boundgraph_grant/
lib.rs

1//! The BoundGraph permission lattice.
2//!
3//! `boundgraph-core` owns the *shape* of a permission — [`GrantAtom`] and
4//! [`GrantSet`] are plain data there. This crate owns its *meaning*: what it
5//! means for one grant to permit less than another, how grants combine, and
6//! whether two of them can ever touch the same resource.
7//!
8//! That makes it the machinery behind Law I. The attenuation check that refuses
9//! a flow whose child widens its parent's authority is a call to [`set_leq`];
10//! the proof that two `par` branches cannot interfere is a call to the
11//! disjointness solver.
12//!
13//! # Conservative by default
14//!
15//! Every question here is answered with [`Tri`], not `bool`. Where the pattern
16//! language cannot decide an answer, the result is [`Tri::Unknown`], and the
17//! compiler treats that as a refusal. A build error is a cheap failure; a
18//! wrongly-granted permission is not.
19//!
20//! ```
21//! use boundgraph_core::GrantSet;
22//! use boundgraph_grant::{Tri, set_leq};
23//!
24//! let parent = GrantSet::parse(["fs:read:/src/**"])?;
25//! let child  = GrantSet::parse(["fs:read:/src/lib/a.rs"])?;
26//! let rogue  = GrantSet::parse(["fs:read:/etc/passwd"])?;
27//!
28//! assert_eq!(set_leq(&child, &parent), Tri::Yes);  // narrowing: allowed
29//! assert_eq!(set_leq(&rogue, &parent), Tri::No);   // widening: refused
30//! # Ok::<(), boundgraph_core::GrantAtomParseError>(())
31//! ```
32
33#![doc(html_root_url = "https://docs.rs/boundgraph-grant")]
34
35pub mod access;
36pub mod disjoint;
37pub mod lattice;
38pub mod normalize;
39pub mod order;
40pub mod pattern;
41pub mod require;
42pub(crate) mod trie;
43
44pub use access::{Access, classify, is_known_action};
45pub use disjoint::{Conflict, ConflictKind, Disjointness, all_disjoint, disjoint};
46pub use lattice::{clamp, join, join_all, meet, meet_all};
47pub use normalize::{is_normal, normalize};
48pub use order::{atom_eq, atom_leq, set_eq, set_leq, set_lt};
49pub use pattern::{Pattern, Tri, Undecidable, covers, intersect, overlaps};
50pub use require::{Refusal, require_attenuated, require_disjoint};
boundgraph_grant/lib.rs

boundgraph_grant/
lib.rs
