Struct Policy 

pub struct Policy { /* private fields */ }

A policy containing multiple rules

Security

Fields are private to enforce validation through deserialization. Use Policy::new() or deserialize from TOML/JSON to create instances. The #[serde(try_from)] attribute ensures all deserialized policies are validated against T20 limits (max rules, max name length, etc.).

Implementations

impl Policy

pub fn name(&self) -> &str

Get the policy name

Examples found in repository

examples/simple_auth_flow.rs (line 75)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    println!("p47h Open Core - Simple Authorization Flow");
    println!("-------------------------------------------");
    println!();

    // -------------------------------------------------------------------------
    // Step 1: Create Identities
    // -------------------------------------------------------------------------
    // Each user or device in the network has a unique cryptographic identity.
    // The identity is an Ed25519 keypair. We use the public key hash as the
    // peer identifier for policy rules.

    let mut rng = rand::thread_rng();

    let alice = Identity::generate(&mut rng)?;
    let alice_id = format!("alice-{}", hex::encode(&alice.public_key_hash()[..4]));

    let bob = Identity::generate(&mut rng)?;
    let bob_id = format!("bob-{}", hex::encode(&bob.public_key_hash()[..4]));

    println!("Created identities:");
    println!("  Alice: {}", alice_id);
    println!("  Bob:   {}", bob_id);
    println!();

    // -------------------------------------------------------------------------
    // Step 2: Define a Policy
    // -------------------------------------------------------------------------
    // A policy is a collection of rules that define who can do what on which
    // resources. Each rule specifies:
    //   - peer_id: The identity this rule applies to
    //   - action: What operation is allowed (Read, Write, Execute, Delete, All)
    //   - resource: What resource pattern this applies to (supports wildcards)

    // Policy parameters:
    //   - name: Human-readable identifier
    //   - valid_duration: How long the policy is valid (in seconds)
    //   - current_time: Unix timestamp when the policy was created
    let current_time = 1700000000; // Fixed timestamp for reproducibility
    let valid_duration = 86400; // 24 hours

    let policy = Policy::new("file-access-policy", valid_duration, current_time)?
        // Rule 1: Alice can read any file under /data/
        .add_rule(PolicyRule::new(
            alice_id.clone(),
            Action::Read,
            Resource::File("/data/*".into()),
        ))?
        // Rule 2: Alice can write to her personal directory
        .add_rule(PolicyRule::new(
            alice_id.clone(),
            Action::Write,
            Resource::File("/home/alice/*".into()),
        ))?
        // Rule 3: Bob has full access to the /shared/ directory
        .add_rule(PolicyRule::new(
            bob_id.clone(),
            Action::All,
            Resource::File("/shared/*".into()),
        ))?;

    println!("Created policy: {}", policy.name());
    println!("  Rules: {}", policy.rules().len());
    println!("  Valid until: {} (Unix timestamp)", policy.valid_until());
    println!();

    // -------------------------------------------------------------------------
    // Step 3: Evaluate Access Requests
    // -------------------------------------------------------------------------
    // The PolicyAuthorizer evaluates whether a specific peer can perform a
    // specific action on a specific resource. It checks all rules and returns
    // true if at least one rule allows the access.

    let authorizer = PolicyAuthorizer::new(policy.rules());

    // Define test cases: (peer, action, resource, expected_result)
    let test_cases = [
        // Alice reading from /data/ - should be ALLOWED (Rule 1)
        (&alice_id, Action::Read, "/data/report.txt", true),
        // Alice writing to /data/ - should be DENIED (no rule allows this)
        (&alice_id, Action::Write, "/data/report.txt", false),
        // Alice writing to her home - should be ALLOWED (Rule 2)
        (&alice_id, Action::Write, "/home/alice/notes.txt", true),
        // Bob reading from /data/ - should be DENIED (no rule for Bob on /data/)
        (&bob_id, Action::Read, "/data/report.txt", false),
        // Bob writing to /shared/ - should be ALLOWED (Rule 3, Action::All)
        (&bob_id, Action::Write, "/shared/document.pdf", true),
        // Bob deleting from /shared/ - should be ALLOWED (Rule 3, Action::All)
        (&bob_id, Action::Delete, "/shared/old-file.txt", true),
        // Unknown user - should be DENIED (no rules match)
        (
            &"unknown-user".to_string(),
            Action::Read,
            "/data/file.txt",
            false,
        ),
    ];

