1use crate::codec::authorization::{
6 from_wire_add_relationship_response, from_wire_check_access_many_response,
7 from_wire_check_access_response, from_wire_delete_relationship_response,
8 from_wire_get_active_model_ref_response, from_wire_list_active_model_resource_types_response,
9 from_wire_list_relationships_response, from_wire_set_active_model_response,
10 from_wire_set_authorization_state_response, to_wire_add_relationship_request,
11 to_wire_check_access_many_request, to_wire_check_access_request,
12 to_wire_delete_relationship_request, to_wire_list_active_model_resource_types_request,
13 to_wire_list_relationships_request, to_wire_set_active_model_request,
14 to_wire_set_authorization_state_request,
15};
16use crate::codec::host_service::{HostServiceChannel, connect_host_service, plain_channel};
17use crate::generated::v1;
18use crate::rpc_support::GestaltError;
19
20pub type DefaultAccessPolicy = i32;
22
23pub mod default_access_policy {
25 pub const DEFAULT_ACCESS_POLICY_DENY: i32 = 0;
27 pub const DEFAULT_ACCESS_POLICY_ALLOW: i32 = 1;
29}
30
31pub type RelationshipTargetType = i32;
33
34pub mod relationship_target_type {
36 pub const RELATIONSHIP_TARGET_TYPE_UNSPECIFIED: i32 = 0;
38 pub const RELATIONSHIP_TARGET_TYPE_SUBJECT: i32 = 1;
40 pub const RELATIONSHIP_TARGET_TYPE_RESOURCE: i32 = 2;
42 pub const RELATIONSHIP_TARGET_TYPE_SUBJECT_SET: i32 = 3;
44}
45
46pub type SourceLayer = i32;
48
49pub mod source_layer {
51 pub const SOURCE_LAYER_UNSPECIFIED: i32 = 0;
53 pub const SOURCE_LAYER_STATIC_CONFIG: i32 = 1;
55 pub const SOURCE_LAYER_RUNTIME: i32 = 2;
57}
58
59#[derive(Clone, Debug, Default, PartialEq)]
61pub struct Action {
62 pub name: String,
64 pub properties: Option<serde_json::Map<String, serde_json::Value>>,
66}
67
68#[derive(Clone, Debug, Default, PartialEq)]
70pub struct AddRelationshipRequest {
71 pub relationship: Option<Relationship>,
73}
74
75#[derive(Clone, Debug, Default, PartialEq)]
77pub struct AddRelationshipResponse {
78 pub relationship: Option<Relationship>,
80}
81
82#[derive(Clone, Debug, Default, PartialEq)]
84pub struct AuthorizationModel {
85 pub id: String,
87 pub version: String,
89 pub resource_types: Vec<AuthorizationModelResourceType>,
91}
92
93#[derive(Clone, Debug, Default, PartialEq)]
95pub struct AuthorizationModelRef {
96 pub id: String,
98 pub version: String,
100 pub created_at: Option<std::time::SystemTime>,
102}
103
104#[derive(Clone, Debug, Default, PartialEq)]
106pub struct AuthorizationModelResourceType {
107 pub name: String,
109 pub relations: Vec<ModelRelation>,
111 pub actions: Vec<ModelAction>,
113 pub source_layer: SourceLayer,
115 pub default_access_policy: DefaultAccessPolicy,
117}
118
119#[derive(Clone, Debug, Default, PartialEq)]
121pub struct AuthorizationModelResourceTypeFilter {
122 pub name: String,
124 pub source_layer: SourceLayer,
126}
127
128#[derive(Clone, Debug, Default, PartialEq)]
130pub struct CheckAccessManyRequest {
131 pub requests: Vec<CheckAccessRequest>,
133}
134
135#[derive(Clone, Debug, Default, PartialEq)]
137pub struct CheckAccessManyResponse {
138 pub decisions: Vec<CheckAccessResponse>,
140}
141
142#[derive(Clone, Debug, Default, PartialEq)]
144pub struct CheckAccessRequest {
145 pub subject: Option<Subject>,
147 pub action: Option<Action>,
149 pub resource: Option<Resource>,
151}
152
153#[derive(Clone, Debug, Default, PartialEq)]
155pub struct CheckAccessResponse {
156 pub allowed: bool,
158 pub model_id: String,
160}
161
162#[derive(Clone, Debug, Default, PartialEq)]
164pub struct DeleteRelationshipRequest {
165 pub relationship_tuple: Option<RelationshipTuple>,
167}
168
