pub struct Policy {
pub rules: Vec<Rule>,
}Expand description
An ordered list of Rules, evaluated top-down with
first match wins; when nothing matches, the default decision is
allow-read / deny-everything-else (authorization-attributes.md §5).
Pure data: load once at boot (from <ENTITY>_ABAC_POLICY /
<ENTITY>_ABAC_POLICY_FILE via Policy::from_json, falling back
to Policy::default_policy on parse failure), then call
Policy::evaluate per request. Unknown JSON fields are ignored
(see Rule).
Fields§
§rules: Vec<Rule>The ordered rules; index order is evaluation order.
Implementations§
Source§impl Policy
impl Policy
Sourcepub fn from_json(json: &str) -> Result<Self, Error>
pub fn from_json(json: &str) -> Result<Self, Error>
Parse a policy from its JSON document form
({ "rules": [ { "effect": ..., "actions": [...], "when": {...} }, ... ] }).
§Errors
Returns the underlying serde_json::Error when the document is
not valid JSON or does not fit the policy shape (unknown effect
/ action names, non-list when values, …). Callers fall back
to Policy::default_policy — a bad policy must never take a
service down at boot.
Sourcepub fn default_policy() -> Self
pub fn default_policy() -> Self
The built-in default policy (authorization-attributes.md §5),
used when no policy is configured:
svc=true⇒ allowwrite+destructive(machine peers may do everything;readis default-allowed anyway),access=admin⇒ allowdestructive(which coversdelete),access=writeoraccess=admin⇒ allowwrite.
Everything else falls through to the default decision: read allowed, mutation denied.
Sourcepub fn evaluate(
&self,
claims: &Claims,
action: Action,
entity: &str,
) -> Decision
pub fn evaluate( &self, claims: &Claims, action: Action, entity: &str, ) -> Decision
Evaluate the policy for one request: the verified subject
(Claims, whose attrs carry the subject
attributes), the derived Action, and the resource entity
(the crate’s entity type, e.g. "place"; reserved for resource
rules — a when key entity matches against it).
Considers no record-level resource attributes — every
resource.* when key resolves empty. This is the coarse,
no-record-load path the blanket guards use; a service that has
loaded the target record calls Policy::evaluate_with_resource
instead (handler-level record checks).
Rules are checked top-down; the first matching rule decides.
When no rule matches, the default decision applies: Action::Read
is allowed, every other action is denied.
Pure and total: no I/O, and no input — claims, attrs, policy, or entity — can make it panic.
Sourcepub fn evaluate_with_resource(
&self,
claims: &Claims,
action: Action,
entity: &str,
resource: &BTreeMap<String, Vec<String>>,
) -> Decision
pub fn evaluate_with_resource( &self, claims: &Claims, action: Action, entity: &str, resource: &BTreeMap<String, Vec<String>>, ) -> Decision
Evaluate the policy with record-level resource attributes —
a string→strings map describing the specific target record (e.g.
{"sensitivity": ["high"]}), matched by when keys prefixed
resource. (resource.sensitivity). Otherwise identical to
Policy::evaluate: same subject attributes, same action, same
entity, same first-match-wins ordering and default decision.
A service derives the resource attributes from the record it just
loaded (handler-level, after fetch) and passes them here, so a
deployment can express e.g. “deny write on a high-sensitivity
record unless access=admin” as ordered policy rules
(authorization-attributes.md §9). The resource. namespace is
disjoint from subject attributes, so a caller can never spoof a
resource attribute through its token. Considers no environment
attributes (every env.* key resolves empty) — call
Policy::evaluate_with_context to pass those too.
Pure and total: no I/O, no panics on any input.
Sourcepub fn evaluate_with_context(
&self,
claims: &Claims,
action: Action,
entity: &str,
resource: &BTreeMap<String, Vec<String>>,
env: &BTreeMap<String, Vec<String>>,
) -> Decision
pub fn evaluate_with_context( &self, claims: &Claims, action: Action, entity: &str, resource: &BTreeMap<String, Vec<String>>, env: &BTreeMap<String, Vec<String>>, ) -> Decision
Evaluate the policy with both record-level resource attributes
(matched by resource.* when keys) and environment
attributes (matched by env.* keys) — a string→strings map of
request-time / network context, e.g.
{"hour": ["22"], "network": ["office"]}. Otherwise identical to
Policy::evaluate.
A service derives the environment attributes per request (clock,
source IP, …) and passes them here so a deployment can express
e.g. “deny write outside working hours” or geofencing as ordered
policy rules (authorization-attributes.md §10). Like
resource.*, the env.* namespace is disjoint from subject
attributes, so a caller cannot spoof it through its token.
Pure and total: no I/O (the caller supplies the clock/network, keeping the engine deterministic), no panics on any input.