is generated by performing an offline process for the particular API-authorization policy, wherein the offline process identifies one or more statements in the particular API-authorization policy that can be indexed.
14. The non-transitory machine readable medium of claim 13 , wherein the pre-generated index maps each identified statement in the particular API-authorization policy to a set of associated index keys.
15. The non-transitory machine readable medium of claim 14 , wherein the associated index keys of the set of associated index keys correspond to names of variables in the particular API-authorization policy.
16. The non-transitory machine readable medium of claim 13 , wherein the set of instructions for identifying the one or more statements in the particular API-authorization policy that can be indexed comprises a set of instructions for analyzing the particular API-authorization policy to identify statements that match a particular pattern.
17. The non-transitory machine readable medium of claim 14 , wherein the offline process is an offline first process, wherein the set of instructions for generating the tree structure comprises a set of instructions for performing, for each statement in the pre-generated index, an online second process (i) to evaluate the statement using available input data and (ii) to generate the tree structure comprising results of the evaluation.
18. The non-transitory machine readable medium of claim 17 , wherein the tree structure is keyed by the set of associated index keys from the index.
19. The non-transitory machine readable medium of claim 17 , wherein the tree structure comprises, for each statement in the pre-generated index, (i) subtrees for each variable in the statement and (ii) leaves corresponding to possible values of each variable.
20. The non-transitory machine readable medium of claim 17 , wherein the set of instructions for performing the online second process to evaluate each statement comprises a set of instructions for evaluating each statement in full using the available input data.