khive_gate/
gate.rs

1use std::sync::Arc;
2
3use crate::{GateDecision, GateError, GateRequest};
4
5// ---------- Trait ----------
6
7/// Authorization gate consulted before each verb dispatch.
8///
9/// Implementations live downstream:
10/// - `AllowAllGate` (this crate) — permissive default
11/// - `RegoGate` (Apache-2.0 sibling crate `khive-gate-rego`) — regorus-backed Rego eval
12/// - `LionGate<G>` (khive-cloud, BUSL) — wraps any `Gate` with lion-core
13///   capability witnesses for verifiable enforcement.
14pub trait Gate: Send + Sync + std::fmt::Debug {
15    /// Evaluates the authorization policy for `req` and returns a decision.
16    fn check(&self, req: &GateRequest) -> Result<GateDecision, GateError>;
17
18    /// Short name of this backend — surfaced in audit events so downstream
19    /// tooling can tell `RegoGate` results apart from `LionGate<RegoGate>`
20    /// results without parsing the type.
21    ///
22    /// Defaults to `std::any::type_name::<Self>()`.
23    fn impl_name(&self) -> &'static str {
24        std::any::type_name::<Self>()
25    }
26}
27
28/// Shareable handle to a `Gate` impl.
29pub type GateRef = Arc<dyn Gate>;
30
31// ---------- Default impl ----------
32
33/// Permissive gate — every request is allowed with no obligations.
34///
35/// This is the runtime default. Replace it in `RuntimeConfig.gate` for any
36/// deployment that needs real authorization.
37#[derive(Clone, Debug, Default)]
38pub struct AllowAllGate;
39
40impl Gate for AllowAllGate {
41    fn check(&self, _req: &GateRequest) -> Result<GateDecision, GateError> {
42        Ok(GateDecision::allow())
43    }
44
45    fn impl_name(&self) -> &'static str {
46        "AllowAllGate"
47    }
48}
khive_gate/gate.rs

khive_gate/
gate.rs
