Module authzen

Expand description

AuthZEN HTTP endpoint types and handlers.

Reference: https://openid.github.io/authzen/ (OpenID AuthZEN WG draft).

Structs§

AppState: Shared state for HTTP handlers.
AppStateOptions: Runtime dependencies and tuning for an AppState.
AuthorizerHandle: Concurrent policy snapshot with an explicit reload boundary.
BatchEvaluationRequest
BatchEvaluationResponse
EntityRef: Subject/Action/Resource reference: a single entity.
EvaluationRequest: OpenID AuthZEN EvaluationRequest (subject/action/resource/context).
EvaluationResponse: AuthZEN EvaluationResponse.

MAX_BATCH_EVALUATIONS: Maximum number of evaluations accepted in a single /access/v1/evaluations request. Caps memory + CPU per request; anything larger should be split by the caller.

build_request_entities: Build a cedar_policy::Entities from the request’s entities array. Per-request entities are typical for AuthZEN (each PEP sends the entities relevant to its call); a future enhancement can layer shared/static entities on top.
build_state: Build an AppState from a policy store on disk + an optional audit log. If chain_secret is Some, the audit log is opened in chained (HMAC) mode; otherwise plain JSONL.
build_state_with_cache: Like build_state but takes an explicit CacheConfig. Passing None disables caching. This function never reads process environment.
build_state_with_options: Construct app state with explicit cache and audit-rotation options.
evaluation_request_for_caller: Map an HTTP or gRPC request while constraining it to the identity carried by a verified API key. The bound tenant is stored in request/audit metadata, not trusted from caller-controlled Cedar context. It is not a Cedar policy attribute; policy isolation must use trusted entities/context explicitly.
evaluation_request_to_agent
router: Build the AuthZEN HTTP router.