Struct CedarEvaluator 

pub struct CedarEvaluator {
    pub(crate) shapes: Arc<Shapes>,
    pub(crate) documents: RwLock<Vec<Arc<Document>>>,
}

The engine: one set of shapes, and every document compiled against it.

Fields

shapes: Arc<Shapes>

documents: RwLock<Vec<Arc<Document>>>

Implementations

impl CedarEvaluator

pub fn new(shapes: Arc<Shapes>) -> Self

An engine that validates against shapes.

pub(crate) fn document( &self, compiled: CompiledId, ) -> Result<Arc<Document>, EvalError>

Trait Implementations

impl Evaluator for CedarEvaluator

fn evaluate( &self, subject: &Subject<'_>, compiled: CompiledId, ) -> Result<Outcome, EvalError>

Statements asked about the same subject on one thread share the request built for it, whichever evaluator holds them.

fn compile(&self, predicate: &Value) -> CompileOutcome

Compile a predicate document into a live artifact this evaluator can judge, or say why it cannot.

fn observe(&self, _event: &Observed<'_>)

Every attempt and outcome on the declared observation surface, whether or not evaluation short-circuited. The decision channel short-circuits; this one does not.

fn lifecycle(&self, _event: &Lifecycle<'_>)

froze / unfroze / deleted, so per-account state does not outlive its account.

fn staleness(&self) -> Staleness

How stale this evaluator’s view may be before it counts as unhealthy.

fn policy_lifecycle(&self, event: PolicyLifecycle)

loaded / superseded / removed, so per-policy state does not outlive the artifact it belongs to — see PolicyLifecycle’s doc comment. Defaulted to a no-op: an evaluator that holds no state per compiled artifact (this crate’s regex evaluator, most builtins) has nothing to clean up, and should not be forced to write an empty override just to say so.