Module cedar 

Cedar policy engine integration (DW-060, CFG-07 / #241: hot reload).

This module provides a thin wrapper around the cedar-policy crate, offering:

• CedarAuthorizer — a compiled Cedar policy set + entity store, ready to evaluate authorization requests.
• CedarRequest — an authorization request (principal, action, resource, context).
• CedarDecision — the authorization decision (Allow or Deny).
• HotReloadCedarAuthorizer — a hot-reloadable wrapper that swaps the compiled policy set atomically without blocking the request path (DP-07, #241).

Design (section 6-Extensibility, §9.3)

Cedar is Rust-native (AWS), so authz becomes fine-grained data (policies), not code, without an FFI boundary. Policies are compiled once at config publish time and embedded in the snapshot. The request path only evaluates — it never parses or compiles.

Hot reload (CFG-07, #241)

The HotReloadCedarAuthorizer wraps a CedarAuthorizer in an ArcSwap, allowing the policy set to be swapped atomically without blocking the request path. The reload compiles the new policy set on a background task and then swaps the Arc in a single atomic operation. The request path always reads the current generation via ArcSwap::load, which is a single relaxed load.

Modules

opa

OPA (Open Policy Agent) HTTP callout with decision caching (DW-060, DP-07 / #241: async hyper_util client, bundle download, TLS).

Structs

CedarAuthorizer

A compiled Cedar authorizer: a policy set + entity store, ready to evaluate authorization requests.

CedarRequest

A Cedar authorization request.

HotReloadCedarAuthorizer

A hot-reloadable Cedar authorizer (CFG-07, #241). Wraps a CedarAuthorizer in an ArcSwap so the policy set can be swapped atomically without blocking the request path.

Enums

CedarDecision

The result of a Cedar authorization check.

CedarError

An error from the Cedar policy engine.