Module authz 

Chronix Authz — Cedar-based Authorization

Fine-grained authorization for the Chronix time-series database using the Cedar policy language (formally verified, pure Rust).

Architecture

Request → AuthMiddleware → AuthContext
                               │
                               ▼
                        AuthzEngine (Cedar)
                           ├── PolicySet (hot-reloadable)
                           ├── Entities (principal, resource, roles)
                           └── Decision: Allow | Deny { reasons }

Policy Model

• Principals: Chronix::User, with role membership via Chronix::Role
• Resources: Chronix::Namespace for data, Chronix::System for administration — the two things chronixd asks about, and nothing else
• Actions: Read, Write, Delete on a namespace; the capabilities in the Admin group on the system

The model is compiled in as a Cedar schema (engine::SCHEMA_SRC) and every policy is validated against it, so a rule naming something this server never asks about is refused at load rather than accepted and never consulted.

Default-Deny

If no policy explicitly permits a request, it is denied. Use forbid policies to create hard denials that override permissive policies.

Example

use chronix_security::authz::{
    AuthzEngine, ChronixAction, ChronixNamespace, ChronixPrincipal,
};

let engine = AuthzEngine::new();
engine.load_policies(r#"
    permit(
        principal in Chronix::Role::"operator",
        action in [Chronix::Action::"Read", Chronix::Action::"Write"],
        resource == Chronix::Namespace::"production"
    );
"#).unwrap();

let operator = ChronixPrincipal::new("alice").with_role("operator");
let production = ChronixNamespace::new("production");
assert!(engine
    .authorize_namespace(&operator, ChronixAction::Write, &production)
    .is_allowed());
assert!(engine
    .authorize_namespace(&operator, ChronixAction::Delete, &production)
    .is_denied());

Re-exports

pub use error::AuthzError;

Modules

error

Error types for the Chronix authorization system.

Structs

AuthzEngine

The Cedar-based authorization engine.

ChronixNamespace

A Chronix namespace — the resource of every data-plane decision.

ChronixPrincipal

A Chronix principal (authenticated identity).

ChronixSystem

The server itself — the resource of every administrative decision.

Enums

ChronixAction

An action chronixd asks about.

Decision

The result of an authorization decision.

Constants

SCHEMA_SRC

The Chronix Cedar schema, compiled into the binary.

Functions

schema_action_names

The action names the schema declares, group included.