khive_gate/
gate.rs

1use std::sync::Arc;
2
3use crate::{GateDecision, GateError, GateRequest};
4
5// ---------- Trait ----------
6
7/// Authorization gate consulted before each verb dispatch.
8///
9/// Implementations live downstream:
10/// - `AllowAllGate` (this crate) — permissive default
11/// - `RegoGate` (Apache-2.0 sibling crate `khive-gate-rego`) — regorus-backed Rego eval
12///
13/// Downstream crates may provide additional implementations, including wrappers
14/// that compose another `Gate` to add stronger enforcement guarantees.
15pub trait Gate: Send + Sync + std::fmt::Debug {
16    /// Evaluates the authorization policy for `req` and returns a decision.
17    fn check(&self, req: &GateRequest) -> Result<GateDecision, GateError>;
18
19    /// Short name of this backend — surfaced in audit events so downstream
20    /// tooling can tell results from different gate implementations apart
21    /// (including a wrapper from the gate it wraps) without parsing the type.
22    ///
23    /// Defaults to `std::any::type_name::<Self>()`.
24    fn impl_name(&self) -> &'static str {
25        std::any::type_name::<Self>()
26    }
27}
28
29/// Shareable handle to a `Gate` impl.
30pub type GateRef = Arc<dyn Gate>;
31
32// ---------- Default impl ----------
33
34/// Permissive gate — every request is allowed with no obligations.
35///
36/// This is the runtime default. Replace it in `RuntimeConfig.gate` for any
37/// deployment that needs real authorization.
38#[derive(Clone, Debug, Default)]
39pub struct AllowAllGate;
40
41impl Gate for AllowAllGate {
42    fn check(&self, _req: &GateRequest) -> Result<GateDecision, GateError> {
43        Ok(GateDecision::allow())
44    }
45
46    fn impl_name(&self) -> &'static str {
47        "AllowAllGate"
48    }
49}
khive_gate/gate.rs

khive_gate/
gate.rs
