Struct EvalTrace 

pub struct EvalTrace { /* private fields */ }

A tree of PolicyEvalResult nodes capturing every policy decision made during an access evaluation.

Returned as part of AccessEvaluation. Use EvalTrace::format to render a human-readable tree, useful for debugging and audit logging.

Example

// An empty trace produces a fallback message:
let empty = EvalTrace::new();
assert_eq!(empty.format(), "No evaluation trace available");

// A trace built from a policy result renders a decision tree:
let trace = EvalTrace::with_root(PolicyEvalResult::Granted {
    policy_type: "AdminPolicy".into(),
    reason: Some("User is admin".into()),
});
assert!(trace.format().contains("AdminPolicy GRANTED"));

Implementations

impl EvalTrace

pub fn new() -> Self

Creates an empty trace with no evaluation results.

pub fn with_root(result: PolicyEvalResult) -> Self

Creates a trace with the given PolicyEvalResult as the root node.

pub fn set_root(&mut self, result: PolicyEvalResult)

Sets (or replaces) the root node of the evaluation tree.

pub fn root(&self) -> Option<&PolicyEvalResult>

Returns a reference to the root PolicyEvalResult, if present.

pub fn format(&self) -> String

Returns a formatted, indented representation of the evaluation tree.

Each node shows a ✔ or ✘ prefix, the policy name, and the reason. Combined nodes indent their children for readability.

Examples found in repository

examples/rbac_policy.rs (line 212)

async fn test_access(
    checker: &PermissionChecker<User, Document, ReadAction, EmptyContext>,
    user_desc: &str,
    user: &User,
    doc_desc: &str,
    doc: &Document,
) {
    let context = EmptyContext;
    let action = ReadAction;

    let result = checker.evaluate_access(user, &action, doc, &context).await;

    println!(
        "{} accessing {}: {}",
        user_desc,
        doc_desc,
        if result.is_granted() {
            "GRANTED ✓"
        } else {
            "DENIED ✗"
        }
    );

    println!(
        "Evaluation trace:\n{}\n",
        match &result {
            AccessEvaluation::Granted { trace, .. } => trace.format(),
            AccessEvaluation::Denied { trace, .. } => trace.format(),
        }
    );
}

examples/actix_web.rs (line 298)

pub async fn edit_post(
    path: web::Path<Uuid>,
    req: HttpRequest,
    AuthenticatedUser(user): AuthenticatedUser,
    checker: web::Data<PermissionChecker<User, Resource, Action, RequestContext>>,
) -> impl Responder {
    let overrides = PostOverrides::from_request(&req);
    let post = load_post(*path, &overrides);
    let ctx = RequestContext {
        current_time: SystemTime::now(),
    };

    match checker
        .evaluate_access(&user, &Action::Edit, &Resource::Post(post), &ctx)
        .await
    {
        AccessEvaluation::Granted { .. } => HttpResponse::Ok().body("Post updated"),
        AccessEvaluation::Denied { reason, trace } => {
            HttpResponse::Forbidden().body(format!("Denied: {}\n{}", reason, trace.format()))
        }
    }
}

pub async fn publish_post(
    path: web::Path<Uuid>,
    req: HttpRequest,
    AuthenticatedUser(user): AuthenticatedUser,
    checker: web::Data<PermissionChecker<User, Resource, Action, RequestContext>>,
) -> impl Responder {
    let overrides = PostOverrides::from_request(&req);
    let post = load_post(*path, &overrides);
    let ctx = RequestContext {
        current_time: SystemTime::now(),
    };

    match checker
        .evaluate_access(&user, &Action::Publish, &Resource::Post(post), &ctx)
        .await
    {
        AccessEvaluation::Granted { .. } => HttpResponse::Ok().body("Post published"),
        AccessEvaluation::Denied { reason, trace } => {
            HttpResponse::Forbidden().body(format!("Denied: {}\n{}", reason, trace.format()))
        }
    }
}

pub async fn view_post(
    path: web::Path<Uuid>,
    req: HttpRequest,
    maybe_user: Option<AuthenticatedUser>,
    checker: web::Data<PermissionChecker<User, Resource, Action, RequestContext>>,
) -> impl Responder {
    let user = maybe_user
        .map(|AuthenticatedUser(user)| user)
        .unwrap_or(User {
            id: Uuid::nil(),
            roles: vec![],
        });

    let overrides = PostOverrides::from_request(&req);
    let post = load_published_post(*path, &overrides);
    let ctx = RequestContext {
        current_time: SystemTime::now(),
    };

    match checker
        .evaluate_access(&user, &Action::View, &Resource::Post(post), &ctx)
        .await
    {
        AccessEvaluation::Granted { .. } => HttpResponse::Ok().body("Here is your post"),
        AccessEvaluation::Denied { reason, trace } => {
            HttpResponse::Forbidden().body(format!("Denied: {}\n{}", reason, trace.format()))
        }
    }
}

examples/rebac_policy.rs (line 253)

async fn test_access(
    checker: &PermissionChecker<User, Project, EditAction, EmptyContext>,
    user: &User,
    project: &Project,
) {
    let context = EmptyContext;
    let action = EditAction;

    println!("\nChecking if {} can edit {}:", user.name, project.name);
    let result = checker
        .evaluate_access(user, &action, project, &context)
        .await;

    println!(
        "Access {} for {}",
        if result.is_granted() {
            "GRANTED ✓"
        } else {
            "DENIED ✗"
        },
        user.name
    );

    println!(
        "Evaluation trace:\n{}\n",
        match &result {
            AccessEvaluation::Granted { trace, .. } => trace.format(),
            AccessEvaluation::Denied { trace, .. } => trace.format(),
        }
    );
}

Trait Implementations

impl Clone for EvalTrace

fn clone(&self) -> EvalTrace

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for EvalTrace

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for EvalTrace

fn default() -> EvalTrace

Returns the “default value” for a type.