wardowl 2.0.0__py3-none-any.whl

wardowl/__init__.py

@@ -0,0 +1,60 @@
+"""wardowl: permission-aware retrieval for RAG.
+
+Every user gets only the chunks they are allowed to read, whatever vector store, permission system
+or framework you use.
+"""
+
+from wardowl.authz import (
+    AllOf,
+    AnyOf,
+    AuthorizationError,
+    Authorizer,
+    FunctionAuthorizer,
+    MetadataACLAuthorizer,
+    TenantAuthorizer,
+)
+from wardowl.backends.memory import InMemoryBackend
+from wardowl.caching import CachingAuthorizer
+from wardowl.events import JsonLinesAudit, RetrievalEvent
+from wardowl.filters import And, Filter, In, Or, filter_from_dict, filter_to_dict, matches
+from wardowl.fusion import RankFusion
+from wardowl.redaction import PatternRedactor, Redactor, SpanRedactor
+from wardowl.retriever import PermissionedRetriever, Reranker, RetrievalResult, SearchBackend, Strategy
+from wardowl.types import Document, Hit, Query, Subject
+
+__version__ = "2.0.0"
+
+__all__ = [
+    "AllOf",
+    "And",
+    "AnyOf",
+    "AuthorizationError",
+    "Authorizer",
+    "CachingAuthorizer",
+    "Document",
+    "Filter",
+    "FunctionAuthorizer",
+    "Hit",
+    "In",
+    "InMemoryBackend",
+    "JsonLinesAudit",
+    "MetadataACLAuthorizer",
+    "Or",
+    "PatternRedactor",
+    "PermissionedRetriever",
+    "Query",
+    "RankFusion",
+    "Redactor",
+    "Reranker",
+    "RetrievalEvent",
+    "RetrievalResult",
+    "SearchBackend",
+    "SpanRedactor",
+    "Strategy",
+    "Subject",
+    "TenantAuthorizer",
+    "__version__",
+    "filter_from_dict",
+    "filter_to_dict",
+    "matches",
+]

wardowl/authorizers/__init__.py

@@ -0,0 +1,14 @@
+"""Authorizers for external permission systems. Each lives in its own module.
+
+The HTTP authorizers (`opa.OPAAuthorizer`, `openfga.OpenFGAAuthorizer`,
+`spicedb.SpiceDBAuthorizer`, `cerbos.CerbosAuthorizer`, `keto.KetoAuthorizer`) share one client: it
+reuses connections (never across `fork()`), bounds each call by `timeout` (except the DNS lookup
+of the host) and each answer by `max_response_bytes`, retries transient failures once, never
+follows redirects, honours the standard proxy variables, refuses to send an `Authorization` header
+unencrypted over the network unless `allow_insecure=True`, and can pause requests to a failing
+server with a `CircuitBreaker`.
+"""
+
+from wardowl.authorizers._http import CircuitBreaker
+
+__all__ = ["CircuitBreaker"]

wardowl/authorizers/_http.py

@@ -0,0 +1,420 @@
+"""HTTP for the authorizers, with the standard library only.
+
+* Connections are kept alive and reused, one per thread, so a busy retriever does not open a TCP
+  (and TLS) connection for every permission check. A connection made before `fork()` is never used
+  in the child process: parent and child would share one socket and could read each other's answers.
+* `timeout` bounds a whole call: connecting to each address of the host, the TLS handshake,
+  sending, every read of the answer, the pause before a retry and the retry itself. An answer
+  larger than `max_response_bytes` (10 MiB by default) is refused.
+* Looking up the host's addresses is the one step `timeout` does not bound, though the time it takes
+  counts against it. The standard library has no timeout for `getaddrinfo`, and a lookup run in a
+  thread cannot be stopped: each one that hung would hold a thread until the system resolver gave
+  up, and during a DNS outage they would pile up. The resolver's own settings bound it (`timeout`
+  and `attempts` in /etc/resolv.conf), a url with an IP address needs no lookup, and connections
+  are reused, so a lookup happens only when a new one is opened.
+* A request that fails in a way that is safe to repeat is retried `retries` times (default once):
+  a refused or reset connection, a response that never arrived, or HTTP 502, 503 or 504. Every
+  request is a query (OPA's data API, OpenFGA's checks and object lists), so repeating one has no
+  side effects. Timeouts are not retried, and neither are other HTTP errors or invalid answers,
+  which would only repeat.
