Module resource_policy 

Resource-level permission guards — bind auth context to entity-level access control.

ResourcePolicy<E> is the auth-layer counterpart to DomainPolicy<E> in backbone-core. Where DomainPolicy enforces business invariants (is the entity in a valid state for this operation?), ResourcePolicy enforces identity-based rules (does this caller have permission to touch this record?).

Typical wiring

HTTP handler
  → AuthMiddleware extracts AuthContext
  → PermissionGuard<E>::check(action, entity, auth_ctx)
      → ResourcePolicy<E>::can(action, entity, auth_ctx)  ← module implements this
  → If Err → 403 Forbidden
  → Else   → service.execute()

Example

pub struct OrderResourcePolicy;

#[async_trait]
impl ResourcePolicy<Order> for OrderResourcePolicy {
    async fn can(&self, action: ResourceAction, entity: &Order, ctx: &AuthContext) -> bool {
        match action {
            ResourceAction::Read => ctx.user_id == entity.customer_id || ctx.has_role("admin"),
            ResourceAction::Update | ResourceAction::Delete => ctx.user_id == entity.customer_id,
            _ => ctx.has_role("admin"),
        }
    }
}

Structs

AccessDenied

Returned when a PermissionGuard denies an operation.

DenyAllResourcePolicy

Denies every action for every caller. Use for deprecated or not-yet-exposed resources.

PermissionGuard

Wraps a ResourcePolicy<E> and enforces it, returning typed errors.

PermitAllResourcePolicy

Permits every action for every caller. Use as the generated default — replace in custom decorators.

RoleRequiredPolicy

Requires the caller to have one of the listed roles to perform any action.

ServicePermissionGuard

Generic permission guard that wraps both a service and an auth context provider.

Enums

ResourceAction

Standard CRUD operations that a resource policy can gate.

Traits

AuthContextProvider

Extracts or provides the current caller’s AuthContext.

ResourcePolicy

Determines whether the caller described by auth_ctx may perform action on entity.