Struct DecisionCache 

pub struct DecisionCache { /* private fields */ }

LRU decision cache for policy evaluation results.

Thread-safe via RwLock. Lock poisoning is handled fail-closed (cache miss on read, no-op on write).

Implementations

impl DecisionCache

pub fn new(max_entries: usize, ttl: Duration) -> Self

Create a new decision cache.

Arguments

• max_entries — Maximum number of cached verdicts. Clamped to [1, MAX_CACHE_ENTRIES].
• ttl — Time-to-live for each entry. Clamped to [MIN_TTL_SECS, MAX_TTL_SECS] seconds.

pub fn get_with_risk( &self, action: &Action, context: Option<&EvaluationContext>, has_risk_score: bool, ) -> Option<Verdict>

Look up a cached verdict for the given action and optional context.

Returns None (cache miss) if:

• The context is session-dependent (non-cacheable)
• A risk score is present (dynamic continuous authorization)
• No entry exists for this action
• The entry’s TTL has expired
• The entry’s policy generation is stale
• The internal lock is poisoned (fail-closed)

Arguments

• has_risk_score — Set to true when the request context carries a risk score from continuous authorization. This forces a cache miss because the ABAC verdict depends on the current risk score.

pub fn get( &self, action: &Action, context: Option<&EvaluationContext>, ) -> Option<Verdict>

Look up a cached verdict (backward-compatible, assumes no risk score).

Equivalent to get_with_risk(action, context, false).

pub fn insert_with_risk( &self, action: &Action, context: Option<&EvaluationContext>, verdict: &Verdict, has_risk_score: bool, )

Insert a verdict into the cache for the given action.

If the context is session-dependent or a risk score is present, this is a no-op (the result should not be cached). If the cache is at capacity, the least-recently-used entry is evicted.

No-op if the internal lock is poisoned (fail-closed: we do not serve stale data from a potentially corrupted map).

Arguments

• has_risk_score — Set to true when the request context carries a risk score from continuous authorization.

pub fn insert( &self, action: &Action, context: Option<&EvaluationContext>, verdict: &Verdict, )

Insert a verdict (backward-compatible, assumes no risk score).

Equivalent to insert_with_risk(action, context, verdict, false).

pub fn invalidate(&self)

Invalidate all cached entries by bumping the policy generation counter.

Existing entries remain in memory but will be treated as stale on the next get call. This is O(1) — no iteration required.

pub fn stats(&self) -> CacheStats

Return aggregate cache performance statistics.

pub fn len(&self) -> usize

Return the number of entries currently in the cache.

Returns 0 if the lock is poisoned (fail-closed).

pub fn is_empty(&self) -> bool

Returns true if the cache contains no entries.

Returns true if the lock is poisoned (fail-closed).

Trait Implementations

impl Debug for DecisionCache

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.