Struct PrincipalResolver 

pub struct PrincipalResolver { /* private fields */ }

The generation-aware shared resolver. One instance per daemon; the installed ResolverPolicy is swapped (never mutated) when the authorization configuration changes.

Implementations

impl PrincipalResolver

pub fn new(policy: ResolverPolicy) -> Self

Install the initial policy at generation 1 (0 is never a valid stamped generation, so an uninitialized consumer can’t look fresh).

pub fn with_generation(policy: ResolverPolicy, generation: u64) -> Self

Install an initial policy at an already-established authorization generation. The inbound RPC state uses this while atomically replacing its whole compiled authentication snapshot.

pub fn from_config(config: &Config) -> Result<Self>

Compile and install from config. Fails — installing nothing — if the auth sections are invalid; see ResolverPolicy::from_config.

pub fn generation(&self) -> u64

The current authorization-policy generation. Consumers compare their stamped ResolvedPrincipal::generation against this before each privileged operation and re-resolve when it moved.

pub fn replace_policy(&self, policy: ResolverPolicy) -> u64

Install a new policy, invalidating every previously stamped generation. Returns the new generation.

pub fn replace_from_config(&self, config: &Config) -> Result<u64>

Re-compile from config and install (see Self::replace_policy) — UNLESS the auth sections are invalid. An invalid replacement is rejected with the validation error: the current policy stays installed and the generation does NOT advance, so established connections keep resolving against the last valid policy until the config is repaired and reloaded. Installation is the boundary: this does not trust the caller to have validated (the boot path deliberately tolerates a semantically invalid config so it can be repaired), and the check is auth-specific so unrelated config errors cannot block an authorization reload.

pub fn resolve( &self, identity: &AuthenticatedIdentity, ) -> Result<ResolvedPrincipal, DenyReason>

Map a provider-verified identity to its canonical principal and the grants the CURRENT policy assigns it. Fail-closed: any gap — unknown roster id, missing mapping, missing profile, provider/alias inconsistency — is a denial, never partial or shared-operator access.