1.18.0 — Executable Obligation Handlers

Adds automatic execution of obligation handlers after permit decisions:

• New Guard.register_obligation_handler(type, handler) API for registering sync or async callbacks

• Handlers are invoked automatically for permit decisions, in obligation order

• ObligationNotMetError now flips the decision to deny with reason="obligation_failed"

• Optional challenge is propagated to Decision.challenge

• Any other exception is logged and also fails closed

• First failing handler short-circuits remaining handlers

• Conditional obligations are respected:

  • handler is skipped when the obligation condition evaluates to False

• Unregistered obligation types remain in Decision.obligations for manual handling

• Registering a handler for an existing type replaces the previous one

New public exception

• rbacx.core.engine.ObligationNotMetError

  • raised by obligation handlers to signal that an obligation was not met
  • accepts optional challenge= keyword argument

No breaking changes

Upgrade

pip install -U rbacx