+* A connection the server closed while it sat idle is replaced and the request sent again, once,
+  without counting as a retry.
+* An optional `CircuitBreaker` stops calling a service that keeps failing, for a cooldown.
+* Redirects are never followed: a permission service has no reason to send one.
+* When a proxy applies to the host (the standard `HTTP_PROXY`, `HTTPS_PROXY` and `NO_PROXY`
+  variables), requests go through urllib, which handles proxies, without connection reuse.
+* `ssl_context` is refused for an http:// url, where it would not be used. An `Authorization`
+  header is refused over http:// unless the url names this machine (`localhost`, `127.0.0.1`,
+  `::1`) and no proxy applies, or `allow_insecure=True` is passed.
+
+Whatever still fails raises `AuthorizationError`, so retrieval fails closed.
+"""
+
+from __future__ import annotations
+
+import http.client
+import io
+import ipaddress
+import json
+import os
+import socket
+import ssl
+import threading
+import time
+import urllib.error
+import urllib.request
+from collections.abc import Callable, Mapping
+from typing import Any
+from urllib.parse import SplitResult, urlsplit
+
+from wardowl.authz import AuthorizationError
+
+__all__ = ["DEFAULT_MAX_RESPONSE_BYTES", "CircuitBreaker", "JsonClient"]
+
+_RETRY_STATUS = frozenset({502, 503, 504})
+
+DEFAULT_MAX_RESPONSE_BYTES = 10 * 1024 * 1024
+"""The largest answer a permission service may send, unless `max_response_bytes` says otherwise."""
+
+_deadline = threading.local()  # `at`: when the request in flight on this thread must be answered
+
+
+class CircuitBreaker:
+    """Pauses requests to a permission service that keeps failing.
+
+    After `failures` consecutive failed requests the breaker opens, and every call raises
+    `AuthorizationError` at once, without contacting the service, for `reset_after` seconds. Then
+    one request is let through as a probe: if it succeeds the breaker closes, if it fails the
+    breaker opens again. A failure is a request that got no HTTP response, or a 5xx one; any other
+    response shows that the service is up. Retrieval fails closed while the breaker is open, as it
+    would if every request failed, but a struggling service is not flooded with requests.
+
+    One breaker can be shared by several authorizers that call the same service.
+    """
+
+    def __init__(
+        self, failures: int = 5, reset_after: float = 30.0, *, clock: Callable[[], float] = time.monotonic
+    ) -> None:
+        if failures < 1 or reset_after <= 0:
+            raise ValueError("failures and reset_after must be positive")
+        self.failures = failures
+        self.reset_after = reset_after
+        self._clock = clock
+        self._lock = threading.Lock()
+        self._consecutive = 0
+        self._opened_at: float | None = None
+        self._probing = False
+
+    @property
+    def is_open(self) -> bool:
+        """True while requests are paused, for monitoring."""
+        with self._lock:
+            return self._opened_at is not None
+
+    def allow(self) -> None:
+        """Raise `AuthorizationError` while open; after the cooldown, let one probe through."""
+        with self._lock:
+            if self._opened_at is None:
+                return
+            if self._probing or self._clock() - self._opened_at < self.reset_after:
+                raise AuthorizationError("the permission service keeps failing; requests are paused (circuit open)")
+            self._probing = True
+
+    def record(self, ok: bool) -> None:
+        """Record the outcome of a request that `allow` let through."""
+        with self._lock:
+            probing, self._probing = self._probing, False
+            if ok:
+                self._consecutive = 0
+                self._opened_at = None
+                return
+            self._consecutive += 1
+            if probing or self._consecutive >= self.failures:
+                self._opened_at = self._clock()
+
+
+class _TooLarge(Exception):
+    """The answer is larger than `max_response_bytes`."""
+
+
+def _left(deadline: float) -> float:
+    """The seconds left before `deadline`; `TimeoutError` when none are."""
+    left = deadline - time.monotonic()
+    if left <= 0:
+        raise TimeoutError("the deadline passed")
+    return left
+
+
+class _DeadlineIO(io.RawIOBase):
+    """A response's socket file: every read waits only for the time left before the deadline, so a
+    server that sends its answer slowly cannot stretch a call past `timeout`."""
