affine_core 0.0.5

AFFiNE primitive core.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100

use super::{AccessGrant, Deployment, Rights};

#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub enum QuotaSubject {
  Workspace,
  Owner,
}

#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub enum QuotaSubjectBasis {
  WorkspaceCommercialEntitlement,
  OwnerFallback,
}

#[derive(Clone, Debug, Eq, PartialEq)]
pub struct QuotaSubjectDecision {
  pub subject: QuotaSubject,
  pub grant: AccessGrant,
  pub basis: QuotaSubjectBasis,
}

pub fn resolve_quota_subject(workspace_grant: &AccessGrant, owner_grant: &AccessGrant) -> QuotaSubjectDecision {
  if workspace_grant.rights.commercial {
    QuotaSubjectDecision {
      subject: QuotaSubject::Workspace,
      grant: workspace_grant.clone(),
      basis: QuotaSubjectBasis::WorkspaceCommercialEntitlement,
    }
  } else {
    QuotaSubjectDecision {
      subject: QuotaSubject::Owner,
      grant: owner_grant.clone(),
      basis: QuotaSubjectBasis::OwnerFallback,
    }
  }
}

#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub enum ByokExecution {
  Server,
  Local,
}

#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub struct ByokAccessContext {
  pub deployment: Deployment,
  pub execution: ByokExecution,
}

#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub enum ByokAccessBasis {
  SelfHosted,
  Workspace,
  Owner,
  Actor,
}

#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub struct ByokAccessDecision {
  pub allowed: bool,
  pub basis: Option<ByokAccessBasis>,
}

pub fn evaluate_byok_access(
  context: ByokAccessContext,
  workspace_rights: Option<Rights>,
  owner_rights: Option<Rights>,
  actor_rights: Option<Rights>,
) -> ByokAccessDecision {
  let basis = match context.deployment {
    Deployment::SelfHosted => {
      (workspace_rights.is_some() && owner_rights.is_some()).then_some(ByokAccessBasis::SelfHosted)
    }
    Deployment::Cloud => {
      let candidates = match context.execution {
        ByokExecution::Server => [
          (workspace_rights, ByokAccessBasis::Workspace),
          (owner_rights, ByokAccessBasis::Owner),
          (None, ByokAccessBasis::Actor),
        ],
        ByokExecution::Local => [
          (workspace_rights, ByokAccessBasis::Workspace),
          (actor_rights, ByokAccessBasis::Actor),
          (owner_rights, ByokAccessBasis::Owner),
        ],
      };
      candidates
        .into_iter()
        .find_map(|(rights, basis)| rights.is_some_and(|rights| rights.copilot_byok).then_some(basis))
    }
  };
  ByokAccessDecision {
    allowed: basis.is_some(),
    basis,
  }
}

#[cfg(test)]
#[path = "../tests/access_control/workspace_access/tests.rs"]
mod tests;