Struct Authorizer

pub struct Authorizer { /* private fields */ }

used to check authorization policies on a token

can be created from AuthorizerBuilder::build, AuthorizerBuilder::build_unauthenticated or Biscuit::authorizer

Implementations

impl Authorizer

pub fn from_snapshot(input: AuthorizerSnapshot) -> Result<Self, Token>

pub fn from_raw_snapshot(input: &[u8]) -> Result<Self, Token>

pub fn from_base64_snapshot(input: &str) -> Result<Self, Token>

pub fn snapshot(&self) -> Result<AuthorizerSnapshot, Format>

pub fn to_raw_snapshot(&self) -> Result<Vec<u8>, Format>

pub fn to_base64_snapshot(&self) -> Result<String, Format>

impl Authorizer

pub fn run(&mut self) -> Result<Duration, Token>

pub fn from(data: &[u8]) -> Result<Self, Token>

creates an Authorizer from a serialized crate::format::schema::AuthorizerPolicies

pub fn save(&self) -> Result<AuthorizerPolicies, Token>

serializes a authorizer’s content

you can use this to save a set of policies and load them quickly before verification. This will not store data obtained or generated from a token.

pub fn limits(&self) -> &AuthorizerLimits

Returns the runtime limits of the authorizer

Those limits cover all the executions under the authorize, query and query_all methods

pub fn external_funcs(&self) -> &HashMap<String, ExternFunc>

Returns the currently registered external functions

pub fn query<R: TryInto<Rule>, T: TryFrom<Fact, Error = E>, E: Into<Token>>( &mut self, rule: R, ) -> Result<Vec<T>, Token>

where Token: From<<R as TryInto<Rule>>::Error>,

run a query over the authorizer’s Datalog engine to gather data

let keypair = KeyPair::new();
let biscuit = Biscuit::builder()
    .fact("user(\"John Doe\", 42)")
    .expect("parse error")
    .build(&keypair)
    .unwrap();

let mut authorizer = biscuit.authorizer().unwrap();
let res: Vec<(String, i64)> = authorizer.query("data($name, $id) <- user($name, $id)").unwrap();

pub fn query_exactly_one<R: TryInto<Rule>, T: TryFrom<Fact, Error = E>, E: Into<Token>>( &mut self, rule: R, ) -> Result<T, Token>

where Token: From<<R as TryInto<Rule>>::Error>,

Run a query over the authorizer’s Datalog engine to gather data. If there is more than one result, this function will throw an error.

let keypair = KeyPair::new();
let builder = Biscuit::builder().fact("user(\"John Doe\", 42)").unwrap();

let biscuit = builder.build(&keypair).unwrap();

let mut authorizer = biscuit.authorizer().unwrap();
let res: (String, i64) = authorizer.query_exactly_one("data($name, $id) <- user($name, $id)").unwrap();
assert_eq!(res.0, "John Doe");
assert_eq!(res.1, 42);

pub fn query_with_limits<R: TryInto<Rule>, T: TryFrom<Fact, Error = E>, E: Into<Token>>( &mut self, rule: R, limits: AuthorizerLimits, ) -> Result<Vec<T>, Token>

where Token: From<<R as TryInto<Rule>>::Error>,

run a query over the authorizer’s Datalog engine to gather data

this only sees facts from the authorizer and the authority block

this method overrides the authorizer’s runtime limits, just for this calls

pub fn query_all<R: TryInto<Rule>, T: TryFrom<Fact, Error = E>, E: Into<Token>>( &mut self, rule: R, ) -> Result<Vec<T>, Token>

where Token: From<<R as TryInto<Rule>>::Error>,

run a query over the authorizer’s Datalog engine to gather data

this has access to the facts generated when evaluating all the blocks

let keypair = KeyPair::new();
let biscuit = Biscuit::builder()
    .fact("user(\"John Doe\", 42)")
    .expect("parse error")
    .build(&keypair)
    .unwrap();

let mut authorizer = biscuit.authorizer().unwrap();
let res: Vec<(String, i64)> = authorizer.query_all("data($name, $id) <- user($name, $id)").unwrap();

pub fn query_all_with_limits<R: TryInto<Rule>, T: TryFrom<Fact, Error = E>, E: Into<Token>>( &mut self, rule: R, limits: AuthorizerLimits, ) -> Result<Vec<T>, Token>

where Token: From<<R as TryInto<Rule>>::Error>,

run a query over the authorizer’s Datalog engine to gather data

this has access to the facts generated when evaluating all the blocks

this method overrides the authorizer’s runtime limits, just for this calls

pub fn execution_time(&self) -> Option<Duration>

returns the elapsed execution time

pub fn iterations(&self) -> u64

returns the number of fact generation iterations

pub fn fact_count(&self) -> usize

returns the number of facts

pub fn authorize(&mut self) -> Result<usize, Token>

verifies the checks and policies

on error, this can return a list of all the failed checks or deny policy on success, it returns the index of the policy that matched

pub fn authorize_with_limits( &mut self, limits: AuthorizerLimits, ) -> Result<usize, Token>

verifies the checks and policies

on error, this can return a list of all the failed checks or deny policy

this method overrides the authorizer’s runtime limits, just for this calls

pub fn print_world(&self) -> String

prints the content of the authorizer

pub fn dump(&self) -> (Vec<Fact>, Vec<Rule>, Vec<Check>, Vec<Policy>)

returns all of the data loaded in the authorizer

pub fn dump_code(&self) -> String

Trait Implementations

impl Clone for Authorizer

fn clone(&self) -> Authorizer

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Authorizer

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for Authorizer

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.