    println!("Evaluating access requests:");
    println!();

    for (peer_id, action, resource_path, expected) in test_cases {
        let resource = Resource::File(resource_path.into());
        let allowed = authorizer.is_allowed(peer_id, &action, &resource);

        // Verify our expectations match the actual result
        let status = if allowed { "ALLOWED" } else { "DENIED" };
        let check = if allowed == expected {
            "OK"
        } else {
            "MISMATCH"
        };

        println!(
            "  {} {:?} {} -> {} [{}]",
            peer_id, action, resource_path, status, check
        );
    }

    println!();
    println!("-------------------------------------------");
    println!("Authorization flow completed successfully.");

    Ok(())
}

pub const fn version(&self) -> u64

Get the policy version

pub const fn issued_at(&self) -> u64

Get the issuance timestamp

pub const fn valid_until(&self) -> u64

Get the expiration timestamp

Examples found in repository

examples/simple_auth_flow.rs (line 77)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    println!("p47h Open Core - Simple Authorization Flow");
    println!("-------------------------------------------");
    println!();

    // -------------------------------------------------------------------------
    // Step 1: Create Identities
    // -------------------------------------------------------------------------
    // Each user or device in the network has a unique cryptographic identity.
    // The identity is an Ed25519 keypair. We use the public key hash as the
    // peer identifier for policy rules.

    let mut rng = rand::thread_rng();

    let alice = Identity::generate(&mut rng)?;
    let alice_id = format!("alice-{}", hex::encode(&alice.public_key_hash()[..4]));

    let bob = Identity::generate(&mut rng)?;
    let bob_id = format!("bob-{}", hex::encode(&bob.public_key_hash()[..4]));

    println!("Created identities:");
    println!("  Alice: {}", alice_id);
    println!("  Bob:   {}", bob_id);
    println!();

    // -------------------------------------------------------------------------
    // Step 2: Define a Policy
    // -------------------------------------------------------------------------
    // A policy is a collection of rules that define who can do what on which
    // resources. Each rule specifies:
    //   - peer_id: The identity this rule applies to
    //   - action: What operation is allowed (Read, Write, Execute, Delete, All)
    //   - resource: What resource pattern this applies to (supports wildcards)

    // Policy parameters:
    //   - name: Human-readable identifier
    //   - valid_duration: How long the policy is valid (in seconds)
    //   - current_time: Unix timestamp when the policy was created
    let current_time = 1700000000; // Fixed timestamp for reproducibility
    let valid_duration = 86400; // 24 hours

    let policy = Policy::new("file-access-policy", valid_duration, current_time)?
        // Rule 1: Alice can read any file under /data/
        .add_rule(PolicyRule::new(
            alice_id.clone(),
            Action::Read,
            Resource::File("/data/*".into()),
        ))?
        // Rule 2: Alice can write to her personal directory
        .add_rule(PolicyRule::new(
            alice_id.clone(),
            Action::Write,
            Resource::File("/home/alice/*".into()),
        ))?
        // Rule 3: Bob has full access to the /shared/ directory
        .add_rule(PolicyRule::new(
            bob_id.clone(),
            Action::All,
            Resource::File("/shared/*".into()),
        ))?;

    println!("Created policy: {}", policy.name());
    println!("  Rules: {}", policy.rules().len());
    println!("  Valid until: {} (Unix timestamp)", policy.valid_until());
    println!();

    // -------------------------------------------------------------------------
    // Step 3: Evaluate Access Requests
    // -------------------------------------------------------------------------
    // The PolicyAuthorizer evaluates whether a specific peer can perform a
    // specific action on a specific resource. It checks all rules and returns
    // true if at least one rule allows the access.