169#[derive(Clone, Debug, Default, PartialEq)]
171pub struct DeleteRelationshipResponse {}
172
173#[derive(Clone, Debug, Default, PartialEq)]
175pub struct GetActiveModelRefResponse {
176 pub model: Option<AuthorizationModelRef>,
178}
179
180#[derive(Clone, Debug, Default, PartialEq)]
182pub struct ListActiveModelResourceTypesRequest {
183 pub filter: Option<AuthorizationModelResourceTypeFilter>,
185 pub page_size: i32,
187 pub page_token: String,
189}
190
191#[derive(Clone, Debug, Default, PartialEq)]
193pub struct ListActiveModelResourceTypesResponse {
194 pub resource_types: Vec<AuthorizationModelResourceType>,
196 pub next_page_token: String,
198 pub model_id: String,
200}
201
202#[derive(Clone, Debug, Default, PartialEq)]
204pub struct ListRelationshipsRequest {
205 pub filter: Option<RelationshipFilter>,
207 pub page_size: i32,
209 pub page_token: String,
211}
212
213#[derive(Clone, Debug, Default, PartialEq)]
215pub struct ListRelationshipsResponse {
216 pub relationships: Vec<Relationship>,
218 pub next_page_token: String,
220}
221
222#[derive(Clone, Debug, Default, PartialEq)]
224pub struct ModelAction {
225 pub name: String,
227 pub relations: Vec<String>,
229}
230
231#[allow(clippy::enum_variant_names, clippy::large_enum_variant)]
233#[derive(Clone, Debug, PartialEq)]
234pub enum ModelAllowedTargetKind {
235 SubjectType(String),
237 ResourceType(String),
239 SubjectSetType(SubjectSetType),
241}
242
243#[derive(Clone, Debug, Default, PartialEq)]
245pub struct ModelAllowedTarget {
246 pub kind: Option<ModelAllowedTargetKind>,
248}
249
250#[derive(Clone, Debug, Default, PartialEq)]
252pub struct ModelRelation {
253 pub name: String,
255 pub allowed_targets: Vec<ModelAllowedTarget>,
257}
258
259#[derive(Clone, Debug, Default, PartialEq)]
261pub struct Relationship {
262 pub tuple: Option<RelationshipTuple>,
264 pub properties: Option<serde_json::Map<String, serde_json::Value>>,
266 pub source_layer: SourceLayer,
268}
269
270#[derive(Clone, Debug, Default, PartialEq)]
272pub struct RelationshipFilter {
273 pub target: Option<RelationshipTarget>,
275 pub relation: String,
277 pub resource: Option<Resource>,
279 pub target_type: RelationshipTargetType,
281 pub target_entity_type: String,
283 pub resource_type: String,
285 pub source_layer: SourceLayer,
287}
288
289#[allow(clippy::enum_variant_names, clippy::large_enum_variant)]
291#[derive(Clone, Debug, PartialEq)]
292pub enum RelationshipTargetKind {
293 Subject(Subject),
295 Resource(Resource),
297 SubjectSet(SubjectSet),
299}
300
301#[derive(Clone, Debug, Default, PartialEq)]
303pub struct RelationshipTarget {
304 pub kind: Option<RelationshipTargetKind>,
306}
307
308#[derive(Clone, Debug, Default, PartialEq)]
310pub struct RelationshipTuple {
311 pub target: Option<RelationshipTarget>,
313 pub relation: String,
315 pub resource: Option<Resource>,
317}
318
319#[derive(Clone, Debug, Default, PartialEq)]
321pub struct Resource {
322 pub r#type: String,
324 pub id: String,
326 pub properties: Option<serde_json::Map<String, serde_json::Value>>,
328}
329
330#[derive(Clone, Debug, Default, PartialEq)]
332pub struct SetActiveModelRequest {
333 pub model: Option<AuthorizationModel>,
335}
336
337#[derive(Clone, Debug, Default, PartialEq)]
339pub struct SetActiveModelResponse {
340 pub model: Option<AuthorizationModelRef>,
342}
343
344#[derive(Clone, Debug, Default, PartialEq)]
346pub struct SetAuthorizationStateRequest {
347 pub model: Option<AuthorizationModel>,
349 pub relationships: Vec<Relationship>,
351}
352
353#[derive(Clone, Debug, Default, PartialEq)]
355pub struct SetAuthorizationStateResponse {
