Module abac 

Attribute-Based Access Control (ABAC) system for Cloudillo

Implements classic ABAC with 4-object model:

• Subject: Authenticated user (AuthCtx)
• Action: Operation being performed (string like “file:read”)
• Object: Resource being accessed (implements AttrSet trait)
• Environment: Context (time, etc.)

Structs

CollectionPolicy

Collection-level policy configuration

Condition

Policy rule condition

Environment

Environment attributes (environmental context)

PermissionChecker

Main permission checker

Policy

ABAC Policy (collection of rules)

PolicyRule

Policy rule

ProfilePolicy

Profile-level policy configuration (TOP + BOTTOM)

Enums

Effect

Operator

SubjectAccessLevel

Subject’s access level to a resource based on their relationship with the owner

VisibilityLevel

Visibility levels for resources (files, actions, profile fields)

Traits

AttrSet

Attribute set trait - all objects implement this

Functions

can_view_item

Check if subject can view an item based on visibility and relationship