    let authorizer = PolicyAuthorizer::new(policy.rules());

    // Define test cases: (peer, action, resource, expected_result)
    let test_cases = [
        // Alice reading from /data/ - should be ALLOWED (Rule 1)
        (&alice_id, Action::Read, "/data/report.txt", true),
        // Alice writing to /data/ - should be DENIED (no rule allows this)
        (&alice_id, Action::Write, "/data/report.txt", false),
        // Alice writing to her home - should be ALLOWED (Rule 2)
        (&alice_id, Action::Write, "/home/alice/notes.txt", true),
        // Bob reading from /data/ - should be DENIED (no rule for Bob on /data/)
        (&bob_id, Action::Read, "/data/report.txt", false),
        // Bob writing to /shared/ - should be ALLOWED (Rule 3, Action::All)
        (&bob_id, Action::Write, "/shared/document.pdf", true),
        // Bob deleting from /shared/ - should be ALLOWED (Rule 3, Action::All)
        (&bob_id, Action::Delete, "/shared/old-file.txt", true),
        // Unknown user - should be DENIED (no rules match)
        (
            &"unknown-user".to_string(),
            Action::Read,
            "/data/file.txt",
            false,
        ),
    ];

    println!("Evaluating access requests:");
    println!();

    for (peer_id, action, resource_path, expected) in test_cases {
        let resource = Resource::File(resource_path.into());
        let allowed = authorizer.is_allowed(peer_id, &action, &resource);

        // Verify our expectations match the actual result
        let status = if allowed { "ALLOWED" } else { "DENIED" };
        let check = if allowed == expected {
            "OK"
        } else {
            "MISMATCH"
        };

        println!(
            "  {} {:?} {} -> {} [{}]",
            peer_id, action, resource_path, status, check
        );
    }

    println!();
    println!("-------------------------------------------");
    println!("Authorization flow completed successfully.");

    Ok(())
}

pub fn rules(&self) -> &[PolicyRule]

Get a reference to the policy rules

Examples found in repository

examples/simple_auth_flow.rs (line 76)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    println!("p47h Open Core - Simple Authorization Flow");
    println!("-------------------------------------------");
    println!();

    // -------------------------------------------------------------------------
    // Step 1: Create Identities
    // -------------------------------------------------------------------------
    // Each user or device in the network has a unique cryptographic identity.
    // The identity is an Ed25519 keypair. We use the public key hash as the
    // peer identifier for policy rules.

    let mut rng = rand::thread_rng();

    let alice = Identity::generate(&mut rng)?;
    let alice_id = format!("alice-{}", hex::encode(&alice.public_key_hash()[..4]));

    let bob = Identity::generate(&mut rng)?;
    let bob_id = format!("bob-{}", hex::encode(&bob.public_key_hash()[..4]));

    println!("Created identities:");
    println!("  Alice: {}", alice_id);
    println!("  Bob:   {}", bob_id);
    println!();

    // -------------------------------------------------------------------------
    // Step 2: Define a Policy
    // -------------------------------------------------------------------------
    // A policy is a collection of rules that define who can do what on which
    // resources. Each rule specifies:
    //   - peer_id: The identity this rule applies to
    //   - action: What operation is allowed (Read, Write, Execute, Delete, All)
    //   - resource: What resource pattern this applies to (supports wildcards)