+
+    def __init__(self, sock: socket.socket, deadline: float) -> None:
+        super().__init__()
+        self._raw = sock.makefile("rb", 0)  # counted among the socket's files, as a response's own is
+        self._socket = sock
+        self._deadline = deadline
+
+    def readable(self) -> bool:
+        return True
+
+    def readinto(self, b: Any) -> int | None:
+        self._socket.settimeout(_left(self._deadline))
+        return self._raw.readinto(b)
+
+    def close(self) -> None:
+        if not self.closed:
+            self._raw.close()
+        super().close()
+
+
+class _Response(http.client.HTTPResponse):
+    """An HTTP response read under the deadline of the request in flight on this thread."""
+
+    def __init__(self, sock: socket.socket, *args: Any, **kwargs: Any) -> None:
+        super().__init__(sock, *args, **kwargs)
+        deadline: float | None = getattr(_deadline, "at", None)
+        if deadline is not None:
+            plain = self.fp  # nothing has been read from it yet
+            self.fp = io.BufferedReader(_DeadlineIO(sock, deadline))
+            plain.close()
+
+
+def _create_connection(
+    address: tuple[str, int], timeout: Any = None, source_address: tuple[str, int] | None = None
+) -> socket.socket:
+    """`socket.create_connection` under the deadline of the request in flight on this thread.
+
+    Each address gets only the time left, not a fresh `timeout`, and the connected socket is then
+    set to the time still left, which bounds the TLS handshake that follows. The lookup of the
+    addresses is not bounded (see the module docstring).
+    """
+    deadline: float | None = getattr(_deadline, "at", None)
+    if deadline is None:
+        return socket.create_connection(address, timeout, source_address)
+    host, port = address
+    failure = OSError(f"no address found for {host!r}")
+    for family, kind, proto, _, sockaddr in socket.getaddrinfo(host, port, 0, socket.SOCK_STREAM):
+        left = _left(deadline)  # TimeoutError once the lookup or earlier addresses used up the time
+        sock = socket.socket(family, kind, proto)
+        try:
+            sock.settimeout(left)
+            if source_address is not None:
+                sock.bind(source_address)
+            sock.connect(sockaddr)
+            sock.settimeout(_left(deadline))  # what remains is all the TLS handshake gets
+        except OSError as exc:
+            sock.close()
+            if isinstance(exc, TimeoutError):
+                raise  # the deadline has passed: there is no time left for another address
+            failure = exc
+        except BaseException:
+            sock.close()
+            raise
+        else:
+            return sock
+    raise failure
+
+
+class _HTTPConnection(http.client.HTTPConnection):
+    response_class = _Response
+
+    def __init__(self, *args: Any, **kwargs: Any) -> None:
+        super().__init__(*args, **kwargs)
+        self._create_connection = _create_connection
+
+
+class _HTTPSConnection(http.client.HTTPSConnection):
+    response_class = _Response
+
+    def __init__(self, *args: Any, **kwargs: Any) -> None:
+        super().__init__(*args, **kwargs)
+        self._create_connection = _create_connection
+
+
+class _HTTPHandler(urllib.request.HTTPHandler):
+    def http_open(self, req: urllib.request.Request) -> http.client.HTTPResponse:
+        return self.do_open(_HTTPConnection, req)
+
+
+class _HTTPSHandler(urllib.request.HTTPSHandler):
+    def __init__(self, context: ssl.SSLContext) -> None:
+        super().__init__(context=context)
+        self._tls = context
+
+    def https_open(self, req: urllib.request.Request) -> http.client.HTTPResponse:
+        return self.do_open(_HTTPSConnection, req, context=self._tls)
+
+
+class _NoRedirect(urllib.request.HTTPRedirectHandler):
+    def redirect_request(self, *args: Any, **kwargs: Any) -> None:
+        return None  # urllib then raises HTTPError for the 3xx response
+
+
+def _proxy_applies(parts: SplitResult) -> bool:
+    return parts.scheme in urllib.request.getproxies() and not urllib.request.proxy_bypass(parts.hostname or "")
+
+
+def _loopback(host: str) -> bool:
+    """True when `host` names this machine, so a request to it never crosses a network."""
+    if host == "localhost":
+        return True
+    try:
+        return ipaddress.ip_address(host).is_loopback
+    except ValueError:
+        return False
+
+
+class JsonClient:
+    """POSTs JSON to one service and returns the decoded answer of a 200 response."""
