Skip to content

Fix/cedar plugin optimization#2554

Merged
crivetimihai merged 3 commits intoIBM:mainfrom
monshri:fix/cedar_plugin_optimization
Feb 7, 2026
Merged

Fix/cedar plugin optimization#2554
crivetimihai merged 3 commits intoIBM:mainfrom
monshri:fix/cedar_plugin_optimization

Conversation

@monshri
Copy link
Copy Markdown
Collaborator

@monshri monshri commented Jan 28, 2026 •
edited
Loading

This PR introduces a set of performance, functionality, and documentation enhancements to improve the Cedar policy plugin’s efficiency, reliability, and integration with the gateway.

Key Changes

Performance Optimizations:
Converted synchronous CedarPy calls to asynchronous execution, implemented batch-based policy evaluation, moved regex compilation to the plugin initialization phase (single-run execution), improved error handling, and aligned the plugin with the latest plugin framework updates.

User Context & Role Handling:
Added logic to process user context propagated from the gateway and determine administrative roles dynamically based on that context.

End-to-End Policy Flow & Documentation:
Verified end-to-end policy evaluation from the gateway UI and updated documentation to reflect the configuration and usage steps.

User context in Plugins Performance
Minor change in adding user context in test_plugins_performance.py

Here, is the performance detail in permissive mode:

image

@monshri monshri requested a review from crivetimihai as a code owner January 28, 2026 21:24
@monshri monshri self-assigned this Jan 28, 2026
@monshri monshri marked this pull request as draft January 28, 2026 21:24
@monshri monshri requested review from araujof and terylt February 3, 2026 19:13
@monshri monshri added security Improves security performance Performance related items plugins enhancement New feature or request labels Feb 3, 2026
@monshri monshri marked this pull request as ready for review February 3, 2026 19:14
@crivetimihai
Copy link
Copy Markdown
Member

crivetimihai commented Feb 4, 2026

Thanks for the Cedar plugin optimization, @monshri. The async conversion, batch evaluation, and compile-once regex are solid performance improvements.

This has been open for a while with the approved label — is it ready to merge? If so, please rebase against main to pick up any recent changes.

@crivetimihai crivetimihai self-assigned this Feb 4, 2026
monshri and others added 3 commits February 7, 2026 14:13
@monshri @crivetimihai
fix(cedar-plugin): optimize Cedar policy evaluation with async and ba…
48a5324 
…tch support

- Convert synchronous CedarPy calls to async via asyncio.to_thread
- Implement batch policy evaluation using is_authorized_batch
- Move regex compilation and policy parsing to plugin initialization
- Add user context handling from gateway (is_admin role detection)
- Add recursive output redaction with configurable redaction string
- Add server_id extraction from gateway metadata with fallback
- Add correlation_id support for batch request tracking
- Add example configs and end-to-end testing documentation
- Update tests for new redaction_str configuration field

Signed-off-by: Shriti Priya <shritip@ibm.com>
Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>
@crivetimihai
fix(cedar-plugin): address review issues in cedar plugin optimization
79e2f3b 
- Initialize _output_redaction_string with default to prevent AttributeError
- Replace mutable default arguments (dict) with None in _preprocess_request
- Use public diagnostics attribute instead of private _diagnostics
- Use ToolHookType enums consistently instead of hardcoded strings
- Fix wrong docstring on _create_dsl_policy_template (was copy-pasted)
- Remove duplicate docstring in tool_post_invoke
- Simplify redundant conditionals in _get_output_request_list
- Fix stale OPA references in resource hook docstrings
- Remove near-duplicate example config (keep config-cedar.yaml)

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>
@crivetimihai
lint
a1b2bdb 
Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>
@crivetimihai crivetimihai force-pushed the fix/cedar_plugin_optimization branch from c6a15e4 to 79e2f3b Compare February 7, 2026 14:24
@crivetimihai
Copy link
Copy Markdown
Member

crivetimihai commented Feb 7, 2026

Rebase & Review Changes

Rebased onto main, squashed 22 commits into 2 clean commits, and applied the following fixes:

