ihawu-core/org.ihawu.core.policy

Package-level declarations

Policy resolution — split into the contracts you integrate against and the provided implementations you can use as-is or compose.

Contracts & data model

The vocabulary Ihawu speaks regardless of where policies come from. Implement or supply these to integrate any policy source (config, database, OPA, Casbin, …):

ResourcePolicyResolver — the strategy interface Ihawu calls to resolve a resource's policies for a principal. Ihawu enforces what it returns; it never evaluates conditions itself.
IhawuPrincipal — the authenticated identity a resolution is performed for (resolution input).
FieldPolicy — a resolved masking decision for one field (resolution output).
ResourcePolicy — static resource → role → field policies rules consumed by RoleBasedResourcePolicyResolver.

Provided implementations

Batteries-included ResourcePolicyResolvers. Optional — reach for these before writing your own:

RoleBasedResourcePolicyResolver — the default, no-external-dependency resolver driven by static ResourcePolicy rules (supplied directly or loaded from JSON).
CachingResourcePolicyResolver — a memoizing decorator that resolves each (principal, resource) at most once per instance lifetime. Wrap any resolver; control cache scope by controlling the instance (e.g. one per request).

Policy resolution — split into the contracts you integrate against and the provided implementations you can use as-is or compose.

Contracts & data model

The vocabulary Ihawu speaks regardless of where policies come from. Implement or supply these to integrate any policy source (config, database, OPA, Casbin, …):

ResourcePolicyResolver — the strategy interface Ihawu calls to resolve a resource's policies for a principal. Ihawu enforces what it returns; it never evaluates conditions itself.
IhawuPrincipal — the authenticated identity a resolution is performed for (resolution input).
FieldPolicy — a resolved masking decision for one field (resolution output).
ResourcePolicy — static resource → role → field policies rules consumed by RoleBasedResourcePolicyResolver.

Provided implementations

Batteries-included ResourcePolicyResolvers. Optional — reach for these before writing your own:

RoleBasedResourcePolicyResolver — the default, no-external-dependency resolver driven by static ResourcePolicy rules (supplied directly or loaded from JSON).
CachingResourcePolicyResolver — a memoizing decorator that resolves each (principal, resource) at most once per instance lifetime. Wrap any resolver; control cache scope by controlling the instance (e.g. one per request).

Types

CachingResourcePolicyResolver

class CachingResourcePolicyResolver(delegate: ResourcePolicyResolver) : ResourcePolicyResolver

A ResourcePolicyResolver decorator that memoizes the wrapped resolver's results, so resolution happens at most once per (principal, resource) for the lifetime of this instance.

FieldPolicy

data class FieldPolicy(val field: String, val strategy: MaskingStrategy, val placeholder: String? = null)

A resolved masking decision for a single field - the output of policy resolution.

IhawuPrincipal

data class IhawuPrincipal(val userId: String, val roles: Set<String>, val attributes: Map<String, String>)

Represents an authenticated user requesting a resource.

ResourcePolicy

data class ResourcePolicy(val resourceName: String, val roleFieldPolicies: Map<String, List<FieldPolicy>>? = null)

The static masking rules for a single resource, consumed by RoleBasedResourcePolicyResolver.

ResourcePolicyResolver

interface ResourcePolicyResolver

Strategy for resolving the masking policies that apply to a resource requested for a given principal.

RoleBasedResourcePolicyResolver

class RoleBasedResourcePolicyResolver(resourcePolicies: List<ResourcePolicy>) : ResourcePolicyResolver

A configuration-backed ResourcePolicyResolver that resolves static, role-based masking rules.