Struct PolicyContext 

pub struct PolicyContext {
    pub action: String,
    pub resource: String,
    pub principal: Option<String>,
    pub attributes: HashMap<String, String>,
}

Evaluation context for a single authorization decision.

Pure POD to stay WASM-ABI friendly (same convention as crate::feature_flag::FlagContext and crate::auth::AuthRequestContext). The host populates this from the already-authenticated request: the router sets action and resource, crate::auth::AuthPlugin fills principal via [crate::auth::AuthUser::user_id], and anything the policy needs beyond that (tenant id, request IP, feature flags, tenant plan tier) lands in attributes as flat string pairs.

Fields

action: String

The action being attempted, in namespace:verb form. Examples: "post:read", "invoice:update", "admin.users:delete". The shape is engine-agnostic — Cedar parses it into its own Action entity, CEL reads it as a plain string. Callers MUST NOT embed resource ids here (that is what resource is for).

resource: String

The resource the action targets, as an opaque identifier. Typical shapes: "posts/123", "tenant/acme/invoices/inv_9f2", "user/u_42/profile". Engines that understand hierarchical ids (Cedar) parse the slashes; flat engines (CEL) treat the whole string as one attribute.

principal: Option<String>

The authenticated subject (user id) requesting the action. None for anonymous requests — policies that require a principal should return PolicyDecision::Deny with a reason rather than erroring.

attributes: HashMap<String, String>

Free-form attributes the policy can read. Keys are policy-defined ("tenant", "plan", "ip", "mfa", …); values are plain strings so the map round-trips cleanly through any sandbox boundary. This is the same escape hatch used by crate::feature_flag::FlagContext::attributes and crate::auth::AuthUser::attributes.

Implementations

impl PolicyContext

pub fn new(action: impl Into<String>, resource: impl Into<String>) -> Self

Construct a fully anonymous context for a given action and resource. Callers add principal and attributes with the builder helpers below.

pub fn with_principal(self, principal: impl Into<String>) -> Self

Attach an authenticated subject to this context.

pub fn with_attribute( self, key: impl Into<String>, value: impl Into<String>, ) -> Self

Attach a single free-form attribute.

Trait Implementations

impl Clone for PolicyContext

fn clone(&self) -> PolicyContext

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for PolicyContext

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for PolicyContext

fn default() -> PolicyContext

Returns the “default value” for a type.