    // Policy parameters:
    //   - name: Human-readable identifier
    //   - valid_duration: How long the policy is valid (in seconds)
    //   - current_time: Unix timestamp when the policy was created
    let current_time = 1700000000; // Fixed timestamp for reproducibility
    let valid_duration = 86400; // 24 hours

    let policy = Policy::new("file-access-policy", valid_duration, current_time)?
        // Rule 1: Alice can read any file under /data/
        .add_rule(PolicyRule::new(
            alice_id.clone(),
            Action::Read,
            Resource::File("/data/*".into()),
        ))?
        // Rule 2: Alice can write to her personal directory
        .add_rule(PolicyRule::new(
            alice_id.clone(),
            Action::Write,
            Resource::File("/home/alice/*".into()),
        ))?
        // Rule 3: Bob has full access to the /shared/ directory
        .add_rule(PolicyRule::new(
            bob_id.clone(),
            Action::All,
            Resource::File("/shared/*".into()),
        ))?;

    println!("Created policy: {}", policy.name());
    println!("  Rules: {}", policy.rules().len());
    println!("  Valid until: {} (Unix timestamp)", policy.valid_until());
    println!();

    // -------------------------------------------------------------------------
    // Step 3: Evaluate Access Requests
    // -------------------------------------------------------------------------
    // The PolicyAuthorizer evaluates whether a specific peer can perform a
    // specific action on a specific resource. It checks all rules and returns
    // true if at least one rule allows the access.

    let authorizer = PolicyAuthorizer::new(policy.rules());

    // Define test cases: (peer, action, resource, expected_result)
    let test_cases = [
        // Alice reading from /data/ - should be ALLOWED (Rule 1)
        (&alice_id, Action::Read, "/data/report.txt", true),
        // Alice writing to /data/ - should be DENIED (no rule allows this)
        (&alice_id, Action::Write, "/data/report.txt", false),
        // Alice writing to her home - should be ALLOWED (Rule 2)
        (&alice_id, Action::Write, "/home/alice/notes.txt", true),
        // Bob reading from /data/ - should be DENIED (no rule for Bob on /data/)
        (&bob_id, Action::Read, "/data/report.txt", false),
        // Bob writing to /shared/ - should be ALLOWED (Rule 3, Action::All)
        (&bob_id, Action::Write, "/shared/document.pdf", true),
        // Bob deleting from /shared/ - should be ALLOWED (Rule 3, Action::All)
        (&bob_id, Action::Delete, "/shared/old-file.txt", true),
        // Unknown user - should be DENIED (no rules match)
        (
            &"unknown-user".to_string(),
            Action::Read,
            "/data/file.txt",
            false,
        ),
    ];

    println!("Evaluating access requests:");
    println!();

    for (peer_id, action, resource_path, expected) in test_cases {
        let resource = Resource::File(resource_path.into());
        let allowed = authorizer.is_allowed(peer_id, &action, &resource);

        // Verify our expectations match the actual result
        let status = if allowed { "ALLOWED" } else { "DENIED" };
        let check = if allowed == expected {
            "OK"
        } else {
            "MISMATCH"
        };

        println!(
            "  {} {:?} {} -> {} [{}]",
            peer_id, action, resource_path, status, check
        );
    }

    println!();
    println!("-------------------------------------------");
    println!("Authorization flow completed successfully.");

    Ok(())
}

pub fn metadata(&self) -> &BTreeMap<String, String>

Get a reference to the metadata

pub fn new( name: impl Into<String>, valid_duration_secs: u64, current_time: u64, ) -> Result<Policy, PolicyError>

Create a new empty policy with version 1

Arguments

• name - Policy identifier
• valid_duration_secs - How long this policy is valid (in seconds)
• current_time - Current Unix timestamp (injected for purity/determinism)

Errors

Returns PolicyError::NameTooLong if name exceeds MAX_POLICY_NAME_LENGTH

Examples found in repository

examples/simple_auth_flow.rs (line 55)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    println!("p47h Open Core - Simple Authorization Flow");
    println!("-------------------------------------------");
    println!();

    // -------------------------------------------------------------------------
    // Step 1: Create Identities
    // -------------------------------------------------------------------------
    // Each user or device in the network has a unique cryptographic identity.
    // The identity is an Ed25519 keypair. We use the public key hash as the
    // peer identifier for policy rules.

