Module abac 

Attribute-based access control (ABAC) — the family’s shared authorization engine.

Implements the policy model fixed by agents/share/authorization-attributes.md (§2–§5): a decision is a pure evaluation of an ordered rule list over the subject attributes carried in the verified Claims::attrs map, the derived action (Action), the coarse resource (the entity name), and — for services that load the target record or supply request context — optional record-level resource attributes (resource.*) and environment attributes (env.*) matched by prefixed when keys (§9–§10; see Policy::evaluate_with_context). A when value of $sub / $email is a template resolving to the caller’s identity, so a rule can express ownership. First match wins; when no rule matches, the default decision is allow read, deny everything else. An allow rule may attach obligations (e.g. "mask", "audit") that the Decision carries for the enforcement point to honour — the engine does not interpret them.

The engine is pure data + pure evaluation: no I/O, no clock, no panics on any input. Nine entity services embed it inside their blanket /api/* guards so the family shares one tested implementation instead of nine copies.

Example

use authentication_verifier::{Action, Claims, Policy};
use std::collections::BTreeMap;

// Subject attributes as minted by the auth-service into the token.
let mut attrs = BTreeMap::new();
attrs.insert("access".to_string(), vec!["write".to_string()]);
let claims = Claims {
    sub: "11111111-1111-1111-1111-111111111111".to_string(),
    email: "alice@example.com".to_string(),
    name: "Alice".to_string(),
    iss: "authentication-service".to_string(),
    aud: "main-x-service".to_string(),
    exp: 2_000_000_000,
    iat: 1_900_000_000,
    nbf: None,
    sid: "22222222-2222-2222-2222-222222222222".to_string(),
    scope: vec![],
    roles: vec![],
    attrs,
};

let policy = Policy::default_policy();
assert!(policy.evaluate(&claims, Action::Read, "place").allowed);
assert!(policy.evaluate(&claims, Action::Write, "place").allowed);
assert!(!policy.evaluate(&claims, Action::Delete, "place").allowed);

Structs

Decision

The outcome of one Policy::evaluate call.

Policy

An ordered list of Rules, evaluated top-down with first match wins; when nothing matches, the default decision is allow-read / deny-everything-else (authorization-attributes.md §5).

ReloadablePolicy

A hot-reloadable Policy holder for the enforcement point: the active policy can be swapped at runtime (e.g. when the policy file changes) without a restart, while readers keep the coarse evaluate path lock-light.

Rule

One ordered policy rule: an Effect, the actions it covers, and a conjunction of subject-attribute conditions.

Enums

Action

The derived action attribute of a request, fixed family-wide.

ActionPattern

One entry of a rule’s actions list: a concrete Action name or the "*" wildcard covering every action.

Effect

A rule’s effect: grant or refuse the covered actions.