Method clone_engine_for_tunnel

crates/openshell-supervisor-network/src/opa.rs:615–633

Clone the inner regorus engine for per-tunnel L7 evaluation. With the `arc` feature enabled, this shares compiled policy via Arc and only duplicates interpreter state (~microseconds). The cloned engine can be used without Mutex contention.

(&self, expected_generation: u64)

    /// and only duplicates interpreter state (~microseconds). The cloned
    /// engine can be used without Mutex contention.
    pub fn clone_engine_for_tunnel(&self, expected_generation: u64) -> Result<TunnelPolicyEngine> {
        let engine = self
            .engine
            .lock()
            .map_err(|_| miette::miette!("OPA engine lock poisoned"))?;
        let generation = self.current_generation();
        if generation != expected_generation {
            return Err(miette::miette!(
                "policy changed before L7 tunnel started [expected_generation:{expected_generation} current_generation:{generation}]"
            ));
        }
        Ok(TunnelPolicyEngine {
            engine: Mutex::new(engine.clone()),
            generation_guard: PolicyGenerationGuard {
                captured_generation: generation,
                current_generation: Arc::clone(&self.generation),
            },
        })
    }
}

/// Convert a `regorus::Value` to a string, handling various types.