Struct StorageAccessController 

pub struct StorageAccessController { /* private fields */ }

Thread-safe role-based and attribute-based access controller.

Implementations

impl StorageAccessController

pub fn new(config: AclConfig) -> Self

Create a new controller with the supplied configuration.

pub fn with_defaults() -> Self

Create a controller with default (deny-by-default, audit-enabled) settings.

pub fn register_subject( &self, subject: SubjectAttributes, ) -> Result<(), AclError>

Register (or replace) a subject identity and its attributes.

pub fn register_role(&self, role: SacRole) -> Result<(), AclError>

Register (or replace) a role definition.

Returns AclError::CyclicRoleInheritance if adding this role would introduce a cycle in the inheritance graph.

pub fn add_policy(&self, policy: ResourcePolicy) -> Result<(), AclError>

Append a resource policy.

Validates the resource pattern is non-empty.

pub fn remove_policy(&self, resource_pattern: &str) -> Result<(), AclError>

Remove all policies whose resource_pattern equals resource_pattern.

Returns Err(AclError::InvalidPattern) if no policies matched.

pub fn check_access( &self, subject_id: &str, resource: &str, permission: Permission, current_ts: u64, ) -> Result<AccessDecision, AclError>

Evaluate whether subject_id may perform permission on resource.

current_ts is a caller-supplied Unix timestamp (milliseconds) used only for audit log entries.

pub fn effective_permissions( &self, subject_id: &str, resource: &str, ) -> Result<Vec<Permission>, AclError>

Return all permissions the subject is granted (i.e. yields Allowed) for the given resource across the known permission variants.

The set of probed permissions is: [Read, Write, Delete, List, Admin, Share] plus any Execute ops that appear in registered policies for this resource.

pub fn roles_for_subject( &self, subject_id: &str, ) -> Result<Vec<String>, AclError>

Return all role names the subject holds, including inherited roles (BFS).

pub fn audit_log_entries( &self, subject_id: Option<&str>, resource: Option<&str>, ) -> Vec<SacAuditEntry>

Query the audit log.

Both filters are optional; omitting them returns the full log. Entries are returned in insertion order (oldest first).

pub fn stats(&self) -> AclStats

Return a snapshot of controller-wide statistics.

pub fn audit_log_len(&self) -> usize

Current number of entries in the audit log.

pub fn with_audit_log<F, T>(&self, f: F) -> T

where F: FnOnce(&VecDeque<SacAuditEntry>) -> T,

Direct read access to the audit log via a closure (avoids cloning).