Struct RbacEnforcer 

pub struct RbacEnforcer { /* private fields */ }

In-memory RBAC enforcer.

Reconstructed from WAL events at bootstrap via role assignment and capability grant/revoke calls.

Implementations

impl RbacEnforcer

pub fn new() -> Self

Creates an empty enforcer.

pub fn assign_role( &mut self, actor_id: ActorId, role: Role, tenant_id: TenantId, )

Assigns a role to an actor within a tenant.

pub fn grant_capability( &mut self, actor_id: ActorId, capability: Capability, tenant_id: TenantId, )

Grants a capability to an actor within a tenant.

pub fn revoke_capability( &mut self, actor_id: ActorId, capability: &Capability, tenant_id: TenantId, )

Revokes a capability from an actor within a tenant.

pub fn has_capability( &self, actor_id: ActorId, capability: &Capability, tenant_id: TenantId, ) -> bool

Returns true if the actor has the given capability in the tenant.

pub fn role_of(&self, actor_id: ActorId, tenant_id: TenantId) -> Option<&Role>

Returns the role assigned to an actor in a tenant, if any.

pub fn check_permission( &self, actor_id: ActorId, capability: &Capability, tenant_id: TenantId, ) -> Result<(), RbacError>

Returns Ok(()) if the actor has the capability, Err(RbacError) otherwise.

Trait Implementations

impl Default for RbacEnforcer

fn default() -> RbacEnforcer

Returns the “default value” for a type.