Struct RemoteReadWorkerAuthorizer 

pub struct RemoteReadWorkerAuthorizer { /* private fields */ }

Injects the configured server-local read policy at every worker boundary.

Implementations

impl RemoteReadWorkerAuthorizer

pub fn new(local_authorizer: Arc<dyn LocalReadAuthorizationRecheck>) -> Self

Create a worker authorizer from the exact policy used for local reads.

pub fn authorize( &self, peer: VerifiedPeerIdentity, envelope: &RemoteReadAuthorizationEnvelope, now_ms: u64, verifier: &dyn ReadDelegationVerifier, ) -> Result<()>

Verify the transport delegation and locally recheck the end-user’s permission before any worker storage/session operation occurs.

pub async fn begin_authorized_worker_session( &self, sessions: &SessionManager, peer: VerifiedPeerIdentity, envelope: &RemoteReadAuthorizationEnvelope, now_ms: u64, verifier: &dyn ReadDelegationVerifier, ) -> Result<SessionId>

Authorize a delegation and create a new subject-bound worker session.

A rejected scope never creates a session, so a later worker cannot use a broader authority than the corresponding local read.

Trait Implementations

impl Clone for RemoteReadWorkerAuthorizer

fn clone(&self) -> RemoteReadWorkerAuthorizer

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.