pub struct HotReloadCedarAuthorizer { /* private fields */ }Expand description
A hot-reloadable Cedar authorizer (CFG-07, #241). Wraps a
CedarAuthorizer in an ArcSwap so the policy set can be
swapped atomically without blocking the request path.
The reload compiles the new policy set on the calling thread (or
a background task) and then swaps the Arc in a single atomic
store. The request path’s is_authorized call loads the current
generation via ArcSwap::load (a single relaxed load) and
evaluates against it — no lock, no I/O, no blocking.
Implementations§
Source§impl HotReloadCedarAuthorizer
impl HotReloadCedarAuthorizer
Sourcepub fn new(initial: CedarAuthorizer) -> Self
pub fn new(initial: CedarAuthorizer) -> Self
Create a new hot-reloadable authorizer from an initial
CedarAuthorizer.
Sourcepub fn from_sources(
policies_src: &str,
entities_json: Option<&str>,
schema_json: Option<&str>,
) -> Result<Self, CedarError>
pub fn from_sources( policies_src: &str, entities_json: Option<&str>, schema_json: Option<&str>, ) -> Result<Self, CedarError>
Create from raw policy/entity/schema sources (convenience).
Sourcepub fn reload(&self, new: CedarAuthorizer) -> CedarAuthorizer
pub fn reload(&self, new: CedarAuthorizer) -> CedarAuthorizer
Atomically swap the compiled policy set. The new authorizer
is compiled by the caller (typically on a background task)
and swapped in with a single atomic store. The request path
sees the new generation on its next is_authorized call.
Returns the previous authorizer (for drop/cleanup).
Sourcepub fn reload_from_sources(
&self,
policies_src: &str,
entities_json: Option<&str>,
schema_json: Option<&str>,
) -> Result<(), CedarError>
pub fn reload_from_sources( &self, policies_src: &str, entities_json: Option<&str>, schema_json: Option<&str>, ) -> Result<(), CedarError>
Reload from raw sources. Compiles the new policy set and swaps it in. Returns an error if compilation fails (the currently loaded generation is unchanged on error).
Evaluate an authorization request against the currently loaded
policy set. Loads the current generation via ArcSwap::load
(a single relaxed atomic load) and evaluates — no lock, no I/O.
Sourcepub fn policy_count(&self) -> usize
pub fn policy_count(&self) -> usize
The number of policies in the currently loaded set.
Sourcepub fn current(&self) -> CedarAuthorizer
pub fn current(&self) -> CedarAuthorizer
Get a clone of the currently loaded authorizer (for inspection or testing).
Auto Trait Implementations§
impl !Freeze for HotReloadCedarAuthorizer
impl RefUnwindSafe for HotReloadCedarAuthorizer
impl Send for HotReloadCedarAuthorizer
impl Sync for HotReloadCedarAuthorizer
impl Unpin for HotReloadCedarAuthorizer
impl UnwindSafe for HotReloadCedarAuthorizer
Blanket Implementations§
§impl<T> AnyExt for T
impl<T> AnyExt for T
§fn downcast_ref<T>(this: &Self) -> Option<&T>where
T: Any,
fn downcast_ref<T>(this: &Self) -> Option<&T>where
T: Any,
T behind reference§fn downcast_mut<T>(this: &mut Self) -> Option<&mut T>where
T: Any,
fn downcast_mut<T>(this: &mut Self) -> Option<&mut T>where
T: Any,
T behind mutable reference§fn downcast_rc<T>(this: Rc<Self>) -> Result<Rc<T>, Rc<Self>>where
T: Any,
fn downcast_rc<T>(this: Rc<Self>) -> Result<Rc<T>, Rc<Self>>where
T: Any,
T behind Rc pointer§fn downcast_arc<T>(this: Arc<Self>) -> Result<Arc<T>, Arc<Self>>where
T: Any,
fn downcast_arc<T>(this: Arc<Self>) -> Result<Arc<T>, Arc<Self>>where
T: Any,
T behind Arc pointer§fn downcast_box<T>(this: Box<Self>) -> Result<Box<T>, Box<Self>>where
T: Any,
fn downcast_box<T>(this: Box<Self>) -> Result<Box<T>, Box<Self>>where
T: Any,
T behind Box pointer§fn downcast_move<T>(this: Self) -> Option<T>
fn downcast_move<T>(this: Self) -> Option<T>
Self to T,
useful only in generic context as a workaround for specializationSource§impl<T> BorrowMut<T> for Twhere
T: ?Sized,
impl<T> BorrowMut<T> for Twhere
T: ?Sized,
Source§fn borrow_mut(&mut self) -> &mut T
fn borrow_mut(&mut self) -> &mut T
§impl<T, X> CoerceTo<T> for Xwhere
T: CoerceFrom<X> + ?Sized,
impl<T, X> CoerceTo<T> for Xwhere
T: CoerceFrom<X> + ?Sized,
fn coerce_rc_to(self: Rc<X>) -> Rc<T>
fn coerce_box_to(self: Box<X>) -> Box<T>
fn coerce_ref_to(&self) -> &T
fn coerce_mut_to(&mut self) -> &mut T
§impl<T> Instrument for T
impl<T> Instrument for T
§fn instrument(self, span: Span) -> Instrumented<Self>
fn instrument(self, span: Span) -> Instrumented<Self>
§fn in_current_span(self) -> Instrumented<Self>
fn in_current_span(self) -> Instrumented<Self>
Source§impl<T> IntoEither for T
impl<T> IntoEither for T
Source§fn into_either(self, into_left: bool) -> Either<Self, Self>
fn into_either(self, into_left: bool) -> Either<Self, Self>
self into a Left variant of Either<Self, Self>
if into_left is true.
Converts self into a Right variant of Either<Self, Self>
otherwise. Read moreSource§fn into_either_with<F>(self, into_left: F) -> Either<Self, Self>
fn into_either_with<F>(self, into_left: F) -> Either<Self, Self>
self into a Left variant of Either<Self, Self>
if into_left(&self) returns true.
Converts self into a Right variant of Either<Self, Self>
otherwise. Read more