dogwood.native

dogwood.native#

Native PyO3 wrappers around the Rust dogwood_language API.

The functions in this module are the closest Python surface to the reference Rust implementation described in Dogwood’s API and workflow guide.

Mapping to Rust:

  • NativeAuthorizer wraps dogwood_language::Authorizer::new(LoweredPolicySet) and feeds request events through Authorizer::is_authorized.

  • lower_to_cedar() maps to LoweredPolicySet::from_str(...).as_cedar().

  • cedar_schema() maps to LoweredPolicySet::cedar_schema_str().

  • validate_policy() maps to Validator::new().validate(&policies).

  • replay() maps to dogwood_language::replay_log.

All schema-backed operations require the maturin-built extension module dogwood._dogwood_native.

Functions

authorize_request(policy_source, ...[, ...])

One-shot native authorization.

available()

Return whether the Rust dogwood_language extension is importable.

cedar_schema(policy_source, policy_schema_source)

Return the augmented Cedar schema emitted by Dogwood lowering.

lower_to_cedar(policy_source, ...[, ...])

Lower Dogwood policy source to Cedar policy text.

replay(policy_source, policy_schema_source, ...)

Replay a Dogwood trace and return CLI-style verdict lines.

require_available()

Raise RuntimeError if the native Rust extension is unavailable.

validate_policy(policy_source, ...[, ...])

Validate policy source against the supplied schemas.

Classes

NativeAuthorizer(policy_source, ...[, ...])

Persistent native Dogwood authorizer.
dogwood.native.available() → bool[source]#

Return whether the Rust dogwood_language extension is importable.

dogwood.native.require_available() → None[source]#

Raise RuntimeError if the native Rust extension is unavailable.

class dogwood.native.NativeAuthorizer(policy_source: str, policy_schema_source: str, event_schema_source: str | None = None)[source]#

Persistent native Dogwood authorizer.

Rust mapping:

  • Builds ServiceSchema from event_schema_source or ServiceSchema::defaults().

  • Builds PolicySchema::from_cedarschema_str(policy_schema_source).

  • Lowers with LoweredPolicySet::from_str.

  • Stores dogwood_language::Authorizer and calls Authorizer::is_authorized for each request.

The object is stateful: every authorization call records the event in the underlying Rust authorizer history, so temporal policies can observe prior events.

__init__(policy_source: str, policy_schema_source: str, event_schema_source: str | None = None)[source]#
authorize_request(action: str, principal: str, resource: str, input: dict[str, Any]) → str[source]#

Authorize one request event and return "Allow" or "Deny".

Rust mapping: builds a dogwood_language::Event with kind "request" from the supplied action, principal, resource, and input, then calls Authorizer::is_authorized.

dogwood.native.lower_to_cedar(policy_source: str, policy_schema_source: str, event_schema_source: str | None = None) → str[source]#

Lower Dogwood policy source to Cedar policy text.

Rust mapping: LoweredPolicySet::from_str followed by LoweredPolicySet::as_cedar rendering.

dogwood.native.cedar_schema(policy_source: str, policy_schema_source: str, event_schema_source: str | None = None) → str[source]#

Return the augmented Cedar schema emitted by Dogwood lowering.

Rust mapping: LoweredPolicySet::cedar_schema_str.

dogwood.native.validate_policy(policy_source: str, policy_schema_source: str, event_schema_source: str | None = None) → dict[str, Any][source]#

Validate policy source against the supplied schemas.

Rust mapping: LoweredPolicySet::from_str then Validator::new().validate(&policies).

dogwood.native.replay(policy_source: str, policy_schema_source: str, trace_source: str, event_schema_source: str | None = None) → str[source]#

Replay a Dogwood trace and return CLI-style verdict lines.

Rust mapping: dogwood_language::replay_log after lowering the policy set against the provided action and optional event schemas.

dogwood.native.authorize_request(policy_source: str, policy_schema_source: str, action: str, principal: str, resource: str, input: dict[str, Any], event_schema_source: str | None = None) → str[source]#

One-shot native authorization.

Rust mapping: lower policy source into a fresh LoweredPolicySet, create a fresh Authorizer, build one request event, and call Authorizer::is_authorized. Prefer NativeAuthorizer for repeated decisions so parse/lower work happens once.