Trait AuthorizeExt 

pub trait AuthorizeExt {
    // Required method
    fn require(
        &self,
        scope: ApiKeyScope,
        admin_only: bool,
    ) -> Result<(), ApiError>;
}

Scope and admin checks on an Authenticated caller.

Lives in ironflow-api rather than ironflow-auth because it returns ApiError, which ironflow-auth cannot depend on.

Examples

use ironflow_api::authorization::AuthorizeExt;
use ironflow_api::error::ApiError;
use ironflow_auth::extractor::{AuthMethod, Authenticated};
use ironflow_store::entities::ApiKeyScope;
use uuid::Uuid;

let auth = Authenticated {
    user_id: Uuid::now_v7(),
    method: AuthMethod::ApiKey {
        key_id: Uuid::now_v7(),
        key_name: "ci".to_string(),
        scopes: vec![ApiKeyScope::RunsRead],
        owner_is_admin: false,
    },
};
auth.require(ApiKeyScope::RunsRead, false)?;

Required Methods

fn require(&self, scope: ApiKeyScope, admin_only: bool) -> Result<(), ApiError>

Check that the caller may use a route needing scope.

An API key must hold scope (the admin scope implies every scope). When admin_only is set, the caller must also be an admin: a JWT session must belong to an admin, and an API key must be owned by an admin (read at request time, so a demotion takes effect immediately). The scope is checked before the admin flag.

Errors

• ApiError::InsufficientScope if an API key lacks scope
• ApiError::Forbidden if admin_only is set and the caller (or the key owner) is not an admin

Examples

use ironflow_api::authorization::AuthorizeExt;
use ironflow_api::error::ApiError;
use ironflow_auth::extractor::{AuthMethod, Authenticated};
use ironflow_store::entities::ApiKeyScope;
use uuid::Uuid;

let auth = Authenticated {
    user_id: Uuid::now_v7(),
    method: AuthMethod::Jwt {
        username: "alice".to_string(),
        is_admin: true,
    },
};
auth.require(ApiKeyScope::Admin, true)?;

Dyn Compatibility

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementations on Foreign Types

impl AuthorizeExt for Authenticated

fn require(&self, scope: ApiKeyScope, admin_only: bool) -> Result<(), ApiError>

Implementors