sova-scope 0.1.1

Scoped RBAC (tenant/workspace membership, role matrix, ownership hooks) for Sova
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152

//! Declarative role matrix builder.

use crate::types::{Ability, Capabilities, ResourceRef};
use std::collections::HashMap;

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum ResourcePattern {
    All,
    Kind(&'static str),
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum Condition {
    Always,
    Owner,
}

#[derive(Clone, Debug)]
struct Rule {
    role: &'static str,
    ability: Ability,
    resource: ResourcePattern,
    condition: Condition,
    allow: bool,
}

#[derive(Clone, Debug, Default)]
pub struct RoleMatrix {
    rules: Vec<Rule>,
    allow_all_roles: Vec<&'static str>,
}

impl RoleMatrix {
    pub fn evaluate(
        &self,
        role: &str,
        ability: Ability,
        resource: Option<ResourceRef>,
        is_owner: bool,
    ) -> bool {
        if self.allow_all_roles.contains(&role) {
            return true;
        }

        let mut decided: Option<bool> = None;
        for rule in &self.rules {
            if rule.role != role || rule.ability != ability {
                continue;
            }
            if !resource_matches(rule.resource, resource) {
                continue;
            }
            let ok = match rule.condition {
                Condition::Always => true,
                Condition::Owner => is_owner,
            };
            if ok {
                decided = Some(rule.allow);
            }
        }

        decided.unwrap_or(false)
    }

    pub fn capabilities(
        &self,
        role: &str,
        resource: Option<ResourceRef>,
        is_owner: bool,
    ) -> Capabilities {
        Capabilities {
            view: self.evaluate(role, Ability::View, resource, is_owner),
            create: self.evaluate(role, Ability::Create, resource, is_owner),
            update: self.evaluate(role, Ability::Update, resource, is_owner),
            delete: self.evaluate(role, Ability::Delete, resource, is_owner),
            manage: self.evaluate(role, Ability::Manage, resource, is_owner),
        }
    }
}

fn resource_matches(pattern: ResourcePattern, resource: Option<ResourceRef>) -> bool {
    match pattern {
        ResourcePattern::All => true,
        ResourcePattern::Kind(kind) => resource.is_some_and(|r| r.kind == kind),
    }
}

#[derive(Default)]
pub struct MatrixBuilder {
    kinds: HashMap<&'static str, RoleMatrix>,
}

impl MatrixBuilder {
    pub fn allow_all(&mut self, scope_kind: &'static str, role: &'static str) -> &mut Self {
        self.kinds
            .entry(scope_kind)
            .or_default()
            .allow_all_roles
            .push(role);
        self
    }

    pub fn allow(
        &mut self,
        scope_kind: &'static str,
        role: &'static str,
        ability: Ability,
        resource: ResourcePattern,
        condition: Condition,
    ) -> &mut Self {
        self.kinds
            .entry(scope_kind)
            .or_default()
            .rules
            .push(Rule {
                role,
                ability,
                resource,
                condition,
                allow: true,
            });
        self
    }

    pub fn deny(
        &mut self,
        scope_kind: &'static str,
        role: &'static str,
        ability: Ability,
        resource: ResourcePattern,
        condition: Condition,
    ) -> &mut Self {
        self.kinds
            .entry(scope_kind)
            .or_default()
            .rules
            .push(Rule {
                role,
                ability,
                resource,
                condition,
                allow: false,
            });
        self
    }

    pub fn build(self) -> HashMap<&'static str, RoleMatrix> {
        self.kinds
    }
}

// Ergonomics aliases used in docs / atlas config.