road-runner-common 0.12.1

Shared Rust utilities for exchange ecosystem backend services.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93

use road_runner_common::authz::model::{
    grant_matches, BindingEntry, CompiledBinding, CompiledSnapshot, GrantEntry, PermissionEntry,
    RoleEntry, SnapshotPayload,
};

fn payload() -> SnapshotPayload {
    SnapshotPayload {
        schema: "cex.authz.snapshot.v1".to_string(),
        policy_version: 7,
        issued_at: Some("2026-07-08T00:00:00Z".to_string()),
        permissions: vec![PermissionEntry {
            permission: "finance:write".to_string(),
            declaring_service: Some("finance".to_string()),
            min_acr: Some("aal2".to_string()),
            requires_quorum: true,
        }],
        roles: vec![RoleEntry {
            id: "r1".to_string(),
            name: "Risk".to_string(),
            description: Some("Risk admin".to_string()),
        }],
        grants: vec![
            GrantEntry {
                role_id: "r1".to_string(),
                permission: "finance:*".to_string(),
                effect: "ALLOW".to_string(),
            },
            GrantEntry {
                role_id: "r1".to_string(),
                permission: "finance:delete".to_string(),
                effect: "DENY".to_string(),
            },
        ],
        bindings: vec![
            BindingEntry {
                id: Some("b1".to_string()),
                principal_sub: "sub-1".to_string(),
                binding_type: "ROLE".to_string(),
                role_id: Some("r1".to_string()),
                expires_at: None,
            },
            BindingEntry {
                id: Some("b2".to_string()),
                principal_sub: "sub-1".to_string(),
                binding_type: "EMERGENCY_DENY".to_string(),
                role_id: None,
                expires_at: Some(99),
            },
        ],
    }
}

#[test]
fn compiled_binding_active_respects_expiry() {
    // Arrange
    let permanent = CompiledBinding { is_emergency_deny: false, role_id: Some("r1".to_string()), expires_at: None };
    let expiring = CompiledBinding { is_emergency_deny: false, role_id: None, expires_at: Some(10) };

    // Act / Assert
    assert!(permanent.active(i64::MAX));
    assert!(expiring.active(9));
    assert!(!expiring.active(10));
}

#[test]
fn compiled_snapshot_indexes_bindings_grants_and_permission_metadata() {
    // Arrange
    let payload = payload();

    // Act
    let snapshot = CompiledSnapshot::from_payload(payload);

    // Assert
    assert_eq!(snapshot.version, 7);
    assert_eq!(snapshot.bindings_for("sub-1").len(), 2);
    assert!(snapshot.bindings_for("missing").is_empty());
    assert_eq!(snapshot.grants_for_role("r1").len(), 2);
    assert!(snapshot.grants_for_role("missing").is_empty());
    let meta = snapshot.perm_meta("finance:write").unwrap();
    assert_eq!(meta.min_acr.as_deref(), Some("aal2"));
    assert!(meta.requires_quorum);
}

#[test]
fn grant_matches_supports_exact_domain_wildcard_and_global_wildcard_only() {
    // Arrange / Act / Assert
    assert!(grant_matches("finance:read", "finance:read"));
    assert!(grant_matches("finance:*", "finance:write"));
    assert!(grant_matches("*:*", "risk:write"));
    assert!(!grant_matches("finance:*", "risk:write"));
    assert!(!grant_matches("finance*", "finance:write"));
    assert!(!grant_matches("finance:*", "finance"));
}