Module principal_resolver 

The RFC 7141 shared principal resolver: ONE place that maps a provider-verified AuthenticatedIdentity to a canonical Principal and its currently-configured grants.

Providers verify credentials into identities; they never touch this vocabulary. The resolver owns the explicit claim-to-profile mapping ([oidc.<alias>].profile_map), the local roster ([users.<name>]), and the compiled [permission_profiles] — and it stamps every resolution with the AUTHORIZATION-POLICY GENERATION it was computed from. Consumers hold the Principal for the connection’s lifetime but re-resolve grants whenever PrincipalResolver::generation has moved past their stamped value, so removing or narrowing a profile, mapping, or roster entry affects established connections at the next privileged operation — no reconnect or daemon restart required.

Deny-by-default: unmapped identities, unmapped claim values, unknown roster ids, and any policy inconsistency resolve to a denial, never to shared-operator or partial access.

Structs

OidcMapping

The identity-mapping half of one [oidc.<alias>] trust relationship.

PrincipalResolver

The generation-aware shared resolver. One instance per daemon; the installed ResolverPolicy is swapped (never mutated) when the authorization configuration changes.

ResolvedPrincipal

One identity’s resolution at a specific policy generation.

ResolverPolicy

One compiled authorization policy: everything the resolver needs at one generation. Immutable once installed; a config change installs a new policy (and bumps the generation) rather than mutating this one.