Struct Gate 

pub struct Gate;

Authorization Gate facade.

Provides a central point for authorization checks.

Example

use ferro_rs::authorization::Gate;

// Define a simple gate
Gate::define("admin", |user, _| user.is_admin().into());

// Check in controller
if Gate::allows("admin", None) {
    // User is admin
}

// Authorize (returns Result)
Gate::authorize("admin", None)?;

Implementations

impl Gate

pub fn init()

Initialize the gate registry.

This is called automatically by the framework during bootstrap.

pub fn define<F>(ability: &str, callback: F)

where F: Fn(&dyn Authenticatable, Option<&dyn Any>) -> AuthResponse + Send + Sync + 'static,

Define a simple ability.

Example

Gate::define("view-dashboard", |user, _| {
    user.as_any().downcast_ref::<User>()
        .map(|u| (u.is_admin || u.has_role("manager")).into())
        .unwrap_or_else(AuthResponse::deny_silent)
});

pub fn before<F>(callback: F)

where F: Fn(&dyn Authenticatable, &str) -> Option<bool> + Send + Sync + 'static,

Register a before hook.

Before hooks run before any ability check. Return Some(true) to allow, Some(false) to deny, or None to continue to the ability check.

Example

// Allow super admins to bypass all checks
Gate::before(|user, _ability| {
    if let Some(u) = user.as_any().downcast_ref::<User>() {
        if u.is_super_admin {
            return Some(true);
        }
    }
    None
});

pub fn allows(ability: &str, resource: Option<&dyn Any>) -> bool

Check if the current user is allowed to perform an ability.

Returns true if allowed, false if denied or not authenticated.

pub fn denies(ability: &str, resource: Option<&dyn Any>) -> bool

Check if the current user is denied an ability.

pub fn authorize( ability: &str, resource: Option<&dyn Any>, ) -> Result<(), AuthorizationError>

Authorize the current user for an ability.

Returns Ok(()) if allowed, or Err(AuthorizationError) if denied.

Example

pub async fn admin_dashboard() -> Result<Response, AuthorizationError> {
    Gate::authorize("view-dashboard", None)?;
    // Render dashboard...
}

pub fn allows_for<U: Authenticatable>( user: &U, ability: &str, resource: Option<&dyn Any>, ) -> bool

Check ability for a specific user.

pub fn authorize_for<U: Authenticatable>( user: &U, ability: &str, resource: Option<&dyn Any>, ) -> Result<(), AuthorizationError>

Authorize for a specific user.

pub fn check_for<U: Authenticatable>( user: &U, ability: &str, resource: Option<&dyn Any>, ) -> AuthResponse

Check ability for a specific user (generic wrapper).

pub fn inspect( user: &dyn Authenticatable, ability: &str, resource: Option<&dyn Any>, ) -> AuthResponse

Check ability for a dynamic Authenticatable reference.

Use this when you have a trait object (&dyn Authenticatable or Arc<dyn Authenticatable>).

pub fn has_policy_for<M: 'static>() -> bool

Check if a policy is registered for a model type.

impl Gate

Extension methods for checking authorization with the current user.

These are async methods that fetch the user before checking.

pub async fn user_allows(ability: &str, resource: Option<&dyn Any>) -> bool

Check if the current authenticated user is allowed (async).

This fetches the user from the database before checking.

pub async fn user_authorize( ability: &str, resource: Option<&dyn Any>, ) -> Result<(), AuthorizationError>

Authorize the current authenticated user (async).

This fetches the user from the database before checking.