Struct Gatekeeper 

pub struct Gatekeeper<R, A = NoopAuditSink, C = IdentityReasonCatalog, W = NoopPolicyObserver> { /* private fields */ }

Axum-friendly authorization boundary.

Implementations

impl<R> Gatekeeper<R>

pub fn new(resolver: R) -> Self

Creates a gatekeeper with no-op audit and identity reason rendering.

impl<R, A, C, W> Gatekeeper<R, A, C, W>

pub fn with_audit_sink<NextAudit>( self, audit_sink: NextAudit, ) -> Gatekeeper<R, NextAudit, C, W>

Replaces the audit sink.

pub fn with_reason_catalog<NextCatalog>( self, reason_catalog: NextCatalog, ) -> Gatekeeper<R, A, NextCatalog, W>

Replaces the reason catalog used for forbidden denials.

pub fn with_observer<NextObserver>( self, observer: NextObserver, ) -> Gatekeeper<R, A, C, NextObserver>

Replaces the side-channel decision observer.

pub fn with_denial_response(self, denial_response: DenialResponseConfig) -> Self

Replaces denial presentation settings.

pub const fn with_audit_subjects(self, audit_subjects: AuditSubjects) -> Self

Controls whether audit entries include tenant and principal identifiers.

impl<R, A, C, W> Gatekeeper<R, A, C, W>

where R: FactResolver, A: AuditSink, C: ReasonCatalog + Send + Sync, W: PolicyObserver,

pub async fn authorize<O>( &self, policy_id: PolicyId, policy: &Policy<O>, context: Context, ) -> Result<Authorized<O>, GatekeepRejection<R::Error, A::Error>>

where O: Lattice + Serialize + Send + Sync,

Resolves facts, evaluates the policy, observes and audits the decision, and returns an axum rejection for denied requests.

Trait Implementations

impl<R, A, C, W> Clone for Gatekeeper<R, A, C, W>

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.