chore: Fixed the Python bindings build after the dev branch merge: updated Cargo.toml and builtins.rs to use the new cpex-builtins facade, then resolved two clippy lint failures.

Signed-off-by: habeck <habeck@us.ibm.com>

Author: tedhabeck

Cargo.lock

@@ -28,19 +28,21 @@ name = "_lib"
 crate-type = ["cdylib"]
 
 [dependencies]
-cpex-core = { path = "../../crates/cpex-core" }
+cpex-core = { workspace = true }
 
 # APL governance layer — same set as cpex-ffi so bundled factories are
 # available to Python callers. Keep in sync with crates/cpex-ffi/Cargo.toml.
-apl-cpex = { path = "../../crates/apl-cpex" }
-apl-pii-scanner = { path = "../../crates/apl-pii-scanner" }
-apl-audit-logger = { path = "../../crates/apl-audit-logger" }
-apl-identity-jwt = { path = "../../crates/apl-identity-jwt" }
-apl-delegator-oauth = { path = "../../crates/apl-delegator-oauth" }
-apl-pdp-cedar-direct = { path = "../../crates/apl-pdp-cedar-direct" }
-
-# Heavy Cedarling deps behind an opt-in feature — off by default.
-apl-cedarling = { path = "../../crates/apl-cedarling", optional = true }
+apl-cpex = { workspace = true }
+# The builtin extension set — mirrors the feature set shipped by cpex-ffi.
+cpex-builtins = { workspace = true, default-features = false, features = [
+    "pii-scanner",
+    "audit-logger",
+    "identity-jwt",
+    "delegator-oauth",
+    "cedar-direct",
+    "cel",
+    "valkey",
+] }
 
 serde = { workspace = true }
 serde_json = { workspace = true }
@@ -56,4 +58,3 @@ pyo3-async-runtimes = { version = "0.29", features = ["tokio-runtime"] }
 
 [features]
 default = []
-cedarling = ["dep:apl-cedarling"]

bindings/python/Cargo.toml

@@ -8,50 +8,14 @@
 // passed to `load_config_yaml` so the APL visitor's `Weak<PluginManager>`
 // upgrades correctly during load.
 //
-// Mirrors `crates/cpex-ffi/src/apl.rs:56` exactly — any new bundled factory
-// added to cpex-ffi should be added here too.
-//
-// Ordering (per apl.rs header comment):
-//   PluginManager::default()
-//     → register_builtin_factories (this function)
-//       → load_config_yaml
-//         → initialize
+// Delegates to `cpex_builtins::install_builtins`, which mirrors the factory
+// set shipped by cpex-ffi. Any new builtin added to cpex-builtins is
+// automatically included here via the shared feature flags.
 
 use std::sync::Arc;
 
 use cpex_core::manager::PluginManager;
 
 pub fn register_builtin_factories(manager: &Arc<PluginManager>) {
-    // Plugin factories — registered by `kind` string. Must happen before
-    // load_config_yaml so the manager can instantiate plugins whose YAML
-    // `kind:` matches.
-    manager.register_factory(
-        apl_pii_scanner::KIND,
-        Box::new(apl_pii_scanner::PiiScannerFactory),
-    );
-    manager.register_factory(
-        apl_audit_logger::KIND,
-        Box::new(apl_audit_logger::AuditLoggerFactory),
-    );
-    manager.register_factory(
-        apl_identity_jwt::KIND,
-        Box::new(apl_identity_jwt::JwtIdentityFactory),
-    );
-    manager.register_factory(
-        apl_delegator_oauth::KIND,
-        Box::new(apl_delegator_oauth::OAuthDelegatorFactory),
-    );
-
-    // APL config visitor + PDP factories.
-    let mut opts = apl_cpex::AplOptions::in_process();
-    opts.pdp_factories = vec![Arc::new(apl_pdp_cedar_direct::CedarDirectPdpFactory::new())];
-    apl_cpex::register_apl(manager, opts);
-
-    // Cedarling-backed identity + PDP seams (opt-in; heavy deps).
-    #[cfg(feature = "cedarling")]
-    {
-        // Wire Cedarling factories when the feature is enabled.
-        // Keep in sync with cpex-ffi's cedarling feature block in apl.rs.
-        let _ = manager; // suppress unused-variable warning if no-op
-    }
+    cpex_builtins::install_builtins(manager);
 }