356 pub active_model: Option<AuthorizationModelRef>,
358}
359
360#[derive(Clone, Debug, Default, PartialEq)]
362pub struct Subject {
363 pub r#type: String,
365 pub id: String,
367 pub properties: Option<serde_json::Map<String, serde_json::Value>>,
369}
370
371#[derive(Clone, Debug, Default, PartialEq)]
373pub struct SubjectSet {
374 pub resource: Option<Resource>,
376 pub relation: String,
378}
379
380#[derive(Clone, Debug, Default, PartialEq)]
382pub struct SubjectSetType {
383 pub resource_type: String,
385 pub relation: String,
387}
388
389pub struct Authorization {
391 inner: v1::authorization_client::AuthorizationClient<HostServiceChannel>,
392 timeout: Option<std::time::Duration>,
393}
394
395impl Authorization {
396 pub fn new(channel: tonic::transport::Channel) -> Self {
398 Self {
399 inner: v1::authorization_client::AuthorizationClient::new(plain_channel(channel)),
400 timeout: None,
401 }
402 }
403
404 pub fn with_timeout(mut self, timeout: std::time::Duration) -> Self {
407 self.timeout = Some(timeout);
408 self
409 }
410
411 pub async fn connect() -> Result<Self, GestaltError> {
413 Self::connect_named("").await
414 }
415
416 pub async fn connect_named(name: &str) -> Result<Self, GestaltError> {
418 Ok(Self {
419 inner: v1::authorization_client::AuthorizationClient::new(
420 connect_host_service("authorization", name).await?,
421 ),
422 timeout: None,
423 })
424 }
425
426 pub async fn check_access(
428 &mut self,
429 action: Option<Action>,
430 resource: Option<Resource>,
431 ) -> Result<CheckAccessResponse, GestaltError> {
432 let request = CheckAccessRequest {
433 action,
434 resource,
435 ..Default::default()
436 };
437 let mut tonic_request = tonic::Request::new(to_wire_check_access_request(request));
438 if let Some(timeout) = self.timeout {
439 tonic_request.set_timeout(timeout);
440 }
441 let response = self.inner.check_access(tonic_request).await?;
442 Ok(from_wire_check_access_response(response.into_inner()))
443 }
444
445 pub async fn check_access_raw(
447 &mut self,
448 request: CheckAccessRequest,
449 ) -> Result<CheckAccessResponse, GestaltError> {
450 let mut tonic_request = tonic::Request::new(to_wire_check_access_request(request));
451 if let Some(timeout) = self.timeout {
452 tonic_request.set_timeout(timeout);
453 }
454 let response = self.inner.check_access(tonic_request).await?;
455 Ok(from_wire_check_access_response(response.into_inner()))
456 }
457
458 pub async fn check_access_many(
460 &mut self,
461 requests: Vec<CheckAccessRequest>,
462 ) -> Result<CheckAccessManyResponse, GestaltError> {
463 let request = CheckAccessManyRequest { requests };
464 let mut tonic_request = tonic::Request::new(to_wire_check_access_many_request(request));
465 if let Some(timeout) = self.timeout {
466 tonic_request.set_timeout(timeout);
467 }
468 let response = self.inner.check_access_many(tonic_request).await?;
469 Ok(from_wire_check_access_many_response(response.into_inner()))
470 }
471
472 pub async fn check_access_many_raw(
474 &mut self,
475 request: CheckAccessManyRequest,
476 ) -> Result<CheckAccessManyResponse, GestaltError> {
477 let mut tonic_request = tonic::Request::new(to_wire_check_access_many_request(request));
478 if let Some(timeout) = self.timeout {
479 tonic_request.set_timeout(timeout);
480 }
481 let response = self.inner.check_access_many(tonic_request).await?;
482 Ok(from_wire_check_access_many_response(response.into_inner()))
483 }
484
485 pub async fn list_relationships(
487 &mut self,
488 page_size: i32,
489 page_token: String,
490 filter: Option<RelationshipFilter>,
491 ) -> Result<ListRelationshipsResponse, GestaltError> {
