gatekeep 4.0.0

Code-first authorization engine for Rust
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66

# gatekeep

> The soul selects her own society,
> Then shuts the door;
>
> — Emily Dickinson, "Exclusion" (1890)

`gatekeep` is a code-first authorization engine for Rust. Policies are ordinary
typed values, so the compiler and your tests can see the same rules that run in
production. Evaluation is deterministic, and every decision includes the facts
and policy clause that produced it.

It fits applications where Rust owns the authorization model. If policy needs
to live outside the codebase or cross service and language boundaries, use a
shared policy system instead.

## A policy

```rust
use gatekeep::{condition, evaluate, policy, Effect, Fact, GatekeepResult, KnownFacts, StaticFactId};

struct CaseOwner;

impl Fact for CaseOwner {
    const ID: StaticFactId = StaticFactId::new("case_owner");
}

fn main() -> GatekeepResult<()> {
    let may_read = policy::grant((), condition::has::<CaseOwner>())
        .try_reason("not_case_owner")?;

    let facts = KnownFacts::new().with_present::<CaseOwner>();
    let decision = evaluate(&may_read, &facts);
    assert_eq!(decision.effect, Effect::Permit(()));

    Ok(())
}
```

Your application authenticates the request and supplies the facts. Gatekeep
evaluates them. The same policy can authorize one request, become a SQL filter
through `gatekeep-sqlx`, and leave a decision trace for audit.

For durable audit, `gatekeep-sqlx` writes complete decision events through
[Dovecote](https://github.com/plethu/dovecote). The
[`gatekeep-keepsake`](https://docs.rs/gatekeep-keepsake) adapter reads relation
state from [Keepsake](https://github.com/plethu/keepsake).

## Install

```sh
cargo add gatekeep@4
```

Add only the adapters you need:
[`gatekeep-axum`](https://docs.rs/gatekeep-axum),
[`gatekeep-fluent`](https://docs.rs/gatekeep-fluent),
[`gatekeep-keepsake`](https://docs.rs/gatekeep-keepsake), and
[`gatekeep-sqlx`](https://docs.rs/gatekeep-sqlx).

Start with the [quickstart](docs/quickstart.md), read about
[graded outcomes](docs/concepts/lattice-outcomes.md), or browse the full
[documentation](docs/README.md). The core API is on
[docs.rs](https://docs.rs/gatekeep).

Licensed under `MIT OR Apache-2.0`.