Struct aliri_oauth2::ScopePolicy

pub struct ScopePolicy { /* fields omitted */ }

An access policy based on OAuth2 scopes

This access policy takes the form of alternatives around required scopes. This policy will allow access if any of the alternatives would allow access. If the policy contains no alternatives, the default effect is to deny access.

Examples

Deny all requests

use aliri_traits::Policy;
use aliri_oauth2::{Scope, ScopePolicy};

let policy = ScopePolicy::deny_all();

let request = Scope::single("admin".parse()?);
assert!(policy.evaluate(&request).is_err());

Allow all requests

use aliri_traits::Policy;
use aliri_oauth2::{Scope, ScopePolicy};

let policy = ScopePolicy::allow_all();

let request = Scope::empty();
assert!(policy.evaluate(&request).is_ok());

Allow requests with a single scope

use aliri_traits::Policy;
use aliri_oauth2::{Scope, ScopePolicy};

let policy = ScopePolicy::allow_one(
    Scope::single("admin".parse()?)
);

let request = Scope::from_scope_tokens(vec![
    "admin".parse()?,
    "user".parse()?,
]);
assert!(policy.evaluate(&request).is_ok());

let user_request = Scope::from_scope_tokens(vec![
    "user".parse()?,
]);
assert!(policy.evaluate(&user_request).is_err());

Allow requests with multiple potential sets of scopes

use aliri_traits::Policy;
use aliri_oauth2::{Scope, ScopePolicy};

let mut policy = ScopePolicy::deny_all();
policy.allow(Scope::single("admin".parse()?));
policy.allow(Scope::from_scope_tokens(vec![
    "special".parse()?,
    "user".parse()?,
]));

let admin_request = Scope::from_scope_tokens(vec![
    "admin".parse()?,
]);
assert!(policy.evaluate(&admin_request).is_ok());

let user_request = Scope::from_scope_tokens(vec![
    "user".parse()?,
]);
assert!(policy.evaluate(&user_request).is_err());

let special_user_request = Scope::from_scope_tokens(vec![
    "special".parse()?,
    "user".parse()?,
]);
assert!(policy.evaluate(&special_user_request).is_ok());

Implementations

impl ScopePolicy

pub fn deny_all() -> Self

Constructs a policy that has no permissible alternatives

By default, this policy will deny all requests

pub fn allow_all() -> Self

Constructs a policy that does not require any scopes (allow)

pub fn allow_one(scopes: Scope) -> Self

Constructs a policy that requires this set of scopes

pub fn or_allow(self, scopes: Scope) -> Self

Add an alternate set of required scopes

pub fn allow(&mut self, scopes: Scope)

Add an alternative set of required scopes

Trait Implementations

impl Clone for ScopePolicy

fn clone(&self) -> ScopePolicy

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ScopePolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ScopePolicy

fn default() -> ScopePolicy

Returns the “default value” for a type.

impl Extend<Scope> for ScopePolicy

fn extend<I>(&mut self, iter: I) where
    I: IntoIterator<Item = Scope>, 

Extends a collection with the contents of an iterator.

fn extend_one(&mut self, item: A)

🔬 This is a nightly-only experimental API. (extend_one)

Extends a collection with exactly one element.

fn extend_reserve(&mut self, additional: usize)

🔬 This is a nightly-only experimental API. (extend_one)

Reserves capacity in a collection for the given number of additional elements.

impl FromIterator<Scope> for ScopePolicy

fn from_iter<I>(iter: I) -> Self where
    I: IntoIterator<Item = Scope>, 

Creates a value from an iterator.

impl IntoIterator for ScopePolicy

type Item = Scope

The type of the elements being iterated over.

type IntoIter = <Vec<Scope> as IntoIterator>::IntoIter

Which kind of iterator are we turning this into?

fn into_iter(self) -> Self::IntoIter

Creates an iterator from a value.

impl<'a> IntoIterator for &'a ScopePolicy

type Item = &'a Scope

The type of the elements being iterated over.

type IntoIter = Iter<'a>

Which kind of iterator are we turning this into?

fn into_iter(self) -> Self::IntoIter

Creates an iterator from a value.

impl PartialEq<ScopePolicy> for ScopePolicy

fn eq(&self, other: &ScopePolicy) -> bool

This method tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &ScopePolicy) -> bool

This method tests for !=.

impl Policy for ScopePolicy

type Request = Scope

The request type evaluated by this policy

type Denial = InsufficientScope

The error returned when this policy denies a request

fn evaluate(&self, held: &Self::Request) -> Result<(), Self::Denial>

Evaluates the request, producing an effect

impl Eq for ScopePolicy

impl StructuralEq for ScopePolicy

impl StructuralPartialEq for ScopePolicy