Enum Policy 

pub enum Policy<O> {
    Permit(O),
    Deny,
    Grant {
        outcome: O,
        condition: Condition,
        label: Option<ClauseLabel>,
        deny_shape: DenyShape,
        obligations: Vec<ObligationId>,
        reason: Option<ReasonCode>,
    },
    All(Vec<Self>),
    Any(Vec<Self>),
    OrElse {
        primary: Box<Self>,
        fallback: Box<Self>,
    },
}

Reified authorization policy.

Variants

Permit(O)

Unconditional permit with an outcome.

Deny

Unconditional denial.

Grant

Conditional permit with denial metadata.

Fields

outcome: O

Outcome granted when the condition succeeds.

condition: Condition

Predicate that guards the grant.

label: Option<ClauseLabel>

Optional trace label for this clause.

deny_shape: DenyShape

Shape exposed when the grant condition fails.

obligations: Vec<ObligationId>

Obligations attached to a successful grant.

reason: Option<ReasonCode>

Reason code attached to a failed grant.

All(Vec<Self>)

Meet composition across child policies.

Any(Vec<Self>)

Join composition across child policies.

OrElse

Fallback policy used only when the primary denies.

Fields

primary: Box<Self>

Primary policy.

fallback: Box<Self>

Fallback policy.

Implementations

impl<O: Serialize> Policy<O>

pub fn hash(&self) -> Result<PolicyHash, Error>

Computes a stable hash of the serialized policy value.

Errors

Returns a postcard::Error when the policy cannot be serialized.

impl<O> Policy<O>

pub fn labeled(self, label: impl IntoLabel) -> Self

Adds a label to grant policies.

pub fn try_labeled(self, label: impl Into<String>) -> GatekeepResult<Self>

Tries to add a validated label to grant policies.

Errors

Returns crate::GatekeepError::EmptyIdentifier when label is empty or contains only whitespace.

pub const fn hidden(self) -> Self

Marks grant denial as hidden.

pub fn reason(self, reason: impl IntoReasonCode) -> Self

Adds a reason code to grant denials.

pub fn try_reason(self, reason: impl Into<String>) -> GatekeepResult<Self>

Tries to add a validated reason code to grant denials.

Errors

Returns crate::GatekeepError::EmptyIdentifier when reason is empty or contains only whitespace.

pub fn with_obligation<S: ObligationSpec>(self) -> Self

Adds a typed obligation to grant permits.

Trait Implementations

impl<O: Clone> Clone for Policy<O>

fn clone(&self) -> Policy<O>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<O: Debug> Debug for Policy<O>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de, O> Deserialize<'de> for Policy<O>

where O: Deserialize<'de>,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl<O: Eq> Eq for Policy<O>

impl<O> From<GrantPolicy<O>> for Policy<O>

fn from(grant: GrantPolicy<O>) -> Self

Converts to this type from the input type.

impl<O: PartialEq> PartialEq for Policy<O>

fn eq(&self, other: &Policy<O>) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl<O> Serialize for Policy<O>

where O: Serialize,

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl<O: PartialEq> StructuralPartialEq for Policy<O>