rskit-authz 0.2.0-alpha.3

RBAC and ABAC authorization engine
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46

//! Wildcard permission matching helpers.

/// Return `true` when `pattern` matches `value`.
///
/// `*` matches anything. `resource:*` and `*:action` are supported.
#[must_use]
pub fn match_pattern(pattern: &str, value: &str) -> bool {
    if pattern == value || pattern == "*" || pattern == "*:*" {
        return true;
    }

    // Use split_once to avoid per-call Vec allocation on the hot auth path.
    match (pattern.split_once(':'), value.split_once(':')) {
        (Some((pp, pa)), Some((vp, va))) => wildcard_equals(pp, vp) && wildcard_equals(pa, va),
        _ => wildcard_equals(pattern, value),
    }
}

/// Return `true` when any supplied pattern matches `value`.
#[must_use]
pub fn match_any(patterns: &[String], value: &str) -> bool {
    patterns.iter().any(|pattern| match_pattern(pattern, value))
}

fn wildcard_equals(pattern: &str, value: &str) -> bool {
    pattern == "*" || pattern == value
}

#[cfg(test)]
mod tests {
    use super::{match_any, match_pattern};

    #[test]
    fn match_pattern_supports_wildcards() {
        assert!(match_pattern("*:*", "article:read"));
        assert!(match_pattern("article:*", "article:write"));
        assert!(match_pattern("*:read", "article:read"));
        assert!(match_pattern("article:read", "article:read"));
        assert!(!match_pattern("article:write", "article:read"));
    }

    #[test]
    fn match_any_returns_false_for_empty_patterns() {
        assert!(!match_any(&[], "article:read"));
    }
}