Expand description
OPA (Open Policy Agent) HTTP callout with decision caching (DW-060, DP-07 / #241: async hyper_util client, bundle download, TLS).
OPA is a Go-based policy engine that we call via HTTP. To keep the callout inside the authz latency budget, we cache decisions by request key. The cache is a simple TTL-based map — no external dependency, no eviction thread (entries expire on read).
§Design (section 6-Extensibility)
The decision cache exists specifically to keep the HTTP/bundle callout inside the authz latency budget rather than dialing out per request. On a cache hit, the decision is returned without any HTTP call. On a cache miss, the callout is made and the result is cached.
§Async client (DP-07, #241)
The OPA callout was previously a blocking TCP client wrapped in
spawn_blocking. It is now an async hyper_util client that runs
on the tokio runtime directly, avoiding thread-pool overhead and
supporting TLS via tokio-rustls.
§Bundle download (DP-07, #241)
When configured with a bundle URL, the client periodically downloads
the OPA bundle (a tar.gz of compiled policies + data) and reloads
the local decision endpoint. The bundle’s revision field is used
as a generation marker: the client only reloads when the revision
changes, avoiding unnecessary re-parsing.
§Feature gate
The cedar cargo feature must be enabled (OPA callout is part of
the same feature as Cedar — both are “external policy engine”
integrations).
Structs§
- OpaClient
- OPA HTTP callout client with a TTL-based decision cache.
- OpaRequest
- An OPA authorization request.
Enums§
- OpaDecision
- The result of an OPA authorization check.
- OpaError
- An error from the OPA client.