cratestack_sqlx/delegate/
model_authorize.rs

1//! `ModelDelegate` authorize_* preflight probes. Each runs a single
2//! `SELECT 1 WHERE policy(...)` to verify the caller may act on a
3//! given row before the actual mutation. Used by the generated
4//! procedure handlers when they take a `@authorize(Model, action,
5//! args.path)` attribute.
6
7use cratestack_core::{CoolContext, CoolError};
8
9use crate::sqlx;
10
11use super::model::ModelDelegate;
12
13impl<'a, M: 'static, PK: 'static> ModelDelegate<'a, M, PK> {
14    pub async fn authorize_detail(&self, id: PK, ctx: &CoolContext) -> Result<(), CoolError>
15    where
16        PK: Send + sqlx::Type<sqlx::Postgres> + for<'q> sqlx::Encode<'q, sqlx::Postgres>,
17    {
18        crate::query::authorize_record_action(
19            self.runtime,
20            self.descriptor,
21            id,
22            self.descriptor.detail_allow_policies,
23            self.descriptor.detail_deny_policies,
24            ctx,
25            "detail",
26        )
27        .await
28    }
29
30    pub async fn authorize_update(&self, id: PK, ctx: &CoolContext) -> Result<(), CoolError>
31    where
32        PK: Send + sqlx::Type<sqlx::Postgres> + for<'q> sqlx::Encode<'q, sqlx::Postgres>,
33    {
34        crate::query::authorize_record_action(
35            self.runtime,
36            self.descriptor,
37            id,
38            self.descriptor.update_allow_policies,
39            self.descriptor.update_deny_policies,
40            ctx,
41            "update",
42        )
43        .await
44    }
45
46    pub async fn authorize_delete(&self, id: PK, ctx: &CoolContext) -> Result<(), CoolError>
47    where
48        PK: Send + sqlx::Type<sqlx::Postgres> + for<'q> sqlx::Encode<'q, sqlx::Postgres>,
49    {
50        crate::query::authorize_record_action(
51            self.runtime,
52            self.descriptor,
53            id,
54            self.descriptor.delete_allow_policies,
55            self.descriptor.delete_deny_policies,
56            ctx,
57            "delete",
58        )
59        .await
60    }
61}
cratestack_sqlx/delegate/model_authorize.rs

cratestack_sqlx/delegate/
model_authorize.rs
