Struct AuthAnalysisConfig 

pub struct AuthAnalysisConfig {

    pub enabled: bool,
    pub admin_path_patterns: Vec<String>,
    pub admin_guard_names: Vec<String>,
    pub login_guard_names: Vec<String>,
    pub policy_guard_names: Vec<String>,
    pub authorization_check_names: Vec<String>,
    pub mutation_indicator_names: Vec<String>,
    pub read_indicator_names: Vec<String>,
    pub token_lookup_names: Vec<String>,
    pub token_expiry_fields: Vec<String>,
    pub token_recipient_fields: Vec<String>,
    pub non_sink_receiver_types: Vec<String>,
    pub non_sink_receiver_name_prefixes: Vec<String>,
    pub non_sink_global_receivers: Vec<String>,
    pub non_sink_method_names: Vec<String>,
    pub realtime_receiver_prefixes: Vec<String>,
    pub outbound_network_receiver_prefixes: Vec<String>,
    pub cache_receiver_prefixes: Vec<String>,
    pub acl_tables: Vec<String>,
}

Per-language authorization-analysis configuration from config file.

Fields

enabled: bool

admin_path_patterns: Vec<String>

admin_guard_names: Vec<String>

login_guard_names: Vec<String>

policy_guard_names: Vec<String>

Typed-extractor wrapper names that prove the request passed route-level capability/policy enforcement (e.g. meilisearch’s GuardedData<ActionPolicy<X>, _>). Per-language defaults set in auth_analysis::config::build_auth_rules; user nyx.toml entries are appended. Distinct from login_guard_names so the pattern (matched as last-segment + case-insensitive starts_with) doesn’t pollute regular call recognition.

authorization_check_names: Vec<String>

mutation_indicator_names: Vec<String>

read_indicator_names: Vec<String>

token_lookup_names: Vec<String>

token_expiry_fields: Vec<String>

token_recipient_fields: Vec<String>

non_sink_receiver_types: Vec<String>

Types whose instances should never be treated as auth sinks (e.g. HashMap, HashSet, Vec). When a let binding’s RHS constructs one of these, or an explicit type annotation names one, the bound variable is tagged as non-sink and method calls on it (map.insert, vec.push, …) are not classified as Read/Mutation operations.

non_sink_receiver_name_prefixes: Vec<String>

Variable-name prefixes that strongly imply a local/in-memory collection, used as a fallback when the type cannot be resolved (e.g. visited, seen, counts). Matched against the first segment of the callee receiver chain.

non_sink_global_receivers: Vec<String>

Built-in / framework receivers whose first-segment, when matched exactly (case-sensitive), classifies the call as inherently non-data-layer. Used for browser/DOM globals (document, window, localStorage, …) and stdlib helpers (Math, JSON, Date). Defaults are per-language in auth_analysis::config::build_auth_rules; user nyx.toml entries are appended.

non_sink_method_names: Vec<String>

Method-name allowlist: when the LAST segment of a callee matches (case-sensitive exact), the call is classified as non-sink regardless of receiver. Used for DOM-API methods (addEventListener, getElementById, appendChild, …).

realtime_receiver_prefixes: Vec<String>

Receiver-chain first-segment prefixes that classify a call as a realtime publish / broadcast sink (pub/sub bus, websocket channel, event stream). Treated as cross-tenant by default and gated by the ownership check.

outbound_network_receiver_prefixes: Vec<String>

Receiver-chain first-segment prefixes that classify a call as an outbound network sink (HTTP client, RPC caller, webhook dispatcher).

cache_receiver_prefixes: Vec<String>

Receiver-chain first-segment prefixes that classify a call as a cross-tenant cache access (Redis / memcache / distributed KV client).

acl_tables: Vec<String>

SQL ACL tables. When a literal SELECT … FROM <T> JOIN <ACL> query pins rows via WHERE <ACL>.user_id = ?N, every returned row is membership-gated and downstream uses of its columns do not need an ownership check. Defaults are set per-language in auth_analysis::config::build_auth_rules.

Trait Implementations

impl Clone for AuthAnalysisConfig

fn clone(&self) -> AuthAnalysisConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuthAnalysisConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for AuthAnalysisConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for AuthAnalysisConfig

where AuthAnalysisConfig: Default,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for AuthAnalysisConfig

fn eq(&self, other: &AuthAnalysisConfig) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for AuthAnalysisConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for AuthAnalysisConfig

impl StructuralPartialEq for AuthAnalysisConfig