authz-core 0.1.0

Zanzibar-style authorization engine — model parser, resolver, policy traits, and CEL condition evaluation
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116

//! Core datastore traits — TupleReader, TupleWriter, PolicyReader, PolicyWriter.

use async_trait::async_trait;

use crate::error::AuthzError;

/// A relationship tuple: object#relation@subject (optionally with condition).
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct Tuple {
    pub object_type: String,
    pub object_id: String,
    pub relation: String,
    pub subject_type: String,
    pub subject_id: String,
    pub condition: Option<String>,
}

/// Filter for tuple queries. All fields are optional.
#[derive(Debug, Clone, Default)]
pub struct TupleFilter {
    pub object_type: Option<String>,
    pub object_id: Option<String>,
    pub relation: Option<String>,
    pub subject_type: Option<String>,
    pub subject_id: Option<String>,
}

/// Authorization policy (DSL definition).
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct AuthorizationPolicy {
    pub id: String,
    pub definition: String,
}

/// Pagination for list operations.
#[derive(Debug, Clone, Default)]
pub struct Pagination {
    pub page_size: usize,
    pub continuation_token: Option<String>,
}

/// Reads tuples from the datastore.
#[async_trait]
pub trait TupleReader: Send + Sync {
    async fn read_tuples(&self, filter: &TupleFilter) -> Result<Vec<Tuple>, AuthzError>;
    async fn read_user_tuple(
        &self,
        object_type: &str,
        object_id: &str,
        relation: &str,
        subject_type: &str,
        subject_id: &str,
    ) -> Result<Option<Tuple>, AuthzError>;
    async fn read_userset_tuples(
        &self,
        object_type: &str,
        object_id: &str,
        relation: &str,
    ) -> Result<Vec<Tuple>, AuthzError>;
    async fn read_starting_with_user(
        &self,
        subject_type: &str,
        subject_id: &str,
    ) -> Result<Vec<Tuple>, AuthzError>;

    /// Batch read: check if any of the given relations match for a user.
    /// Returns the first matching tuple, or None if no match found.
    async fn read_user_tuple_batch(
        &self,
        object_type: &str,
        object_id: &str,
        relations: &[String],
        subject_type: &str,
        subject_id: &str,
    ) -> Result<Option<Tuple>, AuthzError>;
}

/// Writes tuples to the datastore.
#[async_trait]
pub trait TupleWriter: Send + Sync {
    async fn write_tuples(&self, writes: &[Tuple], deletes: &[Tuple])
    -> Result<String, AuthzError>;
}

/// Reads authorization policies.
#[async_trait]
pub trait PolicyReader: Send + Sync {
    async fn read_authorization_policy(
        &self,
        id: &str,
    ) -> Result<Option<AuthorizationPolicy>, AuthzError>;
    async fn read_latest_authorization_policy(
        &self,
    ) -> Result<Option<AuthorizationPolicy>, AuthzError>;
    async fn list_authorization_policies(
        &self,
        pagination: &Pagination,
    ) -> Result<Vec<AuthorizationPolicy>, AuthzError>;
}

/// Writes authorization policies.
#[async_trait]
pub trait PolicyWriter: Send + Sync {
    async fn write_authorization_policy(
        &self,
        policy: &AuthorizationPolicy,
    ) -> Result<String, AuthzError>;
}

/// Reads revision information from the datastore.
#[async_trait]
pub trait RevisionReader: Send + Sync {
    /// Read the latest revision ID from the datastore.
    /// Returns "0" if no revisions exist yet (bootstrap case).
    async fn read_latest_revision(&self) -> Result<String, AuthzError>;
}