Struct AdminPermissionApi 

pub struct AdminPermissionApi<'a, S: AuthSchema> { /* private fields */ }

Permission checks bound to the configuration of the registered AdminPlugin.

Every check requires at least one resource and at least one action per resource. All requested actions must be granted by one of the evaluated roles.

Implementations

impl<'a, S: AuthSchema> AdminPermissionApi<'a, S>

pub fn from_context( context: &'a AuthContext<S>, ) -> Result<Self, AdminPermissionError>

Bind to the configuration that AdminPlugin published during initialization.

pub fn role_has_permission( &self, role: &str, permissions: &HashMap<String, Vec<String>>, ) -> Result<bool, AdminPermissionError>

Evaluate a role string without identifying a user.

This is not authentication. Use it only for a role that trusted server code already holds. Never pass a role that a client supplied. role may hold several roles separated by commas. Unknown roles grant nothing. admin_user_ids never applies because no user is identified.

pub async fn user_has_permission( &self, user_id: &str, permissions: &HashMap<String, Vec<String>>, ) -> Result<bool, AdminPermissionError>

Evaluate the current stored roles of a user from trusted server code.

This reads the user on each call and does not check any session. The caller must authenticate the operator separately. A user without a role uses the configured default role. A user listed in admin_user_ids passes every check.

A dynamic base URL needs a configured fallback for this requestless operation.

pub async fn authorize_request( &self, headers: &HashMap<String, String>, permissions: &HashMap<String, Vec<String>>, ) -> Result<AuthorizedSession, AdminPermissionError>

Authenticate the caller from request headers, then require the permissions.

The session and the user come from the framework session store on every call. Request bodies and client claims never select the user or the role. With a database or secondary storage, this read skips the cookie cache. A revoked session or a removed role therefore takes effect on the next call. The check does not return refreshed session cookies.