cratestack_sqlx/delegate/
model_authorize.rs

1//! `ModelDelegate` authorize_* preflight probes. Each runs a single
2//! `SELECT 1 WHERE policy(...)` to verify the caller may act on a
3//! given row before the actual mutation. Used by the generated
4//! procedure handlers when they take a `@authorize(Model, action,
5//! args.path)` attribute.
6
7use cratestack_core::{CratestackContext, CratestackError};
8
9use crate::sqlx;
10
11use super::model::ModelDelegate;
12
13impl<'a, M: 'static, PK: 'static> ModelDelegate<'a, M, PK> {
14    pub async fn authorize_detail(
15        &self,
16        id: PK,
17        ctx: &CratestackContext,
18    ) -> Result<(), CratestackError>
19    where
20        PK: Send + sqlx::Type<sqlx::Postgres> + for<'q> sqlx::Encode<'q, sqlx::Postgres>,
21    {
22        crate::query::authorize_record_action(
23            self.runtime,
24            self.descriptor,
25            id,
26            self.descriptor.detail_allow_policies,
27            self.descriptor.detail_deny_policies,
28            ctx,
29            "detail",
30        )
31        .await
32    }
33
34    pub async fn authorize_update(
35        &self,
36        id: PK,
37        ctx: &CratestackContext,
38    ) -> Result<(), CratestackError>
39    where
40        PK: Send + sqlx::Type<sqlx::Postgres> + for<'q> sqlx::Encode<'q, sqlx::Postgres>,
41    {
42        crate::query::authorize_record_action(
43            self.runtime,
44            self.descriptor,
45            id,
46            self.descriptor.update_allow_policies,
47            self.descriptor.update_deny_policies,
48            ctx,
49            "update",
50        )
51        .await
52    }
53
54    pub async fn authorize_delete(
55        &self,
56        id: PK,
57        ctx: &CratestackContext,
58    ) -> Result<(), CratestackError>
59    where
60        PK: Send + sqlx::Type<sqlx::Postgres> + for<'q> sqlx::Encode<'q, sqlx::Postgres>,
61    {
62        crate::query::authorize_record_action(
63            self.runtime,
64            self.descriptor,
65            id,
66            self.descriptor.delete_allow_policies,
67            self.descriptor.delete_deny_policies,
68            ctx,
69            "delete",
70        )
71        .await
72    }
73}
cratestack_sqlx/delegate/model_authorize.rs

cratestack_sqlx/delegate/
model_authorize.rs
