authz_resolver_sdk/
lib.rs

1//! `AuthZ` Resolver SDK
2//!
3//! This crate provides the public API for the `authz_resolver` module:
4//!
5//! - [`AuthZResolverClient`] - Public API trait for consumers
6//! - [`AuthZResolverPluginClient`] - Plugin API trait for implementations
7//! - [`EvaluationRequest`], [`EvaluationResponse`] - Evaluation models
8//! - [`Constraint`], [`Predicate`] - Constraint types
9//! - [`AuthZResolverError`] - Error types
10//! - [`AuthZResolverPluginSpecV1`] - GTS schema for plugin discovery
11//! - [`pep`] - PEP helpers ([`PolicyEnforcer`], [`ResourceType`], compiler)
12//!
13//! ## Usage
14//!
15//! ```ignore
16//! use authz_resolver_sdk::{
17//!     AuthZResolverClient,
18//!     pep::{AccessRequest, PolicyEnforcer, ResourceType},
19//! };
20//!
21//! const USER: ResourceType = ResourceType {
22//!     name: "gts.x.core.users.user.v1~",
23//!     supported_properties: &["owner_tenant_id", "id"],
24//! };
25//!
26//! // Get the client from ClientHub
27//! let authz = hub.get::<dyn AuthZResolverClient>()?;
28//!
29//! // Create an enforcer (once, during init — serves all resource types)
30//! let enforcer = PolicyEnforcer::new(authz);
31//!
32//! // All CRUD operations return AccessScope (PDP always returns constraints)
33//! let scope = enforcer.access_scope(&ctx, &USER, "get", Some(id)).await?;
34//!
35//! // CREATE — also returns AccessScope with constraints from PDP
36//! let scope = enforcer.access_scope_with(
37//!     &ctx, &USER, "create", None,
38//!     &AccessRequest::new()
39//!         .context_tenant_id(target_tenant_id)
40//!         .resource_property("owner_tenant_id", target_tenant_id),
41//! ).await?;
42//! ```
43#![cfg_attr(coverage_nightly, feature(coverage_attribute))]
44
45pub mod api;
46pub mod constraints;
47pub mod error;
48pub mod gts;
49pub mod models;
50pub mod pep;
51pub mod plugin_api;
52
53// Re-export main types at crate root
54pub use api::AuthZResolverClient;
55pub use constraints::{Constraint, EqPredicate, InPredicate, Predicate};
56pub use error::AuthZResolverError;
57pub use gts::AuthZResolverPluginSpecV1;
58pub use models::{
59    Action, BarrierMode, Capability, DenyReason, EvaluationRequest, EvaluationRequestContext,
60    EvaluationResponse, EvaluationResponseContext, Resource, Subject, TenantContext, TenantMode,
61};
62pub use pep::{AccessRequest, EnforcerError, IntoPropertyValue, PolicyEnforcer, ResourceType};
63pub use plugin_api::AuthZResolverPluginClient;
authz_resolver_sdk/lib.rs

authz_resolver_sdk/
lib.rs