bindings/python/src/builtins.rs

@@ -43,7 +43,11 @@ cpex_core::impl_plugin_payload!(GenericPayload);
 /// (with `str` keys). Any other type raises `ValueError` naming the type.
 ///
 /// Recursion is capped at 128 levels (R3). `depth` starts at 0.
-pub fn pyobj_to_json_value(py: Python<'_>, obj: &Bound<'_, PyAny>, depth: usize) -> PyResult<Value> {
+pub fn pyobj_to_json_value(
+    _py: Python<'_>,
+    obj: &Bound<'_, PyAny>,
+    depth: usize,
+) -> PyResult<Value> {
     if depth > 128 {
         return Err(PyValueError::new_err(
             "cpex: value nesting exceeds maximum depth of 128 levels",
@@ -75,19 +79,17 @@ pub fn pyobj_to_json_value(py: Python<'_>, obj: &Bound<'_, PyAny>, depth: usize)
     if let Ok(lst) = obj.cast::<PyList>() {
         let mut out = Vec::with_capacity(lst.len());
         for item in lst.iter() {
-            out.push(pyobj_to_json_value(py, &item, depth + 1)?);
+            out.push(pyobj_to_json_value(_py, &item, depth + 1)?);
         }
         return Ok(Value::Array(out));
     }
     if let Ok(d) = obj.cast::<PyDict>() {
         let mut map = Map::with_capacity(d.len());
         for (k, v) in d.iter() {
             let key: String = k.extract().map_err(|_| {
-                PyValueError::new_err(
-                    "cpex: dict keys must be strings; got a non-string key",
-                )
+                PyValueError::new_err("cpex: dict keys must be strings; got a non-string key")
             })?;
-            map.insert(key, pyobj_to_json_value(py, &v, depth + 1)?);
+            map.insert(key, pyobj_to_json_value(_py, &v, depth + 1)?);
         }
         return Ok(Value::Object(map));
     }
@@ -124,22 +126,22 @@ pub fn json_value_to_pyobj<'py>(py: Python<'py>, v: &Value) -> PyResult<Bound<'p
                     "cpex: JSON number {n} is out of range for Python"
                 )))
             }
-        }
+        },
         Value::String(s) => Ok(s.into_pyobject(py)?.into_any()),
         Value::Array(arr) => {
             let lst = PyList::empty(py);
             for item in arr {
                 lst.append(json_value_to_pyobj(py, item)?)?;
             }
             Ok(lst.into_any())
-        }
+        },
         Value::Object(map) => {
             let d = PyDict::new(py);
             for (k, val) in map {
                 d.set_item(k, json_value_to_pyobj(py, val)?)?;
             }
             Ok(d.into_any())
-        }
+        },
     }
 }
 
@@ -198,9 +200,8 @@ pub fn serialize_payload(payload: &dyn PluginPayload) -> Option<Value> {
 ///
 /// An empty dict yields `Extensions::default()` (all fields `#[serde(default)]`).
 pub fn extensions_from_value(value: Value) -> PyResult<Extensions> {
-    serde_json::from_value(value).map_err(|e| {
-        PyValueError::new_err(format!("cpex: extensions conversion failed: {e}"))
-    })
+    serde_json::from_value(value)
+        .map_err(|e| PyValueError::new_err(format!("cpex: extensions conversion failed: {e}")))
 }
 
 /// Deserialize Python dict → `Option<PluginContextTable>` via serde.

bindings/python/src/conversions.rs

@@ -20,14 +20,15 @@ use pyo3::PyErr;
 /// path — denials surface as `PipelineResult { continue_processing: false,
 /// violation: Some(...) }`, never as an `Err`. Kept here as a defensive
 /// catch-all that maps to `RuntimeError`.
+#[allow(clippy::boxed_local)]
 pub fn plugin_error_to_pyerr(e: Box<PluginError>) -> PyErr {
     match *e {
         PluginError::Config { message } => {
             PyValueError::new_err(format!("cpex config error: {message}"))
-        }
+        },
         PluginError::UnknownHook { hook_type } => {
             PyValueError::new_err(format!("cpex unknown hook type: {hook_type}"))
-        }
+        },
         PluginError::Timeout {
             plugin_name,
             timeout_ms,

bindings/python/src/error.rs

@@ -36,15 +36,15 @@ fn worker_threads_from_env() -> Option<usize> {
                 ENV_WORKER_THREADS,
             );
             Some(n)
-        }
+        },
         _ => {
             tracing::warn!(
                 "cpex-python: {}={:?} is not a positive integer; using num_cpus default",
                 ENV_WORKER_THREADS,
                 raw,
             );
             None
-        }
+        },
     }
 }
 

bindings/python/src/lib.rs

@@ -67,7 +67,9 @@ impl PyPluginManager {
 
         let manager = Arc::new(PluginManager::default());
         register_builtin_factories(&manager);
-        manager.load_config_yaml(&yaml).map_err(plugin_error_to_pyerr)?;
+        manager
+            .load_config_yaml(&yaml)
+            .map_err(plugin_error_to_pyerr)?;
 
