authz-core 0.1.0

Zanzibar-style authorization engine — model parser, resolver, policy traits, and CEL condition evaluation
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63

//! Abstract Syntax Tree (AST) for the authorization model DSL.

#[derive(Debug, PartialEq, Clone, serde::Serialize)]
pub struct ModelFile {
    pub type_defs: Vec<TypeDef>,
    pub condition_defs: Vec<ConditionDef>,
}

#[derive(Debug, PartialEq, Clone, serde::Serialize)]
pub struct TypeDef {
    pub name: String,
    pub relations: Vec<RelationDef>,
    pub permissions: Vec<RelationDef>, // Use RelationDef for both relations and permissions
}

#[derive(Debug, PartialEq, Clone, serde::Serialize)]
pub struct RelationDef {
    pub name: String,
    pub expression: RelationExpr,
}

#[derive(Debug, PartialEq, Clone, serde::Serialize)]
pub enum RelationExpr {
    Union(Vec<RelationExpr>),
    Intersection(Vec<RelationExpr>),
    Exclusion {
        base: Box<RelationExpr>,
        subtract: Box<RelationExpr>,
    },
    ComputedUserset(String),
    TupleToUserset {
        computed_userset: String,
        tupleset: String,
    },
    DirectAssignment(Vec<AssignableTarget>),
}

#[derive(Debug, PartialEq, Clone, serde::Serialize)]
pub enum AssignableTarget {
    Type(String),
    Userset {
        type_name: String,
        relation: String,
    },
    Wildcard(String),
    Conditional {
        target: Box<AssignableTarget>,
        condition: String,
    },
}

#[derive(Debug, PartialEq, Clone, serde::Serialize)]
pub struct ConditionDef {
    pub name: String,
    pub params: Vec<ConditionParam>,
    pub expression: String,
}

#[derive(Debug, PartialEq, Clone, serde::Serialize)]
pub struct ConditionParam {
    pub name: String,
    pub param_type: String,
}