Struct DefaultGrantStore 

pub struct DefaultGrantStore { /* private fields */ }

Thread-safe, in-memory command grant store.

Implements GrantPolicy using a single RwLock over both grant sets for atomic snapshot consistency across all operations.

Grant Types

Type	Behavior
Persistent	Valid until revoked or session ends
OneTime	Consumed on first successful match

Thread Safety

All operations are thread-safe via a single RwLock. Because one-time grants are consumed on match, is_granted acquires a write lock to ensure atomicity. Read-only accessors (grant_count, list_grants) use a read lock for concurrency.

Example

use orcs_auth::{CommandGrant, GrantPolicy};
use orcs_runtime::DefaultGrantStore;

let store = DefaultGrantStore::new();

// Grant a persistent pattern
store.grant(CommandGrant::persistent("rm -rf")).expect("grant persistent");
assert!(store.is_granted("rm -rf ./temp").expect("check grant"));
assert!(store.is_granted("rm -rf ./temp").expect("check grant")); // Still valid

// Grant a one-time pattern
store.grant(CommandGrant::one_time("git push --force")).expect("grant one-time");
assert!(store.is_granted("git push --force origin main").expect("check grant")); // Consumed
assert!(!store.is_granted("git push --force origin main").expect("check grant")); // Gone

Implementations

impl DefaultGrantStore

pub fn new() -> Self

Creates a new empty grant store.

pub fn restore_grants(&self, grants: &[CommandGrant]) -> Result<(), GrantError>

Restores grants from a previously saved list (batch, single lock).

Typically used to restore session state:

let grants = old_store.list_grants().expect("list grants");
// ... serialize grants to SessionAsset, persist, reload ...
let new_store = DefaultGrantStore::new();
new_store.restore_grants(&grants).expect("restore grants");

Existing grants are preserved (additive merge).

Errors

Returns GrantError if internal state is inaccessible.

Trait Implementations

impl Debug for DefaultGrantStore

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for DefaultGrantStore

fn default() -> DefaultGrantStore

Returns the “default value” for a type.

impl GrantPolicy for DefaultGrantStore

fn grant(&self, grant: CommandGrant) -> Result<(), GrantError>

Grants a command pattern.

fn revoke(&self, pattern: &str) -> Result<(), GrantError>

Revokes a previously granted pattern.

fn is_granted(&self, command: &str) -> Result<bool, GrantError>

Checks if a command is allowed by any granted pattern.

fn clear(&self) -> Result<(), GrantError>

Clears all grants.

fn grant_count(&self) -> usize

Returns the number of active grants.

fn list_grants(&self) -> Result<Vec<CommandGrant>, GrantError>

Returns all currently active grants.