Class AuthorizationEngine

java.lang.Object

zeroecho.pki.server.AuthorizationEngine

public final class AuthorizationEngine
extends Object

Deterministic side-effect-free default-deny authorization engine.

Evaluation is linear in the number of supplied grants and uses constant auxiliary memory. Callers supply an immutable snapshot of assignments for one decision; the engine never reads persistence or invokes external code.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static enum	AuthorizationEngine.Code	Safe decision codes that reveal no protected-object existence.
static final record	AuthorizationEngine.Decision	Finite safe authorization result.
static final record	AuthorizationEngine.Request	One complete authorization input.

Constructor Summary

Constructors

Constructor	Description
AuthorizationEngine(Clock clock)	Creates an engine using an injected authoritative decision clock.

Method Summary

Modifier and Type	Method	Description
AuthorizationEngine.Decision	authorize(AuthorizationEngine.Request request)	Evaluates one request with explicit-deny precedence.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

AuthorizationEngine

public AuthorizationEngine(Clock clock)

Creates an engine using an injected authoritative decision clock.

Parameters:

clock - injected clock

Method Details

authorize

public AuthorizationEngine.Decision authorize(AuthorizationEngine.Request request)

Evaluates one request with explicit-deny precedence.

Parameters:

request - complete immutable input

Returns:

safe finite decision