+
+    def __init__(
+        self,
+        url: str,
+        *,
+        service: str,
+        timeout: float,
+        headers: Mapping[str, str],
+        retries: int = 1,
+        breaker: CircuitBreaker | None = None,
+        ssl_context: ssl.SSLContext | None = None,
+        max_response_bytes: int = DEFAULT_MAX_RESPONSE_BYTES,
+        allow_insecure: bool = False,
+    ) -> None:
+        parts = urlsplit(url)
+        if parts.scheme not in ("http", "https") or not parts.hostname:
+            raise ValueError(f"the {service} url must start with http:// or https:// and name a host")
+        if retries < 0:
+            raise ValueError("retries must be zero or more")
+        if timeout <= 0 or max_response_bytes < 1:
+            raise ValueError("timeout and max_response_bytes must be positive")
+        if ssl_context is not None and parts.scheme != "https":
+            raise ValueError(f"ssl_context is only used with https://, but the {service} url is {parts.scheme}://")
+        self._proxied = _proxy_applies(parts)
+        cleartext = parts.scheme == "http" and (self._proxied or not _loopback(parts.hostname or ""))
+        if cleartext and not allow_insecure and any(h.lower() == "authorization" for h in headers):
+            raise ValueError(
+                f"the {service} url is http://, so the Authorization header would cross the network unencrypted: "
+                "use https://, or pass allow_insecure=True if the network is trusted"
+            )
+        self.url = url.rstrip("/")
+        self.service = service
+        self.timeout = timeout
+        self.retries = retries
+        self.breaker = breaker
+        self.max_response_bytes = max_response_bytes
+        self.headers = {"Content-Type": "application/json", **headers}
+        self._parts = parts
+        self._prefix = parts.path.rstrip("/")
+        self._ssl = ssl_context or (ssl.create_default_context() if parts.scheme == "https" else None)
+        self._local = threading.local()
+
+    def post_json(self, path: str, payload: Any, what: str, *, lines: bool = False) -> Any:
+        """POST `payload` and return the decoded answer; with `lines`, a list with one decoded
+        value per line of a newline-delimited JSON answer (a streamed response)."""
+        try:
+            body = json.dumps(payload).encode()
+        except (TypeError, ValueError) as exc:
+            raise AuthorizationError(f"{what}: the input is not JSON-serialisable: {exc}") from exc
+        if self.breaker is not None:
+            self.breaker.allow()
+        deadline = time.monotonic() + self.timeout
+        reachable = False  # recorded on every way out, so a probe can never leave the breaker stuck
+        try:
+            attempt = 0
+            while True:
+                last: BaseException | None = None  # the exception behind the failure, kept as its cause
+                try:
+                    status, raw = self._send(path, body, deadline)
+                except TimeoutError as exc:
+                    raise AuthorizationError(f"{what} timed out after {self.timeout} s") from exc
+                except ssl.SSLCertVerificationError as exc:
+                    raise AuthorizationError(f"{what}: TLS certificate verification failed: {exc}") from exc
+                except _TooLarge as exc:
+                    reachable = True  # the service answered; the answer is what is wrong
+                    raise AuthorizationError(f"{what} answered with more than {self.max_response_bytes} bytes") from exc
+                except (OSError, http.client.HTTPException) as exc:
+                    failure, last = f"{type(exc).__name__}: {exc}", exc
+                else:
+                    if status not in _RETRY_STATUS:
+                        reachable = status < 500
+                        return self._decode(status, raw, what, lines)
+                    failure = f"HTTP {status}"
+                pause = min(0.05 * 2**attempt, 1.0)
+                if attempt >= self.retries or time.monotonic() + pause >= deadline:
+                    raise AuthorizationError(f"{what} failed: {failure}") from last
+                attempt += 1
+                time.sleep(pause)
+        finally:
+            if self.breaker is not None:
+                self.breaker.record(reachable)
+
+    @staticmethod
+    def _decode(status: int, raw: bytes, what: str, lines: bool = False) -> Any:
+        if status != 200:
+            raise AuthorizationError(f"{what} returned HTTP {status}")
+        try:
+            if lines:
+                return [json.loads(line) for line in raw.splitlines() if line.strip()]
+            return json.loads(raw)
+        except ValueError as exc:
+            raise AuthorizationError(f"{what} returned invalid JSON") from exc
+
+    def _read(self, response: http.client.HTTPResponse) -> bytes:
+        """The whole body; `_TooLarge` when it is over `max_response_bytes`, before reading it when
+        the length is announced."""
