zift 0.2.2

Scan codebases for embedded authorization logic and generate Policy as Code (Rego/OPA today)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67

//! Zift — static analysis for embedded authorization logic.
//!
//! This crate is published as both a binary (`zift`) and a library.
//!
//! # Stable public API
//!
//! The types below form the semver-committed surface. Everything else is
//! internal or opt-in via `--features unstable`.
//!
//! - [`cli`] — CLI argument types (`Cli`, `ScanArgs`, …)
//! - [`error`] — `ZiftError` and `Result<T>`
//! - [`types`] — core data types (`Finding`, `Language`, `AuthCategory`, …)
//! - [`rules`] — rule loading (read-only)
//! - [`policy`] — engine-agnostic [`policy::PolicyGenerator`] trait and dispatch
//! - [`rego`] — Rego/OPA policy generation; `rego::validator` is the stable surface
//! - [`cedar`] — Cedar policy generation; `cedar::validator` is the stable surface
//! - [`run`] — binary entry point

// Stable public API
pub mod cedar;
pub mod cli;
pub mod error;
pub mod policy;
pub mod rego;
pub mod rules;
pub mod types;

// Internal implementation — not accessible to downstream crates; the binary
// reaches these only through `run()` below.
mod commands;
mod logging;

// Internal modules exposed conditionally when the `unstable` feature is
// enabled. Within this crate they are always reachable via `crate::…`.
#[cfg(feature = "unstable")]
pub mod config;
#[cfg(not(feature = "unstable"))]
mod config;

#[cfg(feature = "unstable")]
pub mod deep;
#[cfg(not(feature = "unstable"))]
mod deep;

#[cfg(feature = "unstable")]
pub mod mcp;
#[cfg(not(feature = "unstable"))]
mod mcp;

#[cfg(feature = "unstable")]
pub mod output;
#[cfg(not(feature = "unstable"))]
mod output;

#[cfg(feature = "unstable")]
pub mod scanner;
#[cfg(not(feature = "unstable"))]
mod scanner;

/// Entry point used by the `zift` binary.
///
/// Initialises logging, loads config, and dispatches the CLI command.
pub fn run(cli: cli::Cli) -> error::Result<()> {
    logging::init(cli.verbose);
    let cfg = config::load_config(&cli.config)?;
    commands::dispatch(cli, cfg)
}