auth-policy 0.0.2

Rust crate for evaluating authorization decisions against declarative policies
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60

use crate::{
    decision::{Decision, Effect},
    error::Result,
    policy::Policy,
    request::Request,
};

#[derive(Debug)]
pub struct PolicyEngine {
    policies: Vec<Policy>,
    default_effect: Effect,
}

impl PolicyEngine {
    /// Create an empty engine that defaults to denying requests when no policy applies.
    pub fn new() -> Self {
        Self {
            policies: Vec::new(),
            default_effect: Effect::Deny,
        }
    }

    /// Build an engine from an iterator of policies.
    pub fn from_policies<I>(policies: I) -> Self
    where
        I: IntoIterator<Item = Policy>,
    {
        let mut engine = Self::new();
        engine.policies.extend(policies);
        engine
    }

    /// Set the default effect returned when no policy matches.
    pub fn with_default_effect(mut self, effect: Effect) -> Self {
        self.default_effect = effect;
        self
    }

    /// Add a policy to the engine.
    pub fn add_policy(&mut self, policy: Policy) {
        self.policies.push(policy);
    }

    /// Evaluate the request against the configured policies.
    pub fn evaluate(&self, request: &Request) -> Result<Decision> {
        for policy in &self.policies {
            if let Some(effect) = policy.evaluate(request)? {
                return Ok(Decision::from_effect(effect));
            }
        }

        Ok(Decision::from_effect(self.default_effect))
    }
}

impl Default for PolicyEngine {
    fn default() -> Self {
        Self::new()
    }
}