khive_gate/gate.rs
1use std::sync::Arc;
2
3use crate::{GateDecision, GateError, GateRequest};
4
5/// Authorization gate consulted before each verb dispatch.
6///
7/// Implementations return policy denials as decisions and infrastructure failures as errors. See
8/// `crates/khive-gate/docs/api/gate-evaluation.md`.
9pub trait Gate: Send + Sync + std::fmt::Debug {
10 /// Evaluate `req`, returning an allow/deny decision or a backend [`GateError`].
11 fn check(&self, req: &GateRequest) -> Result<GateDecision, GateError>;
12
13 /// Return the audit backend name; defaults to `std::any::type_name::<Self>()`.
14 fn impl_name(&self) -> &'static str {
15 std::any::type_name::<Self>()
16 }
17}
18
19/// Shareable handle to a `Gate` impl.
20pub type GateRef = Arc<dyn Gate>;
21
22/// Permissive gate — every request is allowed with no obligations.
23///
24/// This runtime default is for trusted local use. See
25/// `crates/khive-gate/docs/api/gate-evaluation.md`.
26#[derive(Clone, Debug, Default)]
27pub struct AllowAllGate;
28
29impl Gate for AllowAllGate {
30 fn check(&self, _req: &GateRequest) -> Result<GateDecision, GateError> {
31 Ok(GateDecision::allow())
32 }
33
34 fn impl_name(&self) -> &'static str {
35 "AllowAllGate"
36 }
37}