Struct BootstrapConfigRaw 

pub struct BootstrapConfigRaw {

    pub application_name: String,
    pub policy_store_uri: Option<String>,
    pub log_type: LoggerType,
    pub log_level: LogLevel,
    pub log_ttl: Option<u64>,
    pub log_max_items: Option<usize>,
    pub log_max_item_size: Option<usize>,
    pub stdout_mode: StdOutMode,
    pub stdout_timeout_millis: u64,
    pub stdout_buffer_limit: usize,
    pub decision_log_default_jwt_id: String,
    pub local_jwks: Option<String>,
    pub local_policy_store: Option<String>,
    pub policy_store_local_fn: Option<String>,
    pub max_default_entities: Option<usize>,
    pub max_base64_size: Option<usize>,
    pub jwt_sig_validation: FeatureToggle,
    pub jwt_status_validation: FeatureToggle,
    pub strict_schema_validation: FeatureToggle,
    pub jwt_signature_algorithms_supported: HashSet<Algorithm>,
    pub lock: FeatureToggle,
    pub lock_server_configuration_uri: Option<String>,
    pub dynamic_configuration: FeatureToggle,
    pub lock_ssa_jwt: Option<String>,
    pub lock_access_token_jwt: Option<String>,
    pub audit_log_interval: u64,
    pub audit_health_interval: u64,
    pub audit_telemetry_interval: u64,
    pub listen_sse: FeatureToggle,
    pub accept_invalid_certs: FeatureToggle,
    pub lock_transport: LockTransport,
    pub lock_log_channel_capacity: usize,
    pub lock_log_max_retries: u32,
    pub token_cache_max_ttl: usize,
    pub token_cache_capacity: usize,
    pub token_cache_earliest_expiration_eviction: bool,
    pub data_store_max_entries: Option<usize>,
    pub data_store_max_entry_size: Option<usize>,
    pub data_store_default_ttl: Option<u64>,
    pub data_store_max_ttl: Option<u64>,
    pub data_store_enable_metrics: Option<bool>,
    pub data_store_memory_alert_threshold: Option<f64>,
    pub trusted_issuer_loader_type: TrustedIssuerLoaderTypeRaw,
    pub trusted_issuer_loader_workers: WorkersCount,
    pub http_client_request_timeout: u64,
    pub http_client_request_max_retries: u32,
    pub http_client_request_retry_delay: u64,
    pub http_client_max_response_size_bytes: u64,
    pub jwks_refresh_interval: Option<u64>,
    pub jwks_refresh_min_interval: u64,
    pub status_list_refresh_interval_max: u64,
    pub policy_store_refresh_interval_secs: u64,
}

Struct that represent mapping mapping Bootstrap properties to be JSON and YAML compatible from link

This structure is used to deserialize values from ENV VARS so json keys is same as keys in environment variables

Fields

application_name: String

Human friendly identifier for the application

policy_store_uri: Option<String>

Location of policy store JSON, used if policy store is not local, or retreived from Lock Master.

log_type: LoggerType

How the Logs will be presented.

log_level: LogLevel

Log level filter for logging. TRACE is lowest. FATAL is highest.

log_ttl: Option<u64>

If log_type is set to [LogType::Memory], this is the TTL (time to live) of log entities in seconds.

log_max_items: Option<usize>

Maximum number of log entities that can be stored using [LogType::Memory]. If value is 0, there is no limit. But if None, default value is applied.

log_max_item_size: Option<usize>

Maximum size of a single log entity in bytes using [LogType::Memory]. If value is 0, there is no limit. But if None, default value is applied.

stdout_mode: StdOutMode

Logging mode for stdout logger: “async” or “immediate (default)”. Only applicable for native targets (not WASM).

stdout_timeout_millis: u64

Flush timeout in milliseconds for async stdout logging. Only applicable for native targets (not WASM).

stdout_buffer_limit: usize

Buffer size limit in bytes for async stdout logging. Only applicable for native targets (not WASM).

decision_log_default_jwt_id: String

Token claims that will be used for decision logging. Default is jti, but perhaps some other claim is needed.

local_jwks: Option<String>

Path to a local file pointing containing a JWKS.

local_policy_store: Option<String>

JSON object with policy store

policy_store_local_fn: Option<String>

Path to a Policy Store JSON file

max_default_entities: Option<usize>

Maximum number of default entities allowed in a policy store. This prevents DoS attacks by limiting the number of entities that can be loaded. If value is 0, there is no limit. But if None, default value is applied.

max_base64_size: Option<usize>

Maximum size of base64-encoded default entity strings in bytes. This prevents memory exhaustion attacks from extremely large base64 strings. If value is 0, there is no limit. But if None, default value is applied.

jwt_sig_validation: FeatureToggle

Whether to check the signature of all JWT tokens.

