Struct SystemDbAuthorizer 

pub struct SystemDbAuthorizer { /* private fields */ }

Answers authorization from a Corium database holding ReBAC policy.

Implementations

impl SystemDbAuthorizer

pub fn new(source: Arc<dyn PolicySource>) -> Self

Builds an authorizer over source with default tuning.

pub fn with_config(source: Arc<dyn PolicySource>, config: AuthzConfig) -> Self

Builds an authorizer over source.

pub fn with_audit(self, audit: Arc<dyn AuditSink>) -> Self

Routes audit events to audit instead of tracing (builder style).

pub fn config(&self) -> &AuthzConfig

The tuning in force.

pub fn current_policy(&self) -> Option<Arc<Policy>>

The compiled policy this process is deciding from, if it has one.

pub async fn refresh(&self) -> Result<Arc<Policy>, RefreshError>

Reads the source and compiles a new snapshot when its basis has moved.

Safe to call from anywhere: it is what the refresh task loops on, what a Fresh check calls, and what a caller uses to fail startup early on a misconfigured authz database.

Errors

Returns RefreshError when the snapshot cannot be read or compiled. The last good policy is kept: a policy that stops compiling does not silently become “deny everything” while the previous one still applies.

pub fn spawn_refresh(self: &Arc<Self>) -> JoinHandle<()>

Spawns the background task that keeps the compiled snapshot current.

The task waits on the source’s change signal (a basis watch, a tx-report broadcast, or a poll), recompiles off the request path, and swaps the result in. It logs and retries on failure rather than exiting, so a transient store outage does not permanently freeze policy.

pub async fn check( &self, principal: &Principal, access: &Access, ) -> AuthzDecision

Runs one check, returning the decision with its audit detail.

Trait Implementations

impl Authorizer for SystemDbAuthorizer

fn authorize<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, principal: &'life1 Principal, access: &'life2 Access, ) -> Pin<Box<dyn Future<Output = Decision> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Renders a Decision for principal attempting access.