laye 0.1.0

A framework-agnostic role and permission based access control library
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101

use laye::principal::Principal;
use laye::{AccessPolicy, AccessRule, LayeCheckResult};

#[derive(Clone)]
struct MyUser {
    roles: Vec<String>,
    permissions: Vec<String>,
    authenticated: bool,
}

impl Principal for MyUser {
    fn roles(&self) -> &[String] {
        &self.roles
    }
    fn permissions(&self) -> &[String] {
        &self.permissions
    }
    fn is_authenticated(&self) -> bool {
        self.authenticated
    }
}

fn main() {
    let editor = MyUser {
        roles: vec!["editor".to_string()],
        permissions: vec!["posts:write".to_string()],
        authenticated: true,
    };

    let viewer = MyUser {
        roles: vec!["viewer".to_string()],
        permissions: vec![],
        authenticated: true,
    };

    // AND policy: authenticated AND (admin OR editor)
    let policy = AccessPolicy::require_all()
        .add_rule(AccessRule::Authenticated)
        .add_policy(
            AccessPolicy::require_any()
                .add_rule(AccessRule::Role("admin".to_string()))
                .add_rule(AccessRule::Role("editor".to_string())),
        );

    assert_eq!(
        policy.check(Some(&editor)),
        LayeCheckResult::Authorized,
        "editor should be authorized"
    );

    assert_eq!(
        policy.check(Some(&viewer)),
        LayeCheckResult::Forbidden,
        "viewer should be forbidden"
    );

    assert_eq!(
        policy.check(None),
        LayeCheckResult::Unauthorized,
        "anonymous should be unauthorized"
    );

    // Permission-based rule
    let write_policy =
        AccessPolicy::require_all().add_rule(AccessRule::Permission("posts:write".to_string()));

    assert_eq!(
        write_policy.check(Some(&editor)),
        LayeCheckResult::Authorized
    );
    assert_eq!(
        write_policy.check(Some(&viewer)),
        LayeCheckResult::Forbidden
    );

    // Guest-only route
    let guest_policy = AccessPolicy::require_all().add_rule(AccessRule::Guest);

    assert_eq!(guest_policy.check(None), LayeCheckResult::Authorized);
    assert_eq!(
        guest_policy.check(Some(&editor)),
        LayeCheckResult::Forbidden
    );

    // Custom rule
    let custom_policy =
        AccessPolicy::require_all().add_rule(AccessRule::Custom(std::sync::Arc::new(|p| {
            p.is_some_and(|u| u.has_permission("posts:write"))
        })));

    assert_eq!(
        custom_policy.check(Some(&editor)),
        LayeCheckResult::Authorized
    );
    assert_eq!(
        custom_policy.check(Some(&viewer)),
        LayeCheckResult::Forbidden
    );

    println!("All policy checks passed.");
}