coil-auth 0.1.0

Authorisation models and auth package support for the Coil framework.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153

use super::*;

pub const DEFAULT_EXPLAIN_MAX_DEPTH: usize = 100;

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub struct ExplainOptions {
    pub max_depth: usize,
    pub cycle_protection: bool,
}

impl ExplainOptions {
    pub const fn new(max_depth: usize) -> Self {
        Self {
            max_depth,
            cycle_protection: true,
        }
    }

    pub const fn with_cycle_protection(mut self, cycle_protection: bool) -> Self {
        self.cycle_protection = cycle_protection;
        self
    }

    pub const fn normalized(self) -> Self {
        let max_depth = if self.max_depth == 0 {
            1
        } else {
            self.max_depth
        };

        Self {
            max_depth,
            cycle_protection: self.cycle_protection,
        }
    }
}

impl Default for ExplainOptions {
    fn default() -> Self {
        Self {
            max_depth: DEFAULT_EXPLAIN_MAX_DEPTH,
            cycle_protection: true,
        }
    }
}

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum ExplainDecision {
    Allow,
    Deny,
}

impl ExplainDecision {
    pub const fn is_allowed(self) -> bool {
        matches!(self, Self::Allow)
    }
}

#[derive(Debug, Clone, PartialEq, Eq, Hash)]
pub struct ExplainedNode {
    pub object: Entity,
    pub relation: Option<Relation>,
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub enum ExplainStep {
    Start {
        node: ExplainedNode,
    },
    DirectSubjectMatch {
        node: ExplainedNode,
    },
    TupleSubjectMatch {
        from: ExplainedNode,
        tuple: DefaultTuple,
    },
    Inherit {
        from: ExplainedNode,
        to: ExplainedNode,
    },
    TupleTraversal {
        from: ExplainedNode,
        tuple: DefaultTuple,
        to: ExplainedNode,
    },
    Computed {
        from: ExplainedNode,
        via_tuple: DefaultTuple,
        to: ExplainedNode,
    },
    TupleToUserset {
        from: ExplainedNode,
        via_tuple: DefaultTuple,
        to: ExplainedNode,
    },
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub enum DeniedReason {
    NoMatchingPath,
    RecursionLimitReached { max_depth: usize },
    CycleDetected,
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub enum DeniedAttempt {
    Inherit {
        step: ExplainStep,
        result: Box<DeniedExplanation>,
    },
    TupleTraversal {
        step: ExplainStep,
        result: Box<DeniedExplanation>,
    },
    Computed {
        step: ExplainStep,
        result: Box<DeniedExplanation>,
    },
    TupleToUserset {
        step: ExplainStep,
        result: Box<DeniedExplanation>,
    },
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub struct DeniedExplanation {
    pub node: ExplainedNode,
    pub reason: DeniedReason,
    pub attempts: Vec<DeniedAttempt>,
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub struct AllowedExplanation {
    pub steps: Vec<ExplainStep>,
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub enum ExplainTrace {
    Allowed(AllowedExplanation),
    Denied(DeniedExplanation),
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub struct CapabilityExplanation {
    pub manifest: AuthModelManifest,
    pub subject: DefaultSubject,
    pub capability: Capability,
    pub object: Entity,
    pub binding: CapabilityBinding,
    pub decision: ExplainDecision,
    pub options: ExplainOptions,
    pub trace: ExplainTrace,
}