Struct ActiveAuthorizer 

pub struct ActiveAuthorizer { /* private fields */ }

Engine authorizer reading live committed policy state (default-deny in PolicyEnforced mode). Implemented against the replicated keyspace.

Implementations

impl ActiveAuthorizer

pub fn new(store: Arc<Store>, tenant: TenantId) -> Self

Creates an authorizer that reads policy for tenant from store.

Trait Implementations

impl Authorizer for ActiveAuthorizer

fn authorize_label(&self, label: &str) -> Result<(), String>

Authorizes writing a record under label against live policy state.

fn authorize_rel_type(&self, rel_type: &str) -> Result<(), String>

Authorizes writing a relationship of rel_type against live policy.

fn current_generation(&self) -> Result<u64, String>

Current committed policy generation; commit revalidates against this.

fn authorize_label_in_txn( &self, label: &str, txn: &Txn<'_>, cap: u64, ) -> Result<(), String>

Admitted checks must use this transaction, not acquire another store view while writer/map locks are held. cap is the admitted predecessor.

fn authorize_rel_type_in_txn( &self, rel_type: &str, txn: &Txn<'_>, cap: u64, ) -> Result<(), String>

Transactional counterpart of Authorizer::authorize_rel_type.

fn current_generation_in_txn( &self, txn: &Txn<'_>, cap: u64, ) -> Result<u64, String>

Transactional counterpart of Authorizer::current_generation.