         Ok(Self { inner: manager })
     }
@@ -164,8 +166,9 @@ impl PyPluginManager {
         // runtime — the outer timeout ensures we never block indefinitely.
         future_into_py(py, async move {
             let result = tokio::time::timeout(PY_WALL_CLOCK_TIMEOUT, async move {
-                let (pipeline_result, _bg_tasks) =
-                    manager.invoke_by_name(&hook_name, rust_payload, rust_extensions, rust_context).await;
+                let (pipeline_result, _bg_tasks) = manager
+                    .invoke_by_name(&hook_name, rust_payload, rust_extensions, rust_context)
+                    .await;
                 // _bg_tasks dropped here; fire-and-forget tasks keep running
                 // on the manager's TaskTracker and are drained by shutdown() (KD4).
                 pipeline_result_to_py(pipeline_result)

bindings/python/src/manager.rs

@@ -15,8 +15,8 @@
 
 use std::collections::HashMap;
 
-use cpex_core::executor::PipelineResult;
 use cpex_core::error::PluginErrorRecord;
+use cpex_core::executor::PipelineResult;
 use pyo3::prelude::*;
 use pyo3::types::PyDict;
 use serde_json::Value;
@@ -52,7 +52,7 @@ impl PyPipelineResult {
                         "cpex: modified_payload is not a dict",
                     )
                 })?))
-            }
+            },
         }
     }
 
@@ -67,7 +67,7 @@ impl PyPipelineResult {
                         "cpex: modified_extensions is not a dict",
                     )
                 })?))
-            }
+            },
         }
     }
 
@@ -78,11 +78,9 @@ impl PyPipelineResult {
             Some(v) => {
                 let obj = json_value_to_pyobj(py, v)?;
                 Ok(Some(obj.cast_into::<PyDict>().map_err(|_| {
-                    pyo3::exceptions::PyRuntimeError::new_err(
-                        "cpex: violation is not a dict",
-                    )
+                    pyo3::exceptions::PyRuntimeError::new_err("cpex: violation is not a dict")
                 })?))
-            }
+            },
         }
     }
 
@@ -93,9 +91,7 @@ impl PyPipelineResult {
             .map(|v| {
                 let obj = json_value_to_pyobj(py, v)?;
                 obj.cast_into::<PyDict>().map_err(|_| {
-                    pyo3::exceptions::PyRuntimeError::new_err(
-                        "cpex: error entry is not a dict",
-                    )
+                    pyo3::exceptions::PyRuntimeError::new_err("cpex: error entry is not a dict")
                 })
             })
             .collect()
@@ -108,11 +104,9 @@ impl PyPipelineResult {
             Some(v) => {
                 let obj = json_value_to_pyobj(py, v)?;
                 Ok(Some(obj.cast_into::<PyDict>().map_err(|_| {
-                    pyo3::exceptions::PyRuntimeError::new_err(
-                        "cpex: metadata is not a dict",
-                    )
+                    pyo3::exceptions::PyRuntimeError::new_err("cpex: metadata is not a dict")
                 })?))
-            }
+            },
         }
     }
 
@@ -128,7 +122,11 @@ impl PyPipelineResult {
         format!(
             "PipelineResult(continue_processing={}, violation={}, errors={})",
             self.continue_processing,
-            if self.violation.is_some() { "Some(...)" } else { "None" },
+            if self.violation.is_some() {
+                "Some(...)"
+            } else {
+                "None"
+            },
             self.errors.len(),
         )
     }
@@ -150,9 +148,7 @@ pub fn pipeline_result_to_py(mut result: PipelineResult) -> PyResult<PyPipelineR
         Some(p) => match serialize_payload(p.as_ref()) {
             Some(v) => Some(v),
             None => {
-                tracing::warn!(
-                    "cpex-python: modified payload could not be serialised; dropping"
-                );
+                tracing::warn!("cpex-python: modified payload could not be serialised; dropping");
                 result.errors.push(PluginErrorRecord {
                     plugin_name: "<py>".to_string(),
                     message: "modified payload could not be serialised across the PyO3 boundary"
@@ -162,7 +158,7 @@ pub fn pipeline_result_to_py(mut result: PipelineResult) -> PyResult<PyPipelineR
                     proto_error_code: None,
                 });
                 None
-            }
+            },
         },
     };