adk_auth/lib.rs
1//! # adk-auth
2//!
3//! Access control and authentication for ADK-Rust.
4//!
5//! ## Overview
6//!
7//! This crate provides enterprise-grade access control:
8//!
9//! - [`Permission`] - Tool and agent permissions
10//! - [`Role`] - Role with allow/deny rules
11//! - [`AccessControl`] - Permission checking
12//! - [`ScopeGuard`] - Declarative scope-based tool authorization
13//! - [`AuditSink`] - Audit logging trait
14//!
15//! ## Features
16//!
17//! - `sso` - Enable SSO/OAuth/OIDC support
18//! - `auth-bridge` - Enable JWT request context extraction for `adk-server`
19//!
20//! ## Quick Start
21//!
22//! ```rust,ignore
23//! use adk_auth::{Permission, Role, AccessControl};
24//!
25//! let admin = Role::new("admin")
26//! .allow(Permission::AllTools)
27//! .allow(Permission::AllAgents);
28//!
29//! let user = Role::new("user")
30//! .allow(Permission::Tool("search".into()))
31//! .deny(Permission::Tool("code_exec".into()));
32//!
33//! let ac = AccessControl::builder()
34//! .role(admin)
35//! .role(user)
36//! .assign("alice@example.com", "admin")
37//! .build()?;
38//!
39//! ac.check("alice@example.com", &Permission::AllTools)?;
40//! ```
41
42mod access_control;
43mod audit;
44mod error;
45mod middleware;
46mod permission;
47mod role;
48pub mod scope;
49
50#[cfg(feature = "auth-bridge")]
51pub mod auth_bridge;
52
53// SSO module (feature-gated)
54#[cfg(feature = "sso")]
55pub mod sso;
56
57pub use access_control::{AccessControl, AccessControlBuilder};
58pub use audit::{AuditEvent, AuditEventType, AuditOutcome, AuditSink, FileAuditSink};
59pub use error::{AccessDenied, AuthError};
60pub use middleware::{AuthMiddleware, ProtectedTool, ProtectedToolDyn, ToolExt};
61pub use permission::Permission;
62pub use role::Role;
63pub use scope::{
64 ContextScopeResolver, ScopeDenied, ScopeGuard, ScopeResolver, ScopeToolExt, ScopedTool,
65 ScopedToolDyn, StaticScopeResolver, check_scopes,
66};
67
68#[cfg(feature = "auth-bridge")]
69pub use auth_bridge::{JwtRequestContextExtractor, JwtRequestContextExtractorBuilder};