Bugs Fixed

  • _output_redaction_string uninitialized: Added default "[REDACTED]" — previously would AttributeError if policy_redaction_spec was None and redaction code path was reached
  • Mutable default arguments: _preprocess_request(user: dict = {}, ..., context: dict = {}) used shared mutable defaults — changed to None with defaulting inside the method body
  • Private attribute access: result._diagnostics.errors → result.diagnostics.errors (public API)

Consistency Fixes

  • Hook type enums: Tool hooks used hardcoded strings ("tool_pre_invoke") while prompt/resource hooks used enums — now uses ToolHookType.TOOL_PRE_INVOKE / ToolHookType.TOOL_POST_INVOKE consistently
  • Stale OPA references: resource_pre_fetch and resource_post_fetch docstrings still referenced "rego policies" and "opa server" — updated to "cedar policies"

Cleanup

  • Duplicate docstring: tool_post_invoke had the same docstring block twice — removed duplicate
  • Redundant conditionals: _get_output_request_list() had 4 identical if branches all assigning resource = payload — simplified
  • Wrong docstring: _create_dsl_policy_template docstring said "Sets user role mapping from jwt tokens" (copy-pasted from _set_jwt_info) — corrected
  • Duplicate example config: examples/config.yaml was identical to examples/config-cedar.yaml except missing include_user_info: true (which makes it a broken config for Cedar) — removed it

Tests

  • All 12 cedar plugin tests pass
  • All 924 gateway plugin tests pass

@crivetimihai crivetimihai merged commit 244f38c into IBM:main Feb 7, 2026
43 checks passed
@araujof araujof mentioned this pull request Feb 19, 2026
Closed
30 tasks
kcostell06 pushed a commit to kcostell06/mcp-context-forge that referenced this pull request Feb 24, 2026
@monshri @crivetimihai
Fix/cedar plugin optimization (IBM#2554)
b87fecc 
* fix(cedar-plugin): optimize Cedar policy evaluation with async and batch support

- Convert synchronous CedarPy calls to async via asyncio.to_thread
- Implement batch policy evaluation using is_authorized_batch
- Move regex compilation and policy parsing to plugin initialization
- Add user context handling from gateway (is_admin role detection)
- Add recursive output redaction with configurable redaction string
- Add server_id extraction from gateway metadata with fallback
- Add correlation_id support for batch request tracking
- Add example configs and end-to-end testing documentation
- Update tests for new redaction_str configuration field

Signed-off-by: Shriti Priya <shritip@ibm.com>
Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

* fix(cedar-plugin): address review issues in cedar plugin optimization

- Initialize _output_redaction_string with default to prevent AttributeError
- Replace mutable default arguments (dict) with None in _preprocess_request
- Use public diagnostics attribute instead of private _diagnostics
- Use ToolHookType enums consistently instead of hardcoded strings
- Fix wrong docstring on _create_dsl_policy_template (was copy-pasted)
- Remove duplicate docstring in tool_post_invoke
- Simplify redundant conditionals in _get_output_request_list
- Fix stale OPA references in resource hook docstrings
- Remove near-duplicate example config (keep config-cedar.yaml)

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

* lint

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

---------

Signed-off-by: Shriti Priya <shritip@ibm.com>
Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>
Co-authored-by: Mihai Criveti <crivetimihai@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@crivetimihai crivetimihai crivetimihai approved these changes

@araujof araujof Awaiting requested review from araujof

@terylt terylt Awaiting requested review from terylt

@kevalmahajan kevalmahajan Awaiting requested review from kevalmahajan kevalmahajan is a code owner

@madhav165 madhav165 Awaiting requested review from madhav165 madhav165 is a code owner

Assignees

@crivetimihai crivetimihai

@monshri monshri

Labels

enhancement New feature or request performance Performance related items plugins security Improves security

Projects

None yet

Milestone

Release 1.0.0-RC1

Development

Successfully merging this pull request may close these issues.

2 participants

@monshri @crivetimihai