When enabled, this requires the iss (Issuer) claim to be present in all tokens and the issuer URL must use the https scheme.

jwt_status_validation: FeatureToggle

Whether to check the status of the JWT. On startup.

Cedarling will fetch and retreive the latest Status List JWT from the .well-known/openid-configuration via the status_list_endpoint claim and cache it. See the IETF Draft for more info.

strict_schema_validation: FeatureToggle

When enabled, Cedar schema is required and all policies and entities are validated against it. When disabled, Cedarling runs without schema-based validation, allowing quick-start and prototyping without a schema.

jwt_signature_algorithms_supported: HashSet<Algorithm>

Cedarling will only accept tokens signed with these algorithms.

lock: FeatureToggle

If Enabled, the Cedarling will connect to the Lock Master for policies, and subscribe for SSE events.

lock_server_configuration_uri: Option<String>

URI where Cedarling can get JSON file with all required metadata about Lock Master, i.e. .well-known/lock-master-configuration.

Required if LOCK == enabled.

dynamic_configuration: FeatureToggle

Controls whether Cedarling should listen for SSE config updates.

lock_ssa_jwt: Option<String>

SSA for DCR in a Lock Master deployment. The Cedarling will validate this SSA JWT prior to DCR.

lock_access_token_jwt: Option<String>

Pre-issued access token to use for Lock Server authentication, bypassing the SSA → DCR → access_token flow entirely.

When this property is set, Cedarling will skip Dynamic Client Registration and use this access token directly to authenticate with Lock Server endpoints (log, health, telemetry). Primarily intended for testing and local development to simplify the bootstrap flow; may also be used in environments where the DCR flow is not available or access tokens are provisioned externally.

If both CEDARLING_LOCK_ACCESS_TOKEN_JWT and CEDARLING_LOCK_SSA_JWT are set, CEDARLING_LOCK_ACCESS_TOKEN_JWT takes precedence and the SSA flow is skipped.

Not available on WASM targets.

audit_log_interval: u64

How often to send log messages to Lock Master (0 to turn off trasmission).

audit_health_interval: u64

How often to send health messages to Lock Master (0 to turn off transmission).

audit_telemetry_interval: u64

How often to send telemetry messages to Lock Master (0 to turn off transmission).

listen_sse: FeatureToggle

Controls whether Cedarling should listen for updates from the Lock Server.

accept_invalid_certs: FeatureToggle

Allow interaction with a Lock server with invalid certificates. Used for testing.

lock_transport: LockTransport

Transport protocol for Lock Server communication (“grpc” or “rest”).

lock_log_channel_capacity: usize

Channel capacity for buffering log entries before they are sent to the lock server. Higher values allow more logs to be buffered in memory when the lock server is slow, but also increase memory usage. Default value is 100.

lock_log_max_retries: u32

Maximum number of retry attempts for sending logs to the lock server. Uses exponential backoff strategy for retrying. Default value is 5.

token_cache_max_ttl: usize

Maximum token cache TTL in seconds.

Caps how long a validated token may stay in the cache. The effective TTL for an entry is min(time-until-exp, max_ttl) when both apply.

• > 0: cap each entry’s TTL at this value. Also used as the TTL for tokens that do not carry an exp claim.
• 0: disables the token cache entirely.

Default: 5 seconds — small enough to pick up revocation / status-list changes quickly, large enough to amortise repeated requests for the same token.

token_cache_capacity: usize

Maximum number of tokens the cache can store. Default value is 100. 0 means no limit.

token_cache_earliest_expiration_eviction: bool

Enables eviction policy based on the earliest expiration time.

When the cache reaches its capacity, the entry with the nearest expiration timestamp will be removed to make room for a new one.

data_store_max_entries: Option<usize>

Maximum number of data entries in the data store (0 = unlimited). Default: 10,000

data_store_max_entry_size: Option<usize>

Maximum size per data entry in bytes (0 = unlimited). Default: 1MB (1,048,576 bytes)

data_store_default_ttl: Option<u64>

Default TTL for data entries in seconds. If not set, entries do not expire.

data_store_max_ttl: Option<u64>

Maximum allowed TTL for data entries in seconds. Default: 3600 (1 hour). Entries with TTL exceeding this value will be rejected. Note: 0 means a zero-second max TTL (immediate expiry), not unlimited. Omitting this property uses the default (1 hour).

data_store_enable_metrics: Option<bool>

Enable metrics tracking (access counts, timestamps) for data entries. Default: true

data_store_memory_alert_threshold: Option<f64>

Memory usage alert threshold as a percentage (0.0-100.0). When capacity usage exceeds this threshold, a warning is logged. Default: 80.0 (80%)

trusted_issuer_loader_type: TrustedIssuerLoaderTypeRaw

Type of trusted issuer loader. If not set, synchronous loader is used. Can be SYNC or ASYNC.

