Crate gatekeep

Expand description

Ordinary Rust gates and resource policies with inspectable decision evidence.

Start with a named boolean check; use () for a permit/deny outcome.

use gatekeep::{Fact, StaticFactId, KnownFacts, condition, policy, evaluate};
struct Owner;
impl Fact for Owner { const ID: StaticFactId = StaticFactId::new("record.owner"); }
let policy = policy::grant_clause((), condition::has::<Owner>()).into_policy();
let facts = KnownFacts::new().with_bool::<Owner>(true);
assert!(evaluate(&policy, &facts).is_permit());

PreparedPolicy and Authorizer add checked resolution and required audit persistence. ResourcePolicy groups typed application operations. Graded outcomes, partial evaluation and explicit SQL mappings are optional next steps. Applications own authentication, transactions and disclosure.

Guides and the record service show these boundaries in use.

Modules§

condition: Condition builder helpers.
policy: Policy builder helpers.

Structs§

ApplicationVerifiedTenantBinding: An application-verified tenant binding with an explicit validity window.
AuditEntry: Durable audit payload for a decision.
AuthorizationAttempt: Separate durable event for an authorization attempt that produced no decision.
AuthorizationDecision: A completed authorization decision and its audit occurrence.
Authorizer: Framework-independent resolution, evaluation and required audit boundary.
BatchDecisions: Ordered results retaining decisions and per-item failures, including denials.
BindingProvenance: Bounded application-supplied provenance for a tenant or resolver binding.
ClauseLabel: Owned gatekeep identifier.
Context: Request-scoped data passed to adapter boundaries.
Decision: Structured policy decision with obligations and a typed trace.
DecisionAuditId: Owned gatekeep identifier.
DecisionAuditOccurrence: The stable identity and authoritative occurrence time for one decision.
DecisionSummary: Monomorphic observer payload for a decision.
DecisionTrace: Typed trace produced by pure evaluation.
DenialReason: Stable denial reason emitted by the core.
EvidenceDigest: Fixed-size digest carried as evidence without retaining raw claims or tokens.
FactId: Owned gatekeep identifier.
FactObservation: A selected boolean observation and bounded source metadata, never a domain object.
FactResolution: One atomic result from a fact resolver.
FactResolutionEvidence: Bounded evidence for the complete resolved fact set used by one decision.
FactResolutionMetadata: Resolver metadata supplied by an application for one fact-set observation.
IdentityReasonCatalog: Reason catalog that renders the stable reason code.
KnownFacts: Fact bundle accepted by full evaluation.
LegacyAuditEntry: Historical audit shape used only by an explicit migration decoder.
LegacyPolicyAnchor: Policy anchor shape retained for explicit migration of pre-4.0 audit data.
Locale: Language or locale tag used by human-facing reason text.
Lowered: Backend filter and grade projection produced by query lowering.
NoopAuditSink: Audit sink that discards entries.
NoopPolicyObserver: Observer that discards decision summaries.
ObligationId: Owned gatekeep identifier.
ParamKey: Owned gatekeep identifier.
PartialFacts: Fact bundle accepted by partial evaluation.
PendingDecision: An evaluated decision awaiting required persistence, not an authorization token.
PolicyAnchor: Stable policy identity recorded with summaries and audit entries.
PolicyHash: Owned gatekeep identifier.
PolicyId: Owned gatekeep identifier.
PolicyInspection: Borrowed metadata inventory for tooling and reason-catalog checks.
PreparedPolicy: Immutable policy with its versioned identity and required facts computed once.
ReasonCode: Owned gatekeep identifier.
RequestId: Owned gatekeep identifier.
StaticClauseLabel: Static gatekeep identifier.
StaticFactId: Static gatekeep identifier.
StaticObligationId: Static gatekeep identifier.
StaticParamKey: Static gatekeep identifier.
StaticReasonCode: Static gatekeep identifier.
StaticRequestId: Static gatekeep identifier.
StaticSubjectSlot: Static gatekeep identifier.
StaticTenantId: Static gatekeep identifier.
SubjectRef: Application-owned subject reference.
SubjectSlot: Owned gatekeep identifier.
SystemClock: Clock implementation that reads the system UTC wall clock.
TenantBindingEvidence: Bounded evidence for an application-verified tenant binding.
TenantId: Tenant routing identity shared with Dovecote’s 255-byte CloudEvents value.
Trace: Durable, non-generic decision trace.
TrustedServiceBinding: A separately named binding for an explicitly trusted internal service.

