Add support for template-linked policies to SymCC

[katherine-hough]

Category

Cedar language or syntax features/changes

Describe the feature you'd like to request

Currently, SymCC does not support template-linked policies, only static policies. Supporting them would require the following changes:

• Update the symbolic compiler to support template-linked policies either by binding the slots during compilation or pre-processing the policies to bind the slots.
• Updating the type checks performed by symcc before symbolic compilation to handle template-linked policies.
• Add support for specifying linked policies to the symcc CLI subcommand.
• Update the SymCC fuzzing targets to test template-linked policies.

Describe alternatives you've considered

Manually converting template-linked policies into static policies.

Additional context

No response

Is this something that you'd be interested in working on?

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

[john-h-kastner-aws]

@sophrica points out that we also do not support links in TPE.

There's some overlap in work here, mainly:

Updating the type checks performed by symcc before symbolic compilation to handle template-linked policies.

The per-env-typecheck done before tpe/symcc is the same

and

Update the symbolic compiler to support template-linked policies either by binding the slots during compilation or pre-processing the policies to bind the slots.

is identical if we go implement it as a pre-processing pass

[john-h-kastner-aws]

Some work towards this already completed:

• Generate templates in fuzz targets cedar-spec#933 adds the framework for fuzzing with abac templates, so extending this to symcc targets should be trivial
• Support template links in TPE #2318 added some utilities for typechecking a specific template link in a single environment. Updating symcc to use these should also be easy