Enum Authorizer 

pub enum Authorizer {
    AllowAll,
    AllowList(HashMap<String, HashSet<String>>),
    Custom(Arc<dyn Fn(&Identity, &str) -> bool + Send + Sync>),
}

Per-query authorization hook, consulted after a query resolves to its registered name. Dependency-light by design — no external policy engine.

The default Authorizer::AllowAll permits everything (so wiring it in is a no-op for existing servers). Authorizer::AllowList keys on Identity::name and permits only the named queries listed for that identity. Authorizer::Custom defers to a closure for arbitrary policy.

Variants

AllowAll

Permit every identity to run every query (the default).

AllowList(HashMap<String, HashSet<String>>)

Permit each identity only the registered-query names listed for it. An identity absent from the map is denied every query; the special key "*" is consulted as a fallback for identities not otherwise listed.

Custom(Arc<dyn Fn(&Identity, &str) -> bool + Send + Sync>)

Arbitrary policy: (identity, resolved_query_name) -> allowed.

Implementations

impl Authorizer

pub fn allow_list<I, S1, S2>(entries: I) -> Self

where I: IntoIterator<Item = (S1, Vec<S2>)>, S1: Into<String>, S2: Into<String>,

Build an Authorizer::AllowList from (identity_name, &[query_name]) pairs. Each identity is permitted exactly the listed registered-query names (table names from register_named, or the Cypher key otherwise).

pub fn custom<F>(f: F) -> Self

where F: Fn(&Identity, &str) -> bool + Send + Sync + 'static,

Wrap a closure as an Authorizer::Custom.

pub fn is_allowed(&self, identity: &Identity, query_name: &str) -> bool

Is identity allowed to run the query resolved to query_name?

pub fn authorize( &self, identity: &Identity, query_name: &str, ) -> Result<(), Status>

Authorize or reject, mapping a denial to permission_denied.

Trait Implementations

impl Clone for Authorizer

fn clone(&self) -> Authorizer

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Authorizer

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Authorizer

fn default() -> Authorizer

Returns the “default value” for a type.