rocketmq_auth/
permission.rs

1// Copyright 2023 The RocketMQ Rust Authors
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7//     http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
15//! Java-compatible legacy ACL permission bits and migration helpers.
16
17use std::fmt;
18
19use rocketmq_security_api::Action;
20use serde::Deserialize;
21use serde::Serialize;
22
23use crate::authorization::enums::decision::Decision;
24
25#[derive(Clone, Copy, Default, Eq, Hash, PartialEq, Serialize, Deserialize)]
26pub struct Permission(u8);
27
28impl Permission {
29    pub const DENY: Self = Self(1);
30    pub const ANY: Self = Self(1 << 1);
31    pub const PUB: Self = Self(1 << 2);
32    pub const SUB: Self = Self(1 << 3);
33
34    pub fn bits(self) -> u8 {
35        self.0
36    }
37
38    pub fn parse(value: Option<&str>) -> Self {
39        match value.map(str::trim).unwrap_or_default() {
40            "PUB" => Self::PUB,
41            "SUB" => Self::SUB,
42            "PUB|SUB" | "SUB|PUB" => Self(Self::PUB.0 | Self::SUB.0),
43            "DENY" | "" => Self::DENY,
44            _ => Self::DENY,
45        }
46    }
47
48    pub fn contains(self, permission: Self) -> bool {
49        self.0 & permission.0 == permission.0
50    }
51
52    pub fn migration_actions_and_decision(value: Option<&str>) -> (Vec<Action>, Decision) {
53        let trimmed = value.map(str::trim).unwrap_or_default();
54        let decision = if trimmed.is_empty() || trimmed == "DENY" {
55            Decision::Deny
56        } else if matches!(trimmed, "PUB" | "SUB" | "PUB|SUB" | "SUB|PUB" | "GET") {
57            Decision::Allow
58        } else {
59            Decision::Deny
60        };
61        let actions = match trimmed {
62            "PUB" => vec![Action::Pub],
63            "SUB" => vec![Action::Sub],
64            "PUB|SUB" | "SUB|PUB" => vec![Action::Pub, Action::Sub],
65            "GET" => vec![Action::Get],
66            "DENY" | "" => vec![Action::All],
67            _ => vec![Action::All],
68        };
69        (actions, decision)
70    }
71}
72
73impl fmt::Debug for Permission {
74    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
75        f.debug_tuple("Permission").field(&self.0).finish()
76    }
77}
78
79#[cfg(test)]
80mod tests {
81    use super::*;
82
83    #[test]
84    fn parses_java_legacy_permission_bits() {
85        assert_eq!(Permission::parse(Some("DENY")).bits(), 1);
86        assert_eq!(Permission::parse(None).bits(), 1);
87        assert_eq!(Permission::parse(Some("")).bits(), 1);
88        assert_eq!(Permission::parse(Some("PUB")).bits(), 1 << 2);
89        assert_eq!(Permission::parse(Some("SUB")).bits(), 1 << 3);
90        assert_eq!(Permission::parse(Some("PUB|SUB")).bits(), (1 << 2) | (1 << 3));
91        assert_eq!(Permission::parse(Some("SUB|PUB")).bits(), (1 << 2) | (1 << 3));
92        assert_eq!(Permission::parse(Some("UNKNOWN")).bits(), 1);
93    }
94
95    #[test]
96    fn combined_permission_contains_each_action_bit() {
97        let permission = Permission::parse(Some("PUB|SUB"));
98
99        assert!(permission.contains(Permission::PUB));
100        assert!(permission.contains(Permission::SUB));
101        assert!(!permission.contains(Permission::ANY));
102    }
103
104    #[test]
105    fn maps_legacy_permission_to_java_migration_actions_and_decision() {
106        assert_eq!(
107            Permission::migration_actions_and_decision(Some("PUB")),
108            (vec![Action::Pub], Decision::Allow)
109        );
110        assert_eq!(
111            Permission::migration_actions_and_decision(Some("SUB")),
112            (vec![Action::Sub], Decision::Allow)
113        );
114        assert_eq!(
115            Permission::migration_actions_and_decision(Some("PUB|SUB")),
116            (vec![Action::Pub, Action::Sub], Decision::Allow)
117        );
118        assert_eq!(
119            Permission::migration_actions_and_decision(Some("SUB|PUB")),
120            (vec![Action::Pub, Action::Sub], Decision::Allow)
121        );
122        assert_eq!(
123            Permission::migration_actions_and_decision(Some("GET")),
124            (vec![Action::Get], Decision::Allow)
125        );
126        assert_eq!(
127            Permission::migration_actions_and_decision(Some("DENY")),
128            (vec![Action::All], Decision::Deny)
129        );
130        assert_eq!(
131            Permission::migration_actions_and_decision(None),
132            (vec![Action::All], Decision::Deny)
133        );
134        assert_eq!(
135            Permission::migration_actions_and_decision(Some("UNKNOWN")),
136            (vec![Action::All], Decision::Deny)
137        );
138    }
139}
rocketmq_auth/permission.rs

rocketmq_auth/
permission.rs
