Struct AuthzEngine 

pub struct AuthzEngine { /* private fields */ }

The Cedar-based authorization engine.

Thread-safe — share it as Arc<AuthzEngine>.

Default-deny

A request no policy permits is denied. An engine with no policies at all therefore denies everything, which is why chronixd treats “no policy directory configured” as “no policy engine” rather than as an empty one.

Cross-tenant isolation is not a policy

It is a property of the credential: a key or token carries the namespaces it may act in, and the gate refuses a header naming any other before Cedar is consulted. There used to be a built-in forbid policy for this which nothing loaded and which compared a principal.namespace attribute nothing set — an isolation guarantee that existed only as a string constant. Policies narrow what a credential may do; they are not what keeps tenants apart.

Implementations

impl AuthzEngine

pub fn new() -> Self

Create an engine with no policies and the built-in schema.

pub fn check_policies(policy_src: &str) -> Result<usize>

Parse and validate policy_src without installing it.

Errors

AuthzError::PolicyParse if it is not Cedar, AuthzError::PolicyValidation if it does not fit the schema.

pub fn load_policies(&self, policy_src: &str) -> Result<usize>

Replace the active policy set.

Errors

As check_policies; the active set is left untouched when either fails.

pub fn add_policy(&self, id: &str, policy_src: &str) -> Result<()>

Add one policy, keeping the rest.

Clone-and-swap: the candidate is built and validated without a lock held, and the write lock is taken only for the swap, so a rejected policy leaves the active set exactly as it was.

Errors

As check_policies, or AuthzError::Internal if id is already taken.

pub fn remove_policy(&self, id: &str) -> bool

Remove a policy by id. Returns whether it was there.

pub fn load_policies_from_dir(&self, dir: &Path) -> Result<usize>

Load every .cedar file in dir as one policy set.

Errors

The directory cannot be read, or the combined text does not parse or validate.

pub fn policy_count(&self) -> usize

Number of active policies.

pub fn policy_ids(&self) -> Vec<String>

The ids of the active policies.

pub fn authorize_namespace( &self, principal: &ChronixPrincipal, action: ChronixAction, namespace: &ChronixNamespace, ) -> Decision

May principal perform action in namespace?

action must be a data action; an administrative one cannot reach a namespace resource under the schema, so asking would be a decision nobody can write a policy for. Debug builds assert it.

pub fn authorize_system( &self, principal: &ChronixPrincipal, action: ChronixAction, ) -> Decision

May principal perform the administrative action?

Trait Implementations

impl Debug for AuthzEngine

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for AuthzEngine

fn default() -> Self

Returns the “default value” for a type.