Crate allow_me

An authorization library with json-based policy definition.

Define your authorization rules in a simple Identity (I), Operation (O), Resource (R) model. Evaluate requests against your policy rules.

Supports the following customizations:

• variable rules and custom variables,
• custom resource matching,
• custom validation,
• default decision if no rules match.

Examples

use allow_me::{Decision, PolicyBuilder, Request};

let json = r#"{
    "statements": [
        {
            "effect": "allow",
            "identities": [
                "actor_a"
            ],
            "operations": [
                "write"
            ],
            "resources": [
                "resource_1"
            ]
        }
    ]
}"#;

// Construct the policy.
let policy = PolicyBuilder::from_json(json).build().unwrap();

// Prepare request (e.g. from user input).
let request = Request::new("actor_a", "write", "resource_1").unwrap();

// Evaluate the request.
match policy.evaluate(&request).unwrap() {
    Decision::Allowed => println!("Allowed"),
    Decision::Denied => {
        panic!("Denied!")
    }
};

See more in Examples folder.

Re-exports

• pub use crate::matcher::ResourceMatcher;

Modules

• matcher

Structs

• DefaultSubstituter
  Default implementation of Substituter. It supports several useful variables:
• DefaultValidator
  Provides basic validation that policy definition elements are not empty.
• Policy
  Policy engine. Represents a read-only set of rules and can evaluate Request based on those rules.
• PolicyBuilder
  A policy builder, responsible for parsing policy definition and constructing Policy struct.
• PolicyDefinition
  Represents a deserialized policy definition.
• Request
  Represents a request that needs to be evaluated by Policy engine.
• Statement
  Represents a statement in a policy definition.
• VariableIter
  A simple iterator that returns all occurrences of variable substrings like {{var_name}} in the provided string value. Can be used in your custom Substituter implementation.

Enums

• Decision
  Represents a decision on the Request to the Policy engine.
• Effect
  Represents an effect on a statement.
• Error

Traits

• PolicyValidator
  Trait to extend PolicyBuilder validation for policy definition.
• Substituter
  Trait to extend Policy variable rules resolution.

Type Aliases

• Result
  A specialized Result type for policy engine operations.