492 let request = ListRelationshipsRequest {
493 page_size,
494 page_token,
495 filter,
496 };
497 let mut tonic_request = tonic::Request::new(to_wire_list_relationships_request(request));
498 if let Some(timeout) = self.timeout {
499 tonic_request.set_timeout(timeout);
500 }
501 let response = self.inner.list_relationships(tonic_request).await?;
502 Ok(from_wire_list_relationships_response(response.into_inner()))
503 }
504
505 pub async fn list_relationships_raw(
507 &mut self,
508 request: ListRelationshipsRequest,
509 ) -> Result<ListRelationshipsResponse, GestaltError> {
510 let mut tonic_request = tonic::Request::new(to_wire_list_relationships_request(request));
511 if let Some(timeout) = self.timeout {
512 tonic_request.set_timeout(timeout);
513 }
514 let response = self.inner.list_relationships(tonic_request).await?;
515 Ok(from_wire_list_relationships_response(response.into_inner()))
516 }
517
518 pub async fn add_relationship(
520 &mut self,
521 relationship: Option<Relationship>,
522 ) -> Result<Option<Relationship>, GestaltError> {
523 let request = AddRelationshipRequest { relationship };
524 let mut tonic_request = tonic::Request::new(to_wire_add_relationship_request(request));
525 if let Some(timeout) = self.timeout {
526 tonic_request.set_timeout(timeout);
527 }
528 let response = from_wire_add_relationship_response(
529 self.inner
530 .add_relationship(tonic_request)
531 .await?
532 .into_inner(),
533 );
534 Ok(response.relationship)
535 }
536
537 pub async fn add_relationship_raw(
539 &mut self,
540 request: AddRelationshipRequest,
541 ) -> Result<AddRelationshipResponse, GestaltError> {
542 let mut tonic_request = tonic::Request::new(to_wire_add_relationship_request(request));
543 if let Some(timeout) = self.timeout {
544 tonic_request.set_timeout(timeout);
545 }
546 let response = self.inner.add_relationship(tonic_request).await?;
547 Ok(from_wire_add_relationship_response(response.into_inner()))
548 }
549
550 pub async fn delete_relationship(
552 &mut self,
553 relationship_tuple: Option<RelationshipTuple>,
554 ) -> Result<DeleteRelationshipResponse, GestaltError> {
555 let request = DeleteRelationshipRequest { relationship_tuple };
556 let mut tonic_request = tonic::Request::new(to_wire_delete_relationship_request(request));
557 if let Some(timeout) = self.timeout {
558 tonic_request.set_timeout(timeout);
559 }
560 let response = self.inner.delete_relationship(tonic_request).await?;
561 Ok(from_wire_delete_relationship_response(
562 response.into_inner(),
563 ))
564 }
565
566 pub async fn delete_relationship_raw(
568 &mut self,
569 request: DeleteRelationshipRequest,
570 ) -> Result<DeleteRelationshipResponse, GestaltError> {
571 let mut tonic_request = tonic::Request::new(to_wire_delete_relationship_request(request));
572 if let Some(timeout) = self.timeout {
573 tonic_request.set_timeout(timeout);
574 }
575 let response = self.inner.delete_relationship(tonic_request).await?;
576 Ok(from_wire_delete_relationship_response(
577 response.into_inner(),
578 ))
579 }
580
581 pub async fn set_authorization_state(
583 &mut self,
584 relationships: Vec<Relationship>,
585 model: Option<AuthorizationModel>,
586 ) -> Result<Option<AuthorizationModelRef>, GestaltError> {
587 let request = SetAuthorizationStateRequest {
588 relationships,
589 model,
590 };
591 let mut tonic_request =
592 tonic::Request::new(to_wire_set_authorization_state_request(request));
593 if let Some(timeout) = self.timeout {
594 tonic_request.set_timeout(timeout);
595 }
596 let response = from_wire_set_authorization_state_response(
597 self.inner
598 .set_authorization_state(tonic_request)
599 .await?
