Struct StatefulAuthorizationStrategy 

pub struct StatefulAuthorizationStrategy { /* private fields */ }

Stateful authorization strategy with caching.

This strategy caches authorization decisions based on channel ID, reducing the overhead of repeated authorization checks for the same connection.

Cache Key

The cache key is built from:

• Channel ID
• Subject key
• Resource key
• Actions (comma-separated)
• Source IP

Format: {channel_id}#{subject_key}#{resource_key}#{actions}#{source_ip}

Cache Behavior

• Cache Hit: Returns cached result immediately
• Cache Miss: Evaluates authorization and caches the result
• TTL: Cached entries expire after configured duration
• No Channel ID: Bypasses cache and evaluates directly

Use Cases

• Connection-based protocols (e.g., long-lived TCP connections)
• High-throughput scenarios with repeated authorization checks
• Systems where authorization policies are relatively stable

Trade-offs

Advantages:

• Significantly reduced latency for cached requests
• Lower load on authorization provider
• Better performance for connection-based protocols

Disadvantages:

• Potential delay in policy updates (up to TTL)
• Higher memory footprint
• Cache consistency considerations

Examples

use rocketmq_auth::StatefulAuthorizationStrategy;
use rocketmq_auth::AuthConfig;

let config = AuthConfig::default();
let strategy = StatefulAuthorizationStrategy::new(config, None)?;

// First evaluation: queries provider
let context = DefaultAuthorizationContext::of(subject, resource, action, ip);
context.set_channel_id("channel-123");
match strategy.evaluate(&context).await? { // Cache miss
    AuthorizationDecision::Allow => proceed(),
    AuthorizationDecision::Deny(reason) => reject(reason),
}

// Second evaluation: uses cache
match strategy.evaluate(&context).await? { // Cache hit
    AuthorizationDecision::Allow => proceed(),
    AuthorizationDecision::Deny(reason) => reject(reason),
}

Implementations

impl StatefulAuthorizationStrategy

pub fn new( auth_config: AuthConfig, metadata_service: Option<Box<dyn Any + Send + Sync>>, ) -> AuthServiceResult<Self>

Creates a new stateful authorization strategy with caching.

Arguments

• auth_config - Authorization configuration
• metadata_service - Optional metadata service for provider initialization

Returns

A new StatefulAuthorizationStrategy instance.

Examples

let config = AuthConfig::default();
let strategy = StatefulAuthorizationStrategy::new(config, None)?;

pub fn new_with_acl_generation( auth_config: AuthConfig, metadata_service: Option<Box<dyn Any + Send + Sync>>, acl_generation: Arc<AtomicU64>, ) -> AuthServiceResult<Self>

Creates a new stateful authorization strategy bound to a shared ACL generation counter.

pub fn new_with_acl_generation_and_metrics( auth_config: AuthConfig, metadata_service: Option<Box<dyn Any + Send + Sync>>, acl_generation: Arc<AtomicU64>, metrics: AuthMetrics, ) -> AuthServiceResult<Self>

pub fn base(&self) -> &AbstractAuthorizationStrategy

Gets a reference to the base strategy.

pub fn cache_size(&self) -> usize

Gets the current cache size.

pub fn clear_cache(&self)

Clears the entire cache.

Trait Implementations

impl AuthorizationStrategy for StatefulAuthorizationStrategy

fn evaluate<'a>( &'a self, context: &'a DefaultAuthorizationContext, ) -> Pin<Box<dyn Future<Output = AuthServiceResult<AuthorizationDecision>> + 'a>>

Evaluates authorization with caching support.

If the context has a channel ID, the result is cached. Subsequent requests with the same cache key will use the cached result until it expires.

Arguments

• context - The authorization context to evaluate

Returns

• Ok(AuthorizationDecision) for a final allow or deny
• Err(AuthServiceError) if evaluation cannot make a decision

Examples

let strategy = StatefulAuthorizationStrategy::new(config, None)?;
let mut context = DefaultAuthorizationContext::of(subject, resource, action, ip);
context.set_channel_id("channel-123");
match strategy.evaluate(&context).await? {
    AuthorizationDecision::Allow => proceed(),
    AuthorizationDecision::Deny(reason) => reject(reason),
}