acls-rs

Access control primitives for Rust — permission sets, role-based access control (RBAC), and temporal permissions with time-based validity windows.

What it does

• Permission sets with union, intersection, and difference — composition order does not affect the result
• Grant/deny pairs — explicit denials compose correctly with grants
• RBAC — role hierarchies with inheritance and cycle detection
• Temporal permissions — validity windows that expire automatically
• Subjects — represent users or entities with group memberships
• PermissionMapping — configurable bitmask-to-permission translation for bridging domain-specific access control models
• Optional serde support (enable the serde feature)

Quick start

use acls_rs::prelude::*;

// Define permissions with namespace:action pairs
let viewer_perms = PermissionSet::from([
    AtomicPermission::new("file", "read"),
]);
let editor_perms = PermissionSet::from([
    AtomicPermission::new("file", "read"),
    AtomicPermission::new("file", "write"),
]);

// Build roles with grant/denial pairs
let mut rbac = RbacPolicy::new();
rbac.add_role(Role::new("viewer", GrantDenialPair::new(
    viewer_perms, PermissionSet::new(),
)));
rbac.add_role(Role::new("editor", GrantDenialPair::new(
    editor_perms, PermissionSet::new(),
)).with_parent("viewer"));

// Resolve effective permissions
let roles = vec!["editor".to_string()];
let perms = rbac.resolve_permissions(&roles).unwrap();
let effective = perms.effective_permissions();
assert!(effective.contains(&AtomicPermission::new("file", "read")));
assert!(effective.contains(&AtomicPermission::new("file", "write")));

Documentation

Full API reference and design guide: https://akamu.dev/bac-rules/

License

Licensed under either of Apache License 2.0 or MIT license, at your option.