adk-auth 0.9.0

Access control and authentication for Rust Agent Development Kit (ADK-Rust)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89

//! # adk-auth
//!
//! Access control and authentication for ADK-Rust.
//!
//! ## Overview
//!
//! This crate provides enterprise-grade access control:
//!
//! - [`Permission`] - Tool and agent permissions
//! - [`Role`] - Role with allow/deny rules
//! - [`AccessControl`] - Permission checking
//! - [`ScopeGuard`] - Declarative scope-based tool authorization
//! - [`AuditSink`] - Audit logging trait
//!
//! ## Features
//!
//! - `sso` - Enable SSO/OAuth/OIDC support
//! - `auth-bridge` - Enable JWT request context extraction for `adk-server`
//! - `aws-secrets` - Enable AWS Secrets Manager provider
//! - `azure-keyvault` - Enable Azure Key Vault provider
//! - `gcp-secrets` - Enable GCP Secret Manager provider
//!
//! ## Quick Start
//!
//! ```rust,ignore
//! use adk_auth::{Permission, Role, AccessControl};
//!
//! let admin = Role::new("admin")
//!     .allow(Permission::AllTools)
//!     .allow(Permission::AllAgents);
//!
//! let user = Role::new("user")
//!     .allow(Permission::Tool("search".into()))
//!     .deny(Permission::Tool("code_exec".into()));
//!
//! let ac = AccessControl::builder()
//!     .role(admin)
//!     .role(user)
//!     .assign("alice@example.com", "admin")
//!     .build()?;
//!
//! ac.check("alice@example.com", &Permission::AllTools)?;
//! ```

mod access_control;
mod audit;
mod error;
mod middleware;
mod permission;
mod role;
pub mod scope;

#[cfg(feature = "auth-bridge")]
pub mod auth_bridge;

// SSO module (feature-gated)
#[cfg(feature = "sso")]
pub mod sso;

// Cloud secret manager integration
pub mod secrets;

// Enterprise audit sinks (feature-gated)
#[cfg(feature = "otlp-audit")]
pub mod audit_otlp;
#[cfg(feature = "postgres-audit")]
pub mod audit_postgres;

pub use access_control::{AccessControl, AccessControlBuilder};
pub use audit::{
    AuditEvent, AuditEventType, AuditFilter, AuditOutcome, AuditSink, FileAuditSink,
    InMemoryAuditSink,
};
pub use error::{AccessDenied, AuthError};
pub use middleware::{AuthMiddleware, ProtectedTool, ProtectedToolDyn, ToolExt};
pub use permission::Permission;
pub use role::Role;
pub use scope::{
    ContextScopeResolver, ScopeDenied, ScopeGuard, ScopeResolver, ScopeToolExt, ScopedTool,
    ScopedToolDyn, StaticScopeResolver, check_scopes,
};

#[cfg(feature = "auth-bridge")]
pub use auth_bridge::{JwtRequestContextExtractor, JwtRequestContextExtractorBuilder};

#[cfg(feature = "otlp-audit")]
pub use audit_otlp::OtlpAuditSink;
#[cfg(feature = "postgres-audit")]
pub use audit_postgres::PostgresAuditSink;