Struct PartialResponse

pub struct PartialResponse {
    pub satisfied_permits: HashMap<PolicyID, Arc<Annotations>>,
    pub false_permits: HashMap<PolicyID, (ErrorState, Arc<Annotations>)>,
    pub residual_permits: HashMap<PolicyID, (Arc<Expr>, Arc<Annotations>)>,
    pub satisfied_forbids: HashMap<PolicyID, Arc<Annotations>>,
    pub false_forbids: HashMap<PolicyID, (ErrorState, Arc<Annotations>)>,
    pub residual_forbids: HashMap<PolicyID, (Arc<Expr>, Arc<Annotations>)>,
    pub errors: Vec<AuthorizationError>,
    /* private fields */
}

A partially evaluated authorization response. Splits the results into several categories: satisfied, false, and residual for each policy effect. Also tracks all the errors that were encountered during evaluation. This structure currently has to own all of the PolicyID objects due to the Self::reauthorize method. If PolicySet could borrow its PolicyID/contents then this whole structured could be borrowed.

Fields

satisfied_permits: HashMap<PolicyID, Arc<Annotations>>

All of the Effect::Permit policies that were satisfied

false_permits: HashMap<PolicyID, (ErrorState, Arc<Annotations>)>

All of the Effect::Permit policies that were not satisfied

residual_permits: HashMap<PolicyID, (Arc<Expr>, Arc<Annotations>)>

All of the Effect::Permit policies that evaluated to a residual

satisfied_forbids: HashMap<PolicyID, Arc<Annotations>>

All of the Effect::Forbid policies that were satisfied

false_forbids: HashMap<PolicyID, (ErrorState, Arc<Annotations>)>

All of the Effect::Forbid policies that were not satisfied

residual_forbids: HashMap<PolicyID, (Arc<Expr>, Arc<Annotations>)>

All of the Effect::Forbid policies that evaluated to a residual

errors: Vec<AuthorizationError>

All of the policy errors encountered during evaluation

Implementations

impl PartialResponse

pub fn new( true_permits: impl IntoIterator<Item = (PolicyID, Arc<Annotations>)>, false_permits: impl IntoIterator<Item = (PolicyID, (ErrorState, Arc<Annotations>))>, residual_permits: impl IntoIterator<Item = (PolicyID, (Arc<Expr>, Arc<Annotations>))>, true_forbids: impl IntoIterator<Item = (PolicyID, Arc<Annotations>)>, false_forbids: impl IntoIterator<Item = (PolicyID, (ErrorState, Arc<Annotations>))>, residual_forbids: impl IntoIterator<Item = (PolicyID, (Arc<Expr>, Arc<Annotations>))>, errors: impl IntoIterator<Item = AuthorizationError>, request: Arc<Request>, ) -> Self

Create a partial response from each of the policy result categories

pub fn concretize(self) -> Response

Convert this response into a concrete evaluation response. All residuals are treated as errors

pub fn decision(&self) -> Option<Decision>

Attempt to reach a partial decision; the presence of residuals may result in returning None, indicating that a decision could not be reached given the unknowns

pub fn definitely_satisfied(&self) -> impl Iterator<Item = Policy> + '_

Returns the set of PolicyIDs that were definitely satisfied – both permits and forbids

pub fn definitely_errored(&self) -> impl Iterator<Item = &PolicyID>

Returns the set of PolicyIDs that encountered errors

pub fn may_be_determining(&self) -> impl Iterator<Item = Policy> + '_

Returns an over-approximation of the set of determining policies.

This is all policies that may be determining for any substitution of the unknowns.

pub fn must_be_determining(&self) -> impl Iterator<Item = Policy> + '_

Returns an under-approximation of the set of determining policies.

This is all policies that must be determining for all possible substitutions of the unknowns.

pub fn nontrivial_residuals(&self) -> impl Iterator<Item = Policy> + '_

Returns the set of non-trivial (meaning more than just true or false) residuals expressions

pub fn nontrivial_residual_ids(&self) -> impl Iterator<Item = &PolicyID>

Returns the set of ids of non-trivial (meaning more than just true or false) residuals expressions

pub fn nontrival_forbids(&self) -> impl Iterator<Item = Policy> + '_

Returns the set of non-trivial (meaning more than just true or false) residuals expressions from Effect::Forbid

pub fn all_residuals(&self) -> impl Iterator<Item = Policy> + '_

Returns every policy residual, including trivial ones

pub fn get(&self, id: &PolicyID) -> Option<Policy>

Return the residual for a given PolicyID, if it exists in the response

pub fn reauthorize( &self, mapping: &HashMap<SmolStr, Value>, auth: &Authorizer, es: &Entities, ) -> Result<Self, ReauthorizationError>

Attempt to re-authorize this response given a mapping from unknowns to values

Trait Implementations

impl Clone for PartialResponse

fn clone(&self) -> PartialResponse

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for PartialResponse

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl From<PartialResponse> for Response

fn from(p: PartialResponse) -> Self

Converts to this type from the input type.