Struct Cedarling 

pub struct Cedarling { /* private fields */ }

The instance of the Cedarling application. It is safe to share between threads.

Implementations

impl Cedarling

pub async fn new_with_env( raw_config: Option<BootstrapConfigRaw>, ) -> Result<Cedarling, InitCedarlingError>

Create a new instance of the Cedarling application. Initialize instance from enviroment variables and from config. Configuration structure has lower priority.

pub async fn new( config: &BootstrapConfig, ) -> Result<Cedarling, InitCedarlingError>

Create a new instance of the Cedarling application.

pub async fn authorize_unsigned( &self, request: RequestUnsigned, ) -> Result<AuthorizeResult, AuthorizeError>

Authorize request with unsigned data. makes authorization decision based on the [RequestUnverified]

pub async fn authorize_unsigned_batch( &self, request: BatchAuthorizeUnsignedRequest, ) -> Result<BatchAuthorizeResponse<Result<AuthorizeResult, BatchItemError>>, AuthorizeError>

Authorize a batch of unsigned requests against one shared principal.

Runs setup work (principal build + pushed-data snapshot) once and evaluates each item with its own resource and context. Results are returned in input order, wrapped in a BatchAuthorizeResponse that carries a shared batch_id for audit correlation.

Batch-level failures (validation, principal parse) return Err(AuthorizeError); per-item failures are returned as Err(BatchItemError) for that item, while genuine Cedar denials remain Ok(AuthorizeResult) with decision=false.

pub async fn authorize_multi_issuer( &self, request: AuthorizeMultiIssuerRequest, ) -> Result<MultiIssuerAuthorizeResult, AuthorizeError>

Authorize multi-issuer request. makes authorization decision based on multiple JWT tokens from different issuers

pub async fn authorize_multi_issuer_batch( &self, request: BatchAuthorizeMultiIssuerRequest, ) -> Result<BatchAuthorizeResponse<Result<MultiIssuerAuthorizeResult, BatchItemError>>, AuthorizeError>

Authorize a batch of multi-issuer requests against one shared token set.

Validates tokens and builds token/issuer entities once, then evaluates each item with its own resource and context. Results are returned in input order, wrapped in a BatchAuthorizeResponse carrying a shared batch_id. Batch-level failures (validation, JWT verification, status-list refresh) return Err(AuthorizeError); per-item failures are returned as Err(BatchItemError), while genuine Cedar denials remain Ok(MultiIssuerAuthorizeResult) with decision=false.

pub fn get_matching_policies_unsigned( &self, principal: Option<&EntityData>, actions: &[String], resources: &[EntityData], ) -> Result<Vec<PolicyMetadata>, AuthorizeError>

Returns metadata for all policies whose scope constraints are compatible with the given principals, actions, and resources.

This performs scope-level filtering only (principal/action/resource constraints). Policies with when/unless conditions may still not apply at evaluation time.

pub fn get_matching_policies_multi_issuer( &self, tokens: &[TokenInput], actions: &[String], resources: &[EntityData], ) -> Result<Vec<PolicyMetadata>, AuthorizeError>

Returns metadata for all policies whose scope constraints are compatible with the given token-derived principals, actions, and resources.

Tokens are validated and their mapping types used as principal entity types.

pub fn annotations_map<'a>( &self, ids: impl IntoIterator<Item = &'a PolicyId>, ) -> HashMap<String, String>

Merge the annotations (@key("value")) of the given policies into a single map.

Intended for resolving the determining policies of an authorization decision: pass the IDs from result.response.diagnostics().reason().

Lossy: if the same annotation key appears on several policies, one value wins arbitrarily (order undefined). Use Self::annotation_values or Self::annotations_by_policy when duplicates matter.

Resolve annotations promptly after authorize*(): a concurrent policy-store refresh may swap the store, in which case IDs that no longer resolve are silently dropped from the result.

pub fn annotation_values<'a>( &self, ids: impl IntoIterator<Item = &'a PolicyId>, key: &str, ) -> Vec<String>

Collect every value of the annotation key across the given policies, preserving duplicates.

Intended for resolving the determining policies of an authorization decision: pass the IDs from result.response.diagnostics().reason().

Resolve annotations promptly after authorize*(): a concurrent policy-store refresh may swap the store, in which case IDs that no longer resolve are silently dropped from the result.

pub fn annotations_by_policy<'a>( &self, ids: impl IntoIterator<Item = &'a PolicyId>, ) -> HashMap<String, HashMap<String, String>>

Return the annotations of each given policy, grouped by policy ID — the loss-free companion to Self::annotations_map.

Intended for resolving the determining policies of an authorization decision: pass the IDs from result.response.diagnostics().reason().

Resolve annotations promptly after authorize*(): a concurrent policy-store refresh may swap the store, in which case IDs that no longer resolve are silently dropped from the result.

pub async fn shut_down(&self)

Closes the connections to the Lock Server and pushes all available logs.

Trait Implementations

impl Clone for Cedarling

fn clone(&self) -> Cedarling

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl DataApi for Cedarling

fn push_data_ctx( &self, key: &str, value: Value, ttl: Option<Duration>, ) -> Result<(), DataError>

Push a value into the store with an optional TTL.

fn get_data_ctx(&self, key: &str) -> Result<Option<Value>, DataError>

Get a value from the store by key.

fn get_data_entry_ctx(&self, key: &str) -> Result<Option<DataEntry>, DataError>

Get a data entry with full metadata by key.

fn remove_data_ctx(&self, key: &str) -> Result<bool, DataError>

Remove a value from the store by key.

fn clear_data_ctx(&self) -> Result<(), DataError>

Clear all entries from the store.

fn list_data_ctx(&self) -> Result<Vec<DataEntry>, DataError>

List all entries with their metadata.

fn get_stats_ctx(&self) -> Result<DataStoreStats, DataError>

Get statistics about the data store.

impl LogStorage for Cedarling

fn pop_logs(&self) -> Vec<Value>

Return logs and remove them from the storage

fn get_log_by_id(&self, id: &str) -> Option<Value>

Get specific log entry

fn get_log_ids(&self) -> Vec<String>

Returns a list of all log ids

fn get_logs_by_tag(&self, tag: &str) -> Vec<Value>

Get logs by tag, like log_kind or log level. Tag can be log_kind, log_level.

fn get_logs_by_request_id(&self, request_id: &str) -> Vec<Value>

Get logs by request_id. Return log entries that match the given request_id.

fn get_logs_by_request_id_and_tag(&self, id: &str, tag: &str) -> Vec<Value>

Get log by request_id and tag, like composite key request_id + log_kind. Tag can be log_kind, log_level. Return log entries that match the given request_id and tag.

impl TrustedIssuerLoadingInfo for Cedarling

fn is_trusted_issuer_loaded_by_name(&self, issuer_id: &str) -> bool

Returns true if the trusted issuer with the given ID (policy store key) is loaded.

fn is_trusted_issuer_loaded_by_iss(&self, iss_claim: &str) -> bool

Returns true if the trusted issuer with the given iss claim is loaded.

fn total_issuers(&self) -> usize

Returns the total number of trusted issuers that are expected to be loaded.

fn loaded_trusted_issuers_count(&self) -> usize

Returns the number of trusted issuers that have been loaded.

fn loaded_trusted_issuer_ids(&self) -> HashSet<String>

Returns all issuer IDs in the index of loaded trusted issuers.

fn failed_trusted_issuer_ids(&self) -> HashSet<String>

Returns issuer IDs that failed to load.