+        limit = self.max_response_bytes
+        if response.length is not None:
+            if response.length > limit:
+                raise _TooLarge(response.length)
+            return response.read()  # raises IncompleteRead if the body is cut short
+        raw = response.read(limit + 1)  # chunked, or ended by closing the connection
+        if len(raw) > limit:
+            raise _TooLarge(len(raw))
+        return raw
+
+    # ---- transports ------------------------------------------------------------------------
+
+    def _send(self, path: str, body: bytes, deadline: float) -> tuple[int, bytes]:
+        _deadline.at = deadline
+        try:
+            if self._proxied:
+                return self._send_urllib(path, body, deadline)
+            held: tuple[int, http.client.HTTPConnection] | None = getattr(self._local, "conn", None)
+            if held is not None:
+                self._local.conn = None
+                pid, conn = held
+                if pid != os.getpid():
+                    conn.close()  # made before fork(): this process's copy of the parent's socket
+                else:
+                    try:
+                        return self._exchange(conn, path, body, deadline)
+                    except (ConnectionError, http.client.BadStatusLine):
+                        pass  # the server closed the idle connection; send once more on a new one
+            return self._exchange(self._connect(), path, body, deadline)
+        finally:
+            _deadline.at = None
+
+    def _connect(self) -> http.client.HTTPConnection:
+        host, port = self._parts.hostname or "", self._parts.port
+        if self._parts.scheme == "https":
+            return _HTTPSConnection(host, port, context=self._ssl)
+        return _HTTPConnection(host, port)
+
+    def _exchange(self, conn: http.client.HTTPConnection, path: str, body: bytes, deadline: float) -> tuple[int, bytes]:
+        try:
+            sock = conn.sock
+            if sock is None:
+                conn.timeout = _left(deadline)
+                conn.connect()  # TCP and TLS within the deadline, by _create_connection
+                sock = conn.sock
+            sock.settimeout(_left(deadline))
+            conn.request("POST", self._prefix + path, body=body, headers=self.headers)
+            response = conn.getresponse()  # read under the deadline, by _Response
+            raw = self._read(response)
+        except BaseException:
+            conn.close()
+            raise
+        if response.will_close:
+            conn.close()
+        else:
+            self._local.conn = (os.getpid(), conn)
+        return response.status, raw
+
+    def _send_urllib(self, path: str, body: bytes, deadline: float) -> tuple[int, bytes]:
+        handlers: list[Any] = [_NoRedirect(), _HTTPHandler()]
+        if self._ssl is not None:
+            handlers.append(_HTTPSHandler(self._ssl))
+        opener = urllib.request.build_opener(*handlers)
+        # The scheme is restricted to http(s) in __init__, so this cannot open file:// or others.
+        request = urllib.request.Request(self.url + path, data=body, headers=self.headers, method="POST")  # noqa: S310
+        try:
+            with opener.open(request, timeout=_left(deadline)) as response:
+                return response.status, self._read(response)
+        except urllib.error.HTTPError as exc:
+            exc.close()
+            return exc.code, b""  # only a 200 answer's body is read
+        except urllib.error.URLError as exc:
+            if isinstance(exc.reason, TimeoutError):
+                raise TimeoutError(str(exc.reason)) from exc
+            raise

wardowl/authorizers/casbin.py

@@ -0,0 +1,119 @@
+"""Casbin authorizer: decisions per chunk from a Casbin enforcer, in this process.
+
+Pass the `casbin.Enforcer` you already use, built with your model, adapter and policies; the
+`casbin` extra installs the library. Casbin evaluates in the process, so there is no service to
+reach.
+
+* `check` asks the enforcer about each chunk, with `batch_enforce` when it has one. The request is
+  `(subject.id, object, action)`, where the object is `hit.metadata[resource_field]` (or the chunk
+  id when `resource_field` is None) and the action is mapped through `actions`; a chunk without its
+  object is denied. `request` replaces that tuple, for ABAC models whose matchers read attributes.
+* With `group_subjects=True`, the request is also made with each of the subject's groups in place of
+  its id, written `group_prefix` + the group (`"group:eng"` by default), and a chunk is allowed if
+  any request is: for allow-only models whose groups come from the verified token. Policies for
+  groups must name them with the prefix. Users and roles share Casbin's subject field, so without
+  it a group named like a user or a role (`"admin"`, `"ceo@example.com"`) would be granted that
+  user's or role's access; a subject id that starts with the prefix raises `AuthorizationError`
+  for the same reason. A model with deny effects must keep memberships in its own `g` policies
+  instead, since a deny for one group would not override an allow for another.
