gatekeep 5.0.0

Code-first authorization engine for Rust
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70

//! Small reproducible timings; no database, runtime or compiler time is included.
use gatekeep::{
    Fact, KnownFacts, Lattice, PolicyId, PreparedPolicy, StaticFactId, condition, evaluate, policy,
};
use serde::Serialize;
use std::{error::Error, hint::black_box, time::Instant};

struct Owner;
impl Fact for Owner {
    const ID: StaticFactId = StaticFactId::new("owner");
}

#[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord, Serialize)]
enum Tier {
    Shared,
    Full,
}
impl Lattice for Tier {
    fn meet(&self, other: &Self) -> Self {
        self.min(other).clone()
    }
    fn join(&self, other: &Self) -> Self {
        self.max(other).clone()
    }
    fn top() -> Self {
        Self::Full
    }
    fn bottom() -> Self {
        Self::Shared
    }
}

fn measure(label: &str, mut operation: impl FnMut()) {
    let started = Instant::now();
    for _ in 0..100_000 {
        operation();
    }
    println!("{label}: {:?} / 100000 iterations", started.elapsed());
}

fn main() -> Result<(), Box<dyn Error>> {
    let boolean = policy::grant_clause((), condition::has::<Owner>()).into_policy();
    let graded = policy::any([
        policy::permit(Tier::Shared),
        policy::grant_clause(Tier::Full, condition::has::<Owner>()).into_policy(),
    ]);
    let facts = KnownFacts::new().with_bool::<Owner>(true);
    let id = PolicyId::new("read")?;
    let prepared = PreparedPolicy::new(id.clone(), graded.clone())?;
    measure("boolean evaluation with trace", || {
        black_box(evaluate(black_box(&boolean), black_box(&facts)));
    });
    measure("graded evaluation with trace", || {
        black_box(evaluate(black_box(&graded), black_box(&facts)));
    });
    let decision = evaluate(&graded, &facts);
    measure("durable trace conversion", || {
        let _result = black_box(decision.to_trace());
    });
    measure("policy hash", || {
        let _result = black_box(graded.hash());
    });
    measure("policy preparation", || {
        let _result = black_box(PreparedPolicy::new(id.clone(), graded.clone()));
    });
    measure("prepared metadata borrow", || {
        black_box((prepared.anchor(), prepared.required_facts()));
    });
    Ok(())
}