600 .into_inner(),
601 );
602 Ok(response.active_model)
603 }
604
605 pub async fn set_authorization_state_raw(
607 &mut self,
608 request: SetAuthorizationStateRequest,
609 ) -> Result<SetAuthorizationStateResponse, GestaltError> {
610 let mut tonic_request =
611 tonic::Request::new(to_wire_set_authorization_state_request(request));
612 if let Some(timeout) = self.timeout {
613 tonic_request.set_timeout(timeout);
614 }
615 let response = self.inner.set_authorization_state(tonic_request).await?;
616 Ok(from_wire_set_authorization_state_response(
617 response.into_inner(),
618 ))
619 }
620
621 pub async fn get_active_model_ref(
623 &mut self,
624 ) -> Result<Option<AuthorizationModelRef>, GestaltError> {
625 let mut tonic_request = tonic::Request::new(());
626 if let Some(timeout) = self.timeout {
627 tonic_request.set_timeout(timeout);
628 }
629 let response = from_wire_get_active_model_ref_response(
630 self.inner
631 .get_active_model_ref(tonic_request)
632 .await?
633 .into_inner(),
634 );
635 Ok(response.model)
636 }
637
638 pub async fn get_active_model_ref_raw(
640 &mut self,
641 ) -> Result<GetActiveModelRefResponse, GestaltError> {
642 let mut tonic_request = tonic::Request::new(());
643 if let Some(timeout) = self.timeout {
644 tonic_request.set_timeout(timeout);
645 }
646 let response = self.inner.get_active_model_ref(tonic_request).await?;
647 Ok(from_wire_get_active_model_ref_response(
648 response.into_inner(),
649 ))
650 }
651
652 pub async fn set_active_model(
654 &mut self,
655 model: Option<AuthorizationModel>,
656 ) -> Result<Option<AuthorizationModelRef>, GestaltError> {
657 let request = SetActiveModelRequest { model };
658 let mut tonic_request = tonic::Request::new(to_wire_set_active_model_request(request));
659 if let Some(timeout) = self.timeout {
660 tonic_request.set_timeout(timeout);
661 }
662 let response = from_wire_set_active_model_response(
663 self.inner
664 .set_active_model(tonic_request)
665 .await?
666 .into_inner(),
667 );
668 Ok(response.model)
669 }
670
671 pub async fn set_active_model_raw(
673 &mut self,
674 request: SetActiveModelRequest,
675 ) -> Result<SetActiveModelResponse, GestaltError> {
676 let mut tonic_request = tonic::Request::new(to_wire_set_active_model_request(request));
677 if let Some(timeout) = self.timeout {
678 tonic_request.set_timeout(timeout);
679 }
680 let response = self.inner.set_active_model(tonic_request).await?;
681 Ok(from_wire_set_active_model_response(response.into_inner()))
682 }
683
684 pub async fn list_active_model_resource_types(
686 &mut self,
687 page_size: i32,
688 page_token: String,
689 filter: Option<AuthorizationModelResourceTypeFilter>,
690 ) -> Result<ListActiveModelResourceTypesResponse, GestaltError> {
691 let request = ListActiveModelResourceTypesRequest {
692 page_size,
693 page_token,
694 filter,
695 };
696 let mut tonic_request =
697 tonic::Request::new(to_wire_list_active_model_resource_types_request(request));
698 if let Some(timeout) = self.timeout {
699 tonic_request.set_timeout(timeout);
700 }
701 let response = self
702 .inner
703 .list_active_model_resource_types(tonic_request)
704 .await?;
705 Ok(from_wire_list_active_model_resource_types_response(
706 response.into_inner(),
707 ))
708 }
709
710 pub async fn list_active_model_resource_types_raw(
712 &mut self,
713 request: ListActiveModelResourceTypesRequest,
714 ) -> Result<ListActiveModelResourceTypesResponse, GestaltError> {
715 let mut tonic_request =
716 tonic::Request::new(to_wire_list_active_model_resource_types_request(request));
717 if let Some(timeout) = self.timeout {
718 tonic_request.set_timeout(timeout);
719 }
720 let response = self
721 .inner
722 .list_active_model_resource_types(tonic_request)
723 .await?;
724 Ok(from_wire_list_active_model_resource_types_response(
725 response.into_inner(),
726 ))
727 }
728}