Struct Authorizer

pub struct Authorizer { /* private fields */ }

Stateful authorizer wrapping cedar’s engine.

Implementations

impl Authorizer

pub fn new(store: PolicyStore) -> Result<Self>

Build a new authorizer from a PolicyStore.

Errors

Returns Error::Io / Error::Json / Error::PolicyParse from PolicyStore::load_policies or load_schema (e.g. malformed Cedar, missing schema).

pub fn with_cache(self, config: CacheConfig) -> Self

Enable the decision cache with the supplied config. Call multiple times to replace the cache (the previous Arc is dropped).

Examples

use agentguard_core::{Authorizer, PolicyStore};
use agentguard_core::decision::cache::CacheConfig;
use std::time::Duration;

let dir = tempfile::tempdir().unwrap();
let store = PolicyStore::open(dir.path()).unwrap();
let authorizer = Authorizer::new(store)
    .unwrap()
    .with_cache(CacheConfig {
        capacity: 1000,
        allow_ttl: Duration::from_secs(60),
        deny_ttl: Duration::from_secs(5),
        cache_denies: true,
    });
// Subsequent identical requests served within 60 s hit the

pub fn try_with_cache(self, config: CacheConfig) -> Result<Self, String>

Enable the decision cache, returning invalid configuration as an error instead of panicking. Prefer this when config originates from user, operator, or embedder settings.

pub fn cache(&self) -> Option<&Arc<DecisionCache>>

Direct handle on the cache (for invalidation, metrics, tests). Returns None when the cache is disabled.

pub fn invalidate_cache(&self)

Invalidate every cached decision. Call after a policy reload — the next authorize() falls through to cedar and re-populates.

pub fn sweep_stale_cache(&self) -> usize

Drain entries that became stale (policy-version mismatch) or expired since the last sweep. Cheap no-op when the cache is empty or nothing is stale. Returns the number of entries removed.

The read path no longer evicts on staleness to avoid serializing many concurrent readers on a write lock after a policy reload; this method is the matching cleanup hook.

pub fn authorize( &self, req: &AgentRequest, entities: &Entities, ) -> Result<Decision>

Evaluate an AgentRequest against the loaded policy set.

When a decision cache is configured (with_cache), identical requests served within the configured TTL are returned from memory with from_cache: true.

Errors

Returns Error::Json if the request cannot be serialized into the Cedar request shape (should be unreachable today).

Examples

use agentguard_core::{Authorizer, AgentRequest, AgentRequestBuilder,
    Principal, AgentAction, Resource, AgentContext};
use cedar_policy::Entities;

let dir = tempfile::tempdir().unwrap();
let store = agentguard_core::PolicyStore::open(dir.path()).unwrap();
store
    .write_policy(
        "p",
        r#"permit (principal in User::"alice", action, resource);"#,
    )
    .unwrap();
let authorizer = Authorizer::new(store).unwrap();
let req = AgentRequestBuilder::new(Principal::user("alice"))
    .action(AgentAction::tool("send"))
    .resource(Resource::new("Mailbox", "alice@acme"))
    .context(AgentContext::new())
    .build()
    .unwrap();
let decision = authorizer
    .authorize(&req, &Entities::empty())
    .unwrap();
assert_eq!(decision.effect, agentguard_core::authorize::Effect::Allow);

pub fn schema(&self) -> Option<&Schema>

pub fn store(&self) -> &PolicyStore

pub fn policies(&self) -> &PolicySet

pub fn policy_count(&self) -> usize

Number of policies in the loaded set. O(1) for the PolicySet length (cached). Used by /readyz to check that policies are loaded without iterating the full set.