openidauthzen 0.1.0-alpha.1

OpenID AuthZEN Authorization API 1.0 — Policy Decision and Enforcement Points for Rust
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166

//! Search endpoints for discovering authorized subjects, resources, and
//! actions ([AuthZEN §8]).
//!
//! | Endpoint | Request | Response |
//! |----------|---------|----------|
//! | `POST /access/v1/search/subject` | [`SubjectSearchRequest`] | [`SubjectSearchResponse`] |
//! | `POST /access/v1/search/resource` | [`ResourceSearchRequest`] | [`ResourceSearchResponse`] |
//! | `POST /access/v1/search/action` | [`ActionSearchRequest`] | [`ActionSearchResponse`] |
//!
//! All search endpoints support pagination via [`Page`] (request) and
//! [`PageResponse`] (response).
//!
//! [AuthZEN §8]: https://openid.net/specs/authorization-api-1_0.html#section-8

use serde::{Deserialize, Serialize};

use crate::model::{Action, Context, Resource, Subject};

/// Pagination parameters for a search request ([AuthZEN §8]).
///
/// [AuthZEN §8]: https://openid.net/specs/authorization-api-1_0.html#section-8
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct Page {
    /// An opaque continuation token from a previous [`PageResponse`].
    #[serde(skip_serializing_if = "Option::is_none")]
    pub token: Option<String>,
    /// Maximum number of results to return.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub limit: Option<u32>,
    /// Additional pagination parameters.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub properties: Option<serde_json::Value>,
}

/// Pagination metadata in a search response ([AuthZEN §8]).
///
/// [AuthZEN §8]: https://openid.net/specs/authorization-api-1_0.html#section-8
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct PageResponse {
    /// Continuation token for fetching the next page. An empty string
    /// indicates no more results.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub next_token: Option<String>,
    /// Number of results in this page.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub count: Option<u32>,
    /// Total number of results across all pages, if known.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub total: Option<u32>,
    /// Additional pagination metadata.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub properties: Option<serde_json::Value>,
}

/// Find subjects authorized to perform an action on a resource
/// (`POST /access/v1/search/subject`, [AuthZEN §8.4]).
///
/// The `subject` field should include `type` but omit `id`, since
/// the search is discovering which subjects are authorized.
///
/// [AuthZEN §8.4]: https://openid.net/specs/authorization-api-1_0.html#section-8.4
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct SubjectSearchRequest {
    /// Subject filter — set `type` to constrain results; omit `id`.
    pub subject: Subject,
    /// The action to evaluate against. Required.
    pub action: Action,
    /// The resource to evaluate against. Required.
    pub resource: Resource,
    /// Environmental context for the evaluation.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub context: Option<Context>,
    /// Pagination parameters.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub page: Option<Page>,
}

/// Response to a subject search request ([AuthZEN §8.4]).
///
/// [AuthZEN §8.4]: https://openid.net/specs/authorization-api-1_0.html#section-8.4
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct SubjectSearchResponse {
    /// Authorized subjects matching the search criteria.
    pub results: Vec<Subject>,
    /// Pagination metadata.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub page: Option<PageResponse>,
    /// Additional response context.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub context: Option<serde_json::Value>,
}

/// Find resources a subject is authorized to access
/// (`POST /access/v1/search/resource`, [AuthZEN §8.5]).
///
/// The `resource` field should include `type` but omit `id`, since
/// the search is discovering which resources are accessible.
///
/// [AuthZEN §8.5]: https://openid.net/specs/authorization-api-1_0.html#section-8.5
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct ResourceSearchRequest {
    /// The subject performing the action. Required.
    pub subject: Subject,
    /// The action to evaluate against. Required.
    pub action: Action,
    /// Resource filter — set `type` to constrain results; omit `id`.
    pub resource: Resource,
    /// Environmental context for the evaluation.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub context: Option<Context>,
    /// Pagination parameters.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub page: Option<Page>,
}

/// Response to a resource search request ([AuthZEN §8.5]).
///
/// [AuthZEN §8.5]: https://openid.net/specs/authorization-api-1_0.html#section-8.5
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct ResourceSearchResponse {
    /// Accessible resources matching the search criteria.
    pub results: Vec<Resource>,
    /// Pagination metadata.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub page: Option<PageResponse>,
    /// Additional response context.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub context: Option<serde_json::Value>,
}

/// Find actions a subject is permitted to perform on a resource
/// (`POST /access/v1/search/action`, [AuthZEN §8.6]).
///
/// Note: unlike other search requests, this one does not include
/// an `action` field — the purpose is to discover which actions
/// are permitted.
///
/// [AuthZEN §8.6]: https://openid.net/specs/authorization-api-1_0.html#section-8.6
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct ActionSearchRequest {
    /// The subject performing the action. Required.
    pub subject: Subject,
    /// The resource to evaluate against. Required.
    pub resource: Resource,
    /// Environmental context for the evaluation.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub context: Option<Context>,
    /// Pagination parameters.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub page: Option<Page>,
}

/// Response to an action search request ([AuthZEN §8.6]).
///
/// [AuthZEN §8.6]: https://openid.net/specs/authorization-api-1_0.html#section-8.6
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct ActionSearchResponse {
    /// Permitted actions matching the search criteria.
    pub results: Vec<Action>,
    /// Pagination metadata.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub page: Option<PageResponse>,
    /// Additional response context.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub context: Option<serde_json::Value>,
}