Struct ResolverPolicy 

pub struct ResolverPolicy {
    pub profiles: HashMap<String, ResolvedGrants>,
    pub oidc: HashMap<String, OidcMapping>,
    pub roster: HashMap<String, Vec<String>>,
    pub roster_conflict: bool,
}

One compiled authorization policy: everything the resolver needs at one generation. Immutable once installed; a config change installs a new policy (and bumps the generation) rather than mutating this one.

Fields

profiles: HashMap<String, ResolvedGrants>

Compiled [permission_profiles.<alias>] grant sets.

oidc: HashMap<String, OidcMapping>

[oidc.<alias>] identity mappings, by alias.

roster: HashMap<String, Vec<String>>

Local roster: durable principal id → the profile aliases granted to it. Keyed by the EFFECTIVE principal id (principal_id override or entry name), which is what a local provider binds.

roster_conflict: bool

Set when two [users] entries resolved to the SAME effective principal id: the roster cannot deterministically say which grants win, so it is emptied (fail closed) and this flag lets the reload path refuse to install the invalid replacement.

Implementations

impl ResolverPolicy

pub fn from_config(config: &Config) -> Result<Self>

Compile the auth sections of a Config, validating them first.

This is where the “validated config” precondition is actually enforced: load_or_init deliberately tolerates a semantically invalid config so an operator can boot to repair it, so the resolver cannot assume its input was checked. Running the auth-specific validation here means duplicate uids or effective principal ids, invalid issuers, and dangling profile references are rejected before anything is compiled — nothing invalid can become a serving policy. The resolver still fails closed if it meets a gap at resolve time.

Trait Implementations

impl Clone for ResolverPolicy

fn clone(&self) -> ResolverPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ResolverPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ResolverPolicy

fn default() -> ResolverPolicy

Returns the “default value” for a type.