Sync loader means that trusted issuers will be loaded on initialization. Async loader means that trusted issuers will be loaded in background.

trusted_issuer_loader_workers: WorkersCount

Number of concurrent workers to use when loading trusted issuers. Applies to both SYNC (parallel loading during initialization) and ASYNC (parallel background loading) modes. Minimum possible value is 1. Zero will be used as 1.

For WASM maximum value is 6, default is 2. For native maximum value is 1000, default is 10.

http_client_request_timeout: u64

Per-request timeout in seconds.

http_client_request_max_retries: u32

Maximum number of retry attempts per request.

http_client_request_retry_delay: u64

Base delay between retries in seconds.

http_client_max_response_size_bytes: u64

Maximum HTTP response body size, in bytes. Rejects oversized responses (JWKS, OIDC config, status list, policy store, Lock Server endpoints) before they’re fully buffered into memory. 0 disables the cap. Default: 10 MB (10485760).

jwks_refresh_interval: Option<u64>

Optional override for JWKS periodic refresh interval in seconds. When set, overrides the Cache-Control: max-age from the JWKS endpoint. If omitted, the server-driven interval or a 1-hour fallback is used. Values below 5 seconds are clamped to 5.

jwks_refresh_min_interval: u64

Minimum interval in seconds between on-demand JWKS re-fetches per issuer. Prevents abuse from invalid JWT floods triggering excessive re-fetches. Default: 30 seconds. Values below 5 seconds are clamped to 5.

status_list_refresh_interval_max: u64

Upper bound on the Status List JWT refresh interval, in seconds.

Caps how long Cedarling waits between Status List refreshes. When the Status List JWT carries a ttl claim, the effective refresh interval is min(jwt_ttl, status_list_refresh_interval_max), so the issuer can request a more frequent refresh but never a less frequent one. When the JWT omits ttl, this value is used directly. A value of 0 or an unset variable is treated as “use the default” (300 seconds) so the status list cannot silently go stale forever. Non-zero values below 5 are clamped to 5.

Fail-closed behavior: if any background refresh fails — fetch error, 5xx response, or the status list body is invalid (JWT validation fails, deserialization fails, or bit-string parsing fails) — the cached status list is dropped and all tokens that reference it are rejected until the next successful refresh. This prevents a revoked token from being accepted based on stale data at the cost of temporarily denying valid tokens when the issuer’s status endpoint is unreachable or returns a malformed payload.

policy_store_refresh_interval_secs: u64

Base refresh interval, in seconds, for periodic background refresh of remote policy stores (CjarUrl / LockServer). 0 disables refresh and preserves the load-once-at-startup behavior. Non-zero values below the MIN_REFRESH_INTERVAL_SECS floor are clamped at service-init time (with a WARN log emitted) so the worker never busy-polls the upstream — see [PolicyStoreConfig::effective_refresh_interval]. A server Cache-Control: max-age / Expires hint can shorten the next interval but never extends it.

Implementations

impl BootstrapConfigRaw

pub fn from_raw_config_and_env( raw: Option<BootstrapConfigRaw>, ) -> Result<Self, BootstrapConfigLoadingError>

Construct BootstrapConfig from environment variables and BootstrapConfigRaw config. Environment variables have bigger priority.

Trait Implementations

impl Debug for BootstrapConfigRaw

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for BootstrapConfigRaw

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for BootstrapConfigRaw

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for BootstrapConfigRaw

fn eq(&self, other: &BootstrapConfigRaw) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for BootstrapConfigRaw

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for BootstrapConfigRaw

impl TryFrom<&BootstrapConfigRaw> for LockServiceConfig

type Error = BootstrapConfigLoadingError

The type returned in the event of a conversion error.

fn try_from(raw: &BootstrapConfigRaw) -> Result<Self, Self::Error>

Performs the conversion.

impl TryFrom<&BootstrapConfigRaw> for LockServiceConfig

type Error = BootstrapConfigLoadingError

The type returned in the event of a conversion error.

fn try_from(raw: &BootstrapConfigRaw) -> Result<Self, Self::Error>

Performs the conversion.

impl TryFrom<BootstrapConfigRaw> for BootstrapConfig

type Error = BootstrapConfigLoadingError

The type returned in the event of a conversion error.

fn try_from(raw: BootstrapConfigRaw) -> Result<Self, Self::Error>

Performs the conversion.