Package io.confluent.security.auth.s2s

package io.confluent.security.auth.s2s

Class	Description
CedarPolicyStore	In-memory snapshot of the two-category Cedar policy bundle, {"L2": {policyId -> cedar}, "L3": {policyId -> cedar}}, loaded from the broker config key ConfluentConfigs.S2S_AUTHZ_POLICIES.
EvaluationInput	Input passed to S2SDecisionSource.evaluate(EvaluationInput).
S2SAuthZMetrics	Per-layer S2S AuthZ decision metric: s2s-authz-checks-rate, tagged layer (L2/L3b), outcome (allow/deny/continue/abstain), and tokenType.
S2SConnectionLevelAuthZProvider	L2 connection-level S2S AuthZ GATE: evaluates the calling service's SPIRE-mTLS cert SPIFFE-ID against the L2 Cedar policy category and emits a S2SDenyRule on a veto.
S2SConnectionLevelDecisionSource	SRJ Cedar integration point for the L2 connection-level AuthZ provider.
S2SDecisionSource	Pluggable decision source for the S2S AuthZ provider.
S2SDecisionSource.Decision
S2SDecisionSource.Result	Outcome of S2SDecisionSource.evaluate(EvaluationInput), widened beyond the tri-state S2SDecisionSource.Decision with the diagnostic detail the observability layer needs: an outcome label (one of allow/deny/continue/abstain, layer-specific — see S2SConnectionLevelDecisionSource / S2SServiceLevelDecisionSource), and the SRJ Decision's determining policy IDs (reasons) and passName, when the underlying SRJ authorizer actually ran (both are empty when no authorizer is installed, i.e.
S2SDenyRule	DENY-only rule carrying the SPIFFE-ID that triggered the denial.
S2SGrantRule	ALLOW-only rule carrying the system-LAT sub SPIFFE-ID that earned the grant.
S2SServiceLevelAuthZProvider	L3b — the service-level AuthZ VERDICT, dispatched by EmbeddedAuthorizer as the sole verdict for any request whose principal carries a system LAT (tokenType == SYSTEM_LOGICAL_ACCESS_TOKEN), in place of the traditional RBAC/ACL chain.
S2SServiceLevelDecisionSource	SRJ Cedar integration point for the L3b service-level AuthZ provider.