Struct PartialResponse 

pub struct PartialResponse(/* private fields */);

Available on crate feature partial-eval only.

A partially evaluated authorization response.

Splits the results into several categories: satisfied, false, and residual for each policy effect. Also tracks all the errors that were encountered during evaluation.

This feature is experimental. For more information see https://github.com/cedar-policy/rfcs/blob/main/README.md#experimental-features

Implementations

impl PartialResponse

pub fn decision(&self) -> Option<Decision>

Attempt to reach a partial decision; the presence of residuals may result in returning None, indicating that a decision could not be reached given the unknowns

pub fn concretize(self) -> Response

Convert this response into a concrete evaluation response. All residuals are treated as errors

pub fn definitely_satisfied(&self) -> impl Iterator<Item = Policy> + '_

Returns the set of Policys that were definitely satisfied. This will be the set of policies (both permit and forbid) that evaluated to true

pub fn definitely_errored(&self) -> impl Iterator<Item = &PolicyId>

Returns the set of PolicyIds that encountered errors

pub fn may_be_determining(&self) -> impl Iterator<Item = Policy> + '_

Returns an over-approximation of the set of determining policies

This is all policies that may be determining for any substitution of the unknowns. Policies not in this set will not affect the final decision, regardless of any substitutions.

For more information on what counts as “determining” see: https://docs.cedarpolicy.com/auth/authorization.html#request-authorization

pub fn must_be_determining(&self) -> impl Iterator<Item = Policy> + '_

Returns an under-approximation of the set of determining policies

This is all policies that must be determining for all possible substitutions of the unknowns. This set will include policies that evaluated to true and are guaranteed to be contributing to the final authorization decision.

For more information on what counts as “determining” see: https://docs.cedarpolicy.com/auth/authorization.html#request-authorization

pub fn nontrivial_residuals(&self) -> impl Iterator<Item = Policy> + '_

Returns the set of non-trivial (meaning more than just true or false) residuals expressions

pub fn all_residuals(&self) -> impl Iterator<Item = Policy> + '_

Returns every policy as a residual expression

pub fn unknown_entities(&self) -> HashSet<EntityUid>

Returns all unknown entities during the evaluation of the response

pub fn get(&self, id: &PolicyId) -> Option<Policy>

Return the residual for a given PolicyId, if it exists in the response

pub fn reauthorize( &self, mapping: HashMap<SmolStr, RestrictedExpression>, auth: &Authorizer, es: &Entities, ) -> Result<Self, ReauthorizationError>

👎Deprecated: use reauthorize_with_bindings

Attempt to re-authorize this response given a mapping from unknowns to values.

pub fn reauthorize_with_bindings<'m>( &self, mapping: impl IntoIterator<Item = (&'m str, &'m RestrictedExpression)>, auth: &Authorizer, es: &Entities, ) -> Result<Self, ReauthorizationError>

Attempt to re-authorize this response given a mapping from unknowns to values, provided as an iterator. Exhausts the iterator, returning any evaluation errors in the restricted expressions, regardless whether there is a matching unknown.

Trait Implementations

impl Clone for PartialResponse

fn clone(&self) -> PartialResponse

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for PartialResponse

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl From<PartialResponse> for Response

fn from(partial_response: PartialResponse) -> Self

Converts to this type from the input type.

impl RefCast for PartialResponse

type From = PartialResponse

fn ref_cast(_from: &Self::From) -> &Self

fn ref_cast_mut(_from: &mut Self::From) -> &mut Self

impl TryFrom<PartialResponse> for ResidualResponse

type Error = Box<dyn Diagnostic + Send + Sync>

The type returned in the event of a conversion error.

fn try_from(partial_response: PartialResponse) -> Result<Self, Self::Error>

Performs the conversion.