feat(jans-cedarling): Support Initializing Cedarling with .cjar Bytes in UniFFI Bindings (#13548)

haileyesus2433 · web-flow · commit e14944d64440 · 2026-03-21T18:46:22.000+03:00
* feat(jans-cedarling): add load_from_json_with_archive_bytes method to uniffi bindings

Signed-off-by: haileyesus2433 &lt;haileyesusbe@gmail.com&gt;

* docs: enhance Cedarling initialization with new loading methods

- Introduced `load_from_json_with_archive_bytes` method, allowing Cedarling instances to be initialized with a JSON string and raw bytes of a Cedar archive, improving flexibility for environments like Android.
- Added usage examples in Kotlin and Swift for the new loading method, enhancing developer guidance.

Signed-off-by: haileyesus2433 &lt;haileyesusbe@gmail.com&gt;

* fix(jans-cedarling): add blank line

Signed-off-by: haileyesus2433 &lt;haileyesusbe@gmail.com&gt;

---------

Signed-off-by: haileyesus2433 &lt;haileyesusbe@gmail.com&gt;
diff --git a/docs/cedarling/developer/mobile-apps/cedarling-uniffi.md b/docs/cedarling/developer/mobile-apps/cedarling-uniffi.md
@@ -45,7 +45,34 @@ Speaking about Cedarling, it interacts with outside world mainly using 3 interfa
   **Usage in Kotlin:**
 
   ```declarative
-  val cedarling: Cedarling = Cedarling.loadFromJson("/path/to/config.json")
+  val cedarling: Cedarling = Cedarling.loadFromFile("/path/to/config.json")
+  ```
+
+- **Cedarling::load_from_json_with_archive_bytes**
+
+   Loads a Cedarling instance from a bootstrap JSON string plus the raw bytes of a Cedar archive (`.cjar`). Use this when the host cannot pass a policy store path—for example **Android `assets/`** read via `AssetManager`. Fields `CEDARLING_POLICY_STORE_LOCAL`, `CEDARLING_POLICY_STORE_URI`, and `CEDARLING_POLICY_STORE_LOCAL_FN` in the JSON are ignored; the archive bytes are the policy source (same idea as WASM `init_from_archive_bytes`).
+
+   ```declarative
+   #[uniffi::constructor]
+   pub fn load_from_json_with_archive_bytes(
+       config: String,
+       archive_bytes: Vec<u8>,
+   ) -> Result<Self, CedarlingError>
+   ```
+
+   **Usage in Swift:**
+
+   ```declarative
+   let cedarling = try Cedarling.loadFromJsonWithArchiveBytes(
+       config: configJson,
+       archiveBytes: cjarData
+   )
+   ```
+
+  **Usage in Kotlin:**
+
+  ```declarative
+  val cedarling = Cedarling.loadFromJsonWithArchiveBytes(configJson, cjarBytes)
   ```
 
 - **Cedarling::authorizeUnsigned**
diff --git a/jans-cedarling/bindings/cedarling_uniffi/README.md b/jans-cedarling/bindings/cedarling_uniffi/README.md
@@ -215,6 +215,42 @@ Policy stores can be packaged as `.cjar` files (ZIP archives) for easy distribut
 - Works across all platforms
 - Supports integrity validation via manifest
 
+### Initializing Cedarling (UniFFI)
+
+Regenerate Kotlin/Swift bindings from the library (`uniffi-bindgen generate …`) so these constructors match your checkout. Exact method names and argument labels are in the generated `cedarling_uniffi.kt` / `cedarling_uniffi.swift`; the table below is a rough map from the Rust API:
+
+| Rust constructor | Kotlin (typical) | Swift (typical) |
+| --- | --- | --- |
+| `load_from_json` | `Cedarling.loadFromJson(...)` | `Cedarling.loadFromJson(config:)` |
+| `load_from_file` | `Cedarling.loadFromFile(...)` | `Cedarling.loadFromFile(path:)` |
+| `load_from_json_with_archive_bytes` | `Cedarling.loadFromJsonWithArchiveBytes(...)` | `Cedarling.loadFromJsonWithArchiveBytes(config:archiveBytes:)` |
+
+- **`load_from_json`** — Policy store location comes from the JSON (`CEDARLING_POLICY_STORE_LOCAL_FN`, `CEDARLING_POLICY_STORE_URI`, or `CEDARLING_POLICY_STORE_LOCAL`), same as core Cedarling bootstrap rules.
+- **`load_from_file`** — Load bootstrap from a path, then resolve the policy store from fields in that file.
+- **`load_from_json_with_archive_bytes`** — Pass the bootstrap JSON as a string **and** the raw bytes of a `.cjar` archive. Fields `CEDARLING_POLICY_STORE_LOCAL`, `CEDARLING_POLICY_STORE_URI`, and `CEDARLING_POLICY_STORE_LOCAL_FN` in the JSON are **ignored**; the archive is the only policy source. This mirrors the WASM helper `init_from_archive_bytes` and fits **Android `assets/`**, where you open files with `AssetManager` (no ordinary filesystem path for native code), or any host that already has the archive in memory.
+
+**Kotlin (Android assets):**
+
+```kotlin
+val bootstrapJson =
+    assets.open("bootstrap.json").bufferedReader().use { it.readText() }
+val archiveBytes = assets.open("policy-store.cjar").readBytes()
+val cedarling = Cedarling.loadFromJsonWithArchiveBytes(bootstrapJson, archiveBytes)
+```
+
+**Swift (bundle resources):**
+
+```swift
+let bootstrapUrl = Bundle.main.url(forResource: "bootstrap", withExtension: "json")!
+let cjarUrl = Bundle.main.url(forResource: "policy-store", withExtension: "cjar")!
+let bootstrapJson = try String(contentsOf: bootstrapUrl)
+let archiveBytes = try Data(contentsOf: cjarUrl)
+let cedarling = try Cedarling.loadFromJsonWithArchiveBytes(
+    config: bootstrapJson,
+    archiveBytes: archiveBytes
+)
+```
+
 ### Authorization APIs
 
