dogwood.values

Python value, event, response, and fallback authorizer types.

These classes mirror the names in dogwood_language so code written against dogwood-py follows the Rust API shape. Schema-backed production behavior should use dogwood.native; the classes here also power the temporary schema-less fallback path.

Classes

Authorizer(policies)	Stateful fallback authorizer.
Decision(*values)	Authorization decision.
Diagnostics([reason, errors])	Decision diagnostics.
DogwoodRuleRef(rule_index, cedar_policy_id)	Reference to an originating Dogwood rule.
Entity(ty, id)	Cedar entity uid wrapper.
Event(action_name, kind_name, ts, ...)	Dogwood event.
EventBuilder(action, kind)	Builder for Event.
Response(decision, diagnostics)	Authorization response.

class dogwood.values.Decision(*values)

Authorization decision.

Rust mapping: dogwood_language::Decision.

ALLOW = 'Allow'

DENY = 'Deny'

class dogwood.values.Entity(ty: str, id: str)

Cedar entity uid wrapper.

Rust mapping: Dogwood events ultimately carry Cedar entity UIDs for principal/resource scope.

ty: str

id: str

classmethod parse(text: str) → Entity

__init__(ty: str, id: str) → None

class dogwood.values.DogwoodRuleRef(rule_index: int, cedar_policy_id: str)

Reference to an originating Dogwood rule.

Rust mapping: dogwood_language::DogwoodRuleRef.

rule_index: int

cedar_policy_id: str

__init__(rule_index: int, cedar_policy_id: str) → None

class dogwood.values.Diagnostics(reason: tuple[DogwoodRuleRef, ...] = (), errors: tuple[str, ...] = ())

Decision diagnostics.

Rust mapping: dogwood_language::Diagnostics. Native diagnostics are not fully exposed through PyO3 yet; the fallback stores determining rule refs and errors.

reason: tuple[DogwoodRuleRef, ...] = ()

errors: tuple[str, ...] = ()

__init__(reason: tuple[DogwoodRuleRef, ...] = (), errors: tuple[str, ...] = ()) → None

class dogwood.values.Response(decision: Decision, diagnostics: Diagnostics = <factory>)

Authorization response.

Rust mapping: dogwood_language::Response returned by Authorizer::is_authorized for decision-kind events.

decision: Decision

diagnostics: Diagnostics

allowed() → bool

Return true when decision is Decision.ALLOW.

__init__(decision: Decision, diagnostics: Diagnostics = <factory>) → None

class dogwood.values.Event(action_name: str, kind_name: str, ts: int = 0, scope_principal: Entity | None = None, scope_resource: Entity | None = None, logged: dict[str, ~typing.Any]=<factory>, request_ctx: dict[str, ~typing.Any]=<factory>, entities: dict[str, dict[str, ~typing.Any]]=<factory>)

Dogwood event.

Rust mapping: dogwood_language::Event. An event generalizes a Cedar request with a first-class kind such as request or response. Decision kinds are defined by the Dogwood event schema; the default schema makes request a decision kind and response history-only.

action_name: str

kind_name: str

ts: int = 0

scope_principal: Entity | None = None

scope_resource: Entity | None = None

logged: dict[str, Any]

request_ctx: dict[str, Any]

entities: dict[str, dict[str, Any]]

classmethod builder(action: str, kind: str) → EventBuilder

Start building an event.

Rust mapping: Event::builder(action, kind).

property action: str

property kind: str

timestamp() → int

Return the event timestamp.

Rust mapping: Event::timestamp().

principal() → str | None

Return the request principal, if this event carries request scope.

Rust mapping: Event::principal().

resource() → str | None

Return the request resource, if this event carries request scope.

Rust mapping: Event::resource().

field(group: str, name: str) → Any | None

Read one logged event field.

Rust mapping: Event::field(group, name).

fields(group: str) → Iterable[tuple[str, Any]]

Iterate logged event fields in a group.

Rust mapping: Event::fields(group).

field_path(path: list[str] | tuple[str, ...]) → Any | None

request_context_path(path: list[str] | tuple[str, ...]) → Any | None

Read a value from the Cedar request context path.

__init__(action_name: str, kind_name: str, ts: int = 0, scope_principal: Entity | None = None, scope_resource: Entity | None = None, logged: dict[str, ~typing.Any]=<factory>, request_ctx: dict[str, ~typing.Any]=<factory>, entities: dict[str, dict[str, ~typing.Any]]=<factory>) → None

class dogwood.values.EventBuilder(action: str, kind: str)

Builder for Event.

Rust mapping: dogwood_language::EventBuilder.

__init__(action: str, kind: str)

timestamp(ts: int) → EventBuilder

Set the event timestamp.

Rust mapping: EventBuilder::timestamp.

principal(uid: str) → EventBuilder

Set request principal scope.

Rust mapping: EventBuilder::principal.

resource(uid: str) → EventBuilder

Set request resource scope.

Rust mapping: EventBuilder::resource.

field(group: str, name: str, value: Any) → EventBuilder

Add one logged event field.

Rust mapping: EventBuilder::field.

logged_group(group: str, value: dict[str, Any]) → EventBuilder

Add a full logged event field group.

request_context(group: str, name: str, value: Any) → EventBuilder

Add one Cedar request context field.

request_context_group(group: str, value: dict[str, Any]) → EventBuilder

Add a full Cedar request context group.

build() → Event

Return the constructed event.

Rust mapping: EventBuilder::build.

class dogwood.values.Authorizer(policies: Any)

Stateful fallback authorizer.

Rust mapping: dogwood_language::Authorizer. The native equivalent is dogwood.native.NativeAuthorizer; this class is the temporary schema-less Python fallback.

__init__(policies: Any)

history: list[Event]

is_authorized(event: Event) → Response | None

Authorize one event and record it in history.

Rust mapping: Authorizer::is_authorized(&event) -> Option<Response>. Returns None for history-only events. In the fallback, only request is treated as a decision kind.