Trait Authorizer

Source

pub trait Authorizer:
    Send
    + Sync
    + 'static {
    // Required method
    fn authorize<'life0, 'life1, 'life2, 'async_trait>(
        &'life0 self,
        principal: &'life1 Principal,
        access: &'life2 Access,
    ) -> Pin<Box<dyn Future<Output = Decision> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait,
             'life2: 'async_trait;
}

Expand description

Decides whether a Principal may perform an Access.

This is async, unlike IdentityProvider, because the interesting authorizers call out to an external policy oracle — a relationship-based service such as OpenFGA / Auth0 FGA answers a per-decision Check(user, relation, object) over the network, and modelling that as a blocking call would stall a runtime thread. Local authorizers (AllowAll, PolicyAuthorizer) simply return without awaiting. Authorization also runs handler-side, inside the async RPC, so .await costs nothing structurally there — whereas authn runs in the synchronous tonic interceptor.