Embedded Cedar authorization for repository-scoped memory access.
Cedar memory entity UIDs identify authorization scope rather than an actual
memory node. The UID ID is a JSON array of repository ID, audience scope,
and node type. Audience scope is ["repo"] or
["groups", encoded_group_id, ...], where each group ID is itself the JSON
encoding of [organization, group]. Consequently, same-type memories in
the same repository and audience always evaluate identically.
Summary
Functions
Decides scope access, returning false for a denied audience and errors for evaluation failures.
Requires an allowed decision, returning an AccessError on denial or evaluation failure.
Checks trusted repository membership independently of the configured Cedar policy.
Compiles and validates a default or custom policy; nil and false disable authorization.
Validates and canonicalizes a repo-wide or organization-qualified group audience.
Types
Functions
@spec allowed?(t() | nil, map() | nil, String.t(), atom(), map()) :: {:ok, boolean()} | {:error, Mnemosyne.Errors.Invalid.AccessError.t()}
Decides scope access, returning false for a denied audience and errors for evaluation failures.
@spec authorize(t() | nil, map() | nil, String.t(), atom(), map()) :: :ok | {:error, Mnemosyne.Errors.Invalid.AccessError.t()}
Requires an allowed decision, returning an AccessError on denial or evaluation failure.
@spec member(t() | nil, map() | nil, String.t()) :: :ok | {:error, Mnemosyne.Errors.Invalid.AccessError.t()}
Checks trusted repository membership independently of the configured Cedar policy.
@spec new(nil | false | keyword()) :: {:ok, nil | t()} | {:error, Mnemosyne.Errors.Invalid.AccessError.t()}
Compiles and validates a default or custom policy; nil and false disable authorization.
@spec normalize_audience(term()) :: {:ok, audience()} | {:error, Mnemosyne.Errors.Invalid.AccessError.t()}
Validates and canonicalizes a repo-wide or organization-qualified group audience.