+* `filter_for` returns None, so the retriever post-filters and every candidate is decided by Casbin.
+
+An enforcer that raises, or answers with anything but one boolean per request, makes `check` raise
+`AuthorizationError`.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Callable, Mapping, Sequence
+from typing import Any
+
+from wardowl.authz import AuthorizationError
+from wardowl.filters import Filter
+from wardowl.types import Hit, Subject
+
+__all__ = ["CasbinAuthorizer"]
+
+Request = Callable[[Subject, Hit, str], Sequence[Any]]
+
+
+class CasbinAuthorizer:
+    """Decides each chunk with a Casbin enforcer.
+
+    `enforcer` is a `casbin.Enforcer` (or `SyncedEnforcer`, to share one across threads that also
+    change policies). `actions` maps wardowl actions to Casbin actions (default
+    `{"read": "read"}`). With `group_subjects=True`, groups are asked about as `group_prefix` + the
+    group, so policies for groups must use that prefix.
+    """
+
+    def __init__(
+        self,
+        enforcer: Any,
+        *,
+        actions: Mapping[str, str] | None = None,
+        resource_field: str | None = "doc_id",
+        group_subjects: bool = False,
+        group_prefix: str = "group:",
+        request: Request | None = None,
+    ) -> None:
+        if not callable(getattr(enforcer, "enforce", None)):
+            raise TypeError("enforcer must be a casbin Enforcer (with an enforce method)")
+        if not isinstance(group_prefix, str) or not group_prefix:
+            raise ValueError("group_prefix must be a non-empty string, so groups cannot pass for users or roles")
+        self.enforcer = enforcer
+        self.actions = dict(actions or {"read": "read"})
+        self.resource_field = resource_field
+        self.group_subjects = group_subjects
+        self.group_prefix = group_prefix
+        self.request = request
+
+    def _action(self, action: str) -> str:
+        if action not in self.actions:
+            raise AuthorizationError(f"no Casbin action is configured for action {action!r}")
+        return self.actions[action]
+
+    def _object(self, hit: Hit) -> str | None:
+        if self.resource_field is None:
+            return hit.id
+        value = hit.metadata.get(self.resource_field)
+        return value if isinstance(value, str) and value else None
+
+    def _who(self, subject: Subject) -> list[str]:
+        """The Casbin subjects to ask about: the subject's id, then its groups with their prefix."""
+        if not self.group_subjects:
+            return [subject.id]
+        if subject.id.startswith(self.group_prefix):
+            raise AuthorizationError(f"subject id {subject.id!r} starts with the group prefix {self.group_prefix!r}")
+        return [subject.id, *(self.group_prefix + g for g in sorted(subject.groups))]
+
+    def _requests(self, subject: Subject, hit: Hit, action: str, who: Sequence[str]) -> list[Sequence[Any]]:
+        if self.request is not None:
+            return [self.request(subject, hit, action)]
+        obj = self._object(hit)
+        if obj is None:
+            return []
+        return [(name, obj, action) for name in who]
+
+    def check(self, subject: Subject, hits: Sequence[Hit], action: str = "read") -> list[bool]:
+        casbin_action = self._action(action)
+        who = self._who(subject) if self.request is None else []
+        try:
+            per_hit = [self._requests(subject, hit, casbin_action, who) for hit in hits]
+            requests = [list(r) for rs in per_hit for r in rs]
+            if not requests:
+                return [False] * len(hits)
+            batch = getattr(self.enforcer, "batch_enforce", None)
+            answers = list(batch(requests)) if callable(batch) else [self.enforcer.enforce(*r) for r in requests]
+        except Exception as exc:
+            raise AuthorizationError(f"Casbin failed: {exc}") from exc
+        if len(answers) != len(requests) or not all(isinstance(a, bool) for a in answers):
+            raise AuthorizationError("Casbin did not answer each request with a boolean")
+        decisions: list[bool] = []
+        position = 0
+        for rs in per_hit:
+            decisions.append(any(answers[position : position + len(rs)]))
+            position += len(rs)
+        return decisions
+
+    def filter_for(self, subject: Subject, action: str = "read") -> Filter | None:
+        self._action(action)
+        return None