Enums§

AttemptAuthorizationError: Complete failure result when recording failed authorization attempts.
AttemptFailure: Failure category recorded without backend messages or untrusted request bodies.
AttemptValidationError: Failure establishing a trusted attempt record.
AuditConstructionError: Failure while deriving a durable entry from a typed decision.
AuditEntryError: Validation failure for a current durable audit entry.
AuthorizationError: Error produced while resolving, evaluating, tracing, or auditing a decision.
BatchError: Whole-batch failure before any decisions are evaluated or persisted.
BindingAuthority: Authority metadata supplied by the application that verified a binding.
Condition: Boolean predicate over known or deferred facts.
ContextError: Error returned when a request context cannot establish a safe tenant boundary.
DecisionAuditOccurrenceError: Validation failure for a decision occurrence crossing the SQL audit boundary.
DecisiveClause: Typed decisive clause.
DenyShape: Disclosure shape for a denied grant.
Effect: Permit or deny effect produced by evaluation.
EffectKind: Permit/deny effect without the generic outcome value.
ExplanationAudience: Who may receive an explanation. Audit output contains internal fact names.
FactResolutionError: Invalid or stale freshness information in a resolver envelope.
FactResolutionEvidenceError: Failure while creating bounded fact-set evidence.
GatekeepError: Validation errors returned by typed gatekeep records.
LowerError: Error returned by query-lowering adapters.
ObservationError: Invalid selected evidence. Error messages never include source content.
Policy: Reified authorization policy.
PolicyAdvice: Advisory authoring issue; it does not change evaluation or invalidate a policy.
Presence: Presence state of a named fact.
ReasonValue: Structured denial-reason parameter value.
ReplayError: Historical evidence cannot reconstruct the supplied policy’s inputs.
Residual: Result of partial evaluation with possibly unknown facts.
ResidualPolicy: Residual policy produced by partial evaluation.
ResidualPolicyBranch: Child branch considered by ResidualPolicy::try_fold_pruned.
ResidualPolicyNode: Fold node exposed by ResidualPolicy::try_fold.
ResolveError: Error returned by fact resolution orchestration.
TenantBinding: The binding authority carried by a crate::Context.
TenantBindingError: Errors returned when constructing or validating a tenant binding.
TraceClause: Serialized decisive clause.
TraceError: Error produced while serializing trace or reason values.

Constants§

AUDIT_ENTRY_SCHEMA_VERSION: Current durable representation version for decision audit entries.
MAX_FACT_OBSERVATIONS: Maximum selected observations retained by one decision.
MAX_TENANT_ID_BYTES: Maximum UTF-8 byte length shared with Dovecote tenant routing values.
POLICY_HASH_FORMAT_VERSION: Durable encoding version used by Policy::hash.

Traits§

AttemptAuditSink: Required persistence boundary for failed attempts, separate from decisions.
AuditSink: Append-only audit boundary.
BatchFactResolver: Provider-owned bulk loading. No default loop pretends to eliminate N+1 reads.
Clock: Application-owned source of UTC instants used at adapter boundaries.
Fact: Marker trait for compile-time known facts.
FactResolver: Async boundary that resolves policy facts from application-owned storage.
Lattice: Outcome ordering used when policies combine permissions.
ObligationSpec: Marker trait for compile-time known obligations.
ObservationFacts: Explicit observations available for validating selected resolution evidence.
PolicyObserver: Side-channel observer for decision summaries.
QueryFactResolver: Optional query resolution for applications that lower policies into list filters.
QueryLowering: Lowers a residual policy into a backend filter and grade projection.
ReasonCatalog: Presentation adapter for localized denial reasons.
ResourcePolicy: Application-owned operations and named checks for one resource type.

Functions§

complete_residual: Completes a partial-evaluation result against known facts.
evaluate: Evaluates a policy against known facts.
evaluate_residual: Evaluates a residual policy against known facts.
partial_evaluate: Partially evaluates a policy against present, absent, and unknown facts.
required_facts: Returns every fact that may be consulted by a policy.
required_residual_facts: Returns every fact that may be consulted by a residual policy.

Type Aliases§

GatekeepResult: Result type used by gatekeep constructors and validators.
TraceValue: Opaque serialized value used only for trace and audit output.

Crate gatekeep

Crate gatekeep Copy item path

Modules§

Structs§

Enums§

Constants§

Traits§

Functions§

Type Aliases§

Crate gatekeep