 The UniFFI binding exposes two authorization methods:
diff --git a/jans-cedarling/bindings/cedarling_uniffi/src/lib.rs b/jans-cedarling/bindings/cedarling_uniffi/src/lib.rs
@@ -6,7 +6,7 @@
 
 use cedarling::{
     self as core, BootstrapConfig, BootstrapConfigRaw, DataApi, DataEntry as CoreDataEntry,
-    DataStoreStats as CoreDataStoreStats, LogStorage,
+    DataStoreStats as CoreDataStoreStats, LogStorage, PolicyStoreSource,
 };
 use std::sync::Arc;
 mod result;
@@ -293,6 +293,43 @@ impl Cedarling {
         Ok(Self { inner: cedarling })
     }
 
+    /// Loads Cedarling from bootstrap JSON plus a Cedar archive (`.cjar`) as raw bytes.
+    ///
+    /// host cannot pass a filesystem path—for example Android assets loaded via `AssetManager`.
+    #[uniffi::constructor]
+    pub fn load_from_json_with_archive_bytes(
+        config: String,
+        archive_bytes: Vec<u8>,
+    ) -> Result<Self, CedarlingError> {
+        let mut raw_config: BootstrapConfigRaw =
+            serde_json::from_str(&config).map_err(|e| CedarlingError::InitializationFailed {
+                error_msg: e.to_string(),
+            })?;
+
+        raw_config.local_policy_store = None;
+        raw_config.policy_store_uri = None;
+        // Set a dummy .cjar file path to satisfy validation (will be overridden below)
+        raw_config.policy_store_local_fn = Some("dummy.cjar".to_string());
+
+        let mut bootstrap_config = BootstrapConfig::from_raw_config(&raw_config).map_err(|e| {
+            CedarlingError::InitializationFailed {
+                error_msg: e.to_string(),
+            }
+        })?;
+
+        // Override the policy store source with the archive bytes
+        bootstrap_config.policy_store_config.source =
+            PolicyStoreSource::ArchiveBytes(archive_bytes);
+
+        let cedarling = core::blocking::Cedarling::new(&bootstrap_config).map_err(|e| {
+            CedarlingError::InitializationFailed {
+                error_msg: e.to_string(),
+            }
+        })?;
+
+        Ok(Self { inner: cedarling })
+    }
+
     // Loads Cedarling instance from a configuration file
     #[uniffi::constructor]
     pub fn load_from_file(path: String) -> Result<Self, CedarlingError> {
diff --git a/jans-cedarling/bindings/cedarling_uniffi/src/tests.rs b/jans-cedarling/bindings/cedarling_uniffi/src/tests.rs
@@ -4,6 +4,7 @@
 // Copyright (c) 2024, Gluu, Inc.
 
 use crate::Cedarling;
+use crate::CedarlingError;
 use crate::{EntityData, JsonValue};
 use serde_json::json;
 use std::sync::Arc;
@@ -79,6 +80,19 @@ fn create_test_cedarling() -> Cedarling {
     .expect("Error in initializing Cedarling")
 }
 
+#[test]
+fn test_load_from_json_with_archive_bytes_rejects_invalid() {
+    let config =
+        std::fs::read_to_string("../../bindings/cedarling_uniffi/test_files/bootstrap.json")
+            .expect("bootstrap.json should be readable");
+    let result = Cedarling::load_from_json_with_archive_bytes(config, vec![0x00, 0x01, 0x02, 0x03]);
+    assert!(
+        matches!(&result, Err(CedarlingError::InitializationFailed { .. })),
+        "invalid archive bytes should yield InitializationFailed, is_ok={}",
+        result.is_ok()
+    );
+}
+
 #[test]
 fn test_data_api_push_and_get() {
     let cedarling = create_test_cedarling();
