treetop-client 0.0.4

Typed async Rust client for Treetop policy authorization servers
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105

//! Fluent user-policy endpoint calls.

use crate::types::{EntityId, Namespace, UserPolicies, ValidationError};
use crate::{Result, TreetopError};

use super::inner::{Client, CorrelationId};

/// A fluent user-policy query that returns structured policy data by default.
///
/// Add group and namespace filters before calling [`send`](Self::send), or call
/// [`raw`](Self::raw) to transition to a raw Cedar DSL response.
pub struct UserPoliciesRequest<'a, Capability> {
    client: &'a Client<Capability>,
    user: String,
    groups: Vec<String>,
    namespaces: Vec<String>,
    correlation_id: Option<CorrelationId>,
}

impl<'a, Capability> UserPoliciesRequest<'a, Capability> {
    pub(super) fn new(client: &'a Client<Capability>, user: impl Into<String>) -> Result<Self> {
        let user = user.into();
        validate_user(&user)?;
        Ok(Self {
            client,
            user,
            groups: Vec::new(),
            namespaces: Vec::new(),
            correlation_id: None,
        })
    }

    /// Adds a validated group filter.
    pub fn group(mut self, group: impl Into<String>) -> Result<Self> {
        let group = group.into();
        EntityId::new(&group).validate("user policies group")?;
        self.groups.push(group);
        Ok(self)
    }

    /// Adds a validated qualified Cedar namespace filter.
    pub fn namespace(mut self, namespace: impl Into<String>) -> Result<Self> {
        let namespace = namespace.into();
        Namespace::new(namespace.split("::").map(str::to_string).collect())
            .validate("user policies namespace")?;
        self.namespaces.push(namespace);
        Ok(self)
    }

    /// Overrides the client's correlation ID for this call.
    pub fn correlation_id(mut self, id: impl Into<String>) -> Result<Self> {
        self.correlation_id = Some(CorrelationId::parse(id.into())?);
        Ok(self)
    }

    /// Transitions this query to a raw Cedar DSL response.
    pub fn raw(self) -> RawUserPoliciesRequest<'a, Capability> {
        RawUserPoliciesRequest { inner: self }
    }

    /// Sends the query and returns structured policy data.
    pub async fn send(self) -> Result<UserPolicies> {
        self.client
            .send_user_policies(
                &self.user,
                &self.groups,
                &self.namespaces,
                false,
                self.correlation_id.as_ref(),
            )
            .await
    }
}

/// A fluent user-policy query that returns raw Cedar DSL text.
pub struct RawUserPoliciesRequest<'a, Capability> {
    inner: UserPoliciesRequest<'a, Capability>,
}

impl<Capability> RawUserPoliciesRequest<'_, Capability> {
    /// Sends the query and returns raw Cedar DSL text.
    pub async fn send(self) -> Result<String> {
        self.inner
            .client
            .send_user_policies_raw(
                &self.inner.user,
                &self.inner.groups,
                &self.inner.namespaces,
                true,
                self.inner.correlation_id.as_ref(),
            )
            .await
    }
}

fn validate_user(user: &str) -> Result<()> {
    EntityId::new(user).validate("user policies user")?;
    if user.is_empty() || matches!(user, "." | "..") {
        return Err(TreetopError::from(ValidationError::InvalidPathSegment {
            field: "user policies user",
            value: user.to_string(),
        }));
    }
    Ok(())
}