lilo-im-core 0.1.1

Identity Matters core: Authorizer trait, Principal types, peer credential extraction (Helioy v1 IAM)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64

use async_trait::async_trait;
use chrono::{DateTime, Utc};
use serde::{Deserialize, Serialize};
use uuid::Uuid;

use crate::error::AuditError;
use crate::types::{Action, Principal, ResourceSpec};

#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
#[serde(tag = "kind", rename_all = "snake_case")]
pub enum AuditDecision {
    Allow,
    Deny { reason: String },
    Error { message: String },
}

#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct AuditRow {
    pub id: Uuid,
    pub timestamp: DateTime<Utc>,
    pub principal: Principal,
    pub action: Action,
    pub resource: ResourceSpec,
    pub decision: AuditDecision,
    pub session_ref: Option<Uuid>,
    pub notes: Option<String>,
    pub policy_id: Option<String>,
    pub evaluation_trace: Option<String>,
    pub denial_reason: Option<String>,
}

impl AuditRow {
    #[must_use]
    pub fn new(
        principal: Principal,
        action: Action,
        resource: ResourceSpec,
        decision: AuditDecision,
    ) -> Self {
        let denial_reason = match &decision {
            AuditDecision::Deny { reason } => Some(reason.clone()),
            _ => None,
        };

        Self {
            id: Uuid::now_v7(),
            timestamp: Utc::now(),
            principal,
            action,
            session_ref: resource.session_id,
            resource,
            decision,
            notes: None,
            policy_id: None,
            evaluation_trace: None,
            denial_reason,
        }
    }
}

#[async_trait]
pub trait AuditSink: Send + Sync {
    async fn record(&self, row: AuditRow) -> Result<(), AuditError>;
}