    let mut rng = rand::thread_rng();

    let alice = Identity::generate(&mut rng)?;
    let alice_id = format!("alice-{}", hex::encode(&alice.public_key_hash()[..4]));

    let bob = Identity::generate(&mut rng)?;
    let bob_id = format!("bob-{}", hex::encode(&bob.public_key_hash()[..4]));

    println!("Created identities:");
    println!("  Alice: {}", alice_id);
    println!("  Bob:   {}", bob_id);
    println!();

    // -------------------------------------------------------------------------
    // Step 2: Define a Policy
    // -------------------------------------------------------------------------
    // A policy is a collection of rules that define who can do what on which
    // resources. Each rule specifies:
    //   - peer_id: The identity this rule applies to
    //   - action: What operation is allowed (Read, Write, Execute, Delete, All)
    //   - resource: What resource pattern this applies to (supports wildcards)

    // Policy parameters:
    //   - name: Human-readable identifier
    //   - valid_duration: How long the policy is valid (in seconds)
    //   - current_time: Unix timestamp when the policy was created
    let current_time = 1700000000; // Fixed timestamp for reproducibility
    let valid_duration = 86400; // 24 hours

    let policy = Policy::new("file-access-policy", valid_duration, current_time)?
        // Rule 1: Alice can read any file under /data/
        .add_rule(PolicyRule::new(
            alice_id.clone(),
            Action::Read,
            Resource::File("/data/*".into()),
        ))?
        // Rule 2: Alice can write to her personal directory
        .add_rule(PolicyRule::new(
            alice_id.clone(),
            Action::Write,
            Resource::File("/home/alice/*".into()),
        ))?
        // Rule 3: Bob has full access to the /shared/ directory
        .add_rule(PolicyRule::new(
            bob_id.clone(),
            Action::All,
            Resource::File("/shared/*".into()),
        ))?;

    println!("Created policy: {}", policy.name());
    println!("  Rules: {}", policy.rules().len());
    println!("  Valid until: {} (Unix timestamp)", policy.valid_until());
    println!();

    // -------------------------------------------------------------------------
    // Step 3: Evaluate Access Requests
    // -------------------------------------------------------------------------
    // The PolicyAuthorizer evaluates whether a specific peer can perform a
    // specific action on a specific resource. It checks all rules and returns
    // true if at least one rule allows the access.

    let authorizer = PolicyAuthorizer::new(policy.rules());

    // Define test cases: (peer, action, resource, expected_result)
    let test_cases = [
        // Alice reading from /data/ - should be ALLOWED (Rule 1)
        (&alice_id, Action::Read, "/data/report.txt", true),
        // Alice writing to /data/ - should be DENIED (no rule allows this)
        (&alice_id, Action::Write, "/data/report.txt", false),
        // Alice writing to her home - should be ALLOWED (Rule 2)
        (&alice_id, Action::Write, "/home/alice/notes.txt", true),
        // Bob reading from /data/ - should be DENIED (no rule for Bob on /data/)
        (&bob_id, Action::Read, "/data/report.txt", false),
        // Bob writing to /shared/ - should be ALLOWED (Rule 3, Action::All)
        (&bob_id, Action::Write, "/shared/document.pdf", true),
        // Bob deleting from /shared/ - should be ALLOWED (Rule 3, Action::All)
        (&bob_id, Action::Delete, "/shared/old-file.txt", true),
        // Unknown user - should be DENIED (no rules match)
        (
            &"unknown-user".to_string(),
            Action::Read,
            "/data/file.txt",
            false,
        ),
    ];

    println!("Evaluating access requests:");
    println!();

    for (peer_id, action, resource_path, expected) in test_cases {
        let resource = Resource::File(resource_path.into());
        let allowed = authorizer.is_allowed(peer_id, &action, &resource);

        // Verify our expectations match the actual result
        let status = if allowed { "ALLOWED" } else { "DENIED" };
        let check = if allowed == expected {
            "OK"
        } else {
            "MISMATCH"
        };

        println!(
            "  {} {:?} {} -> {} [{}]",
            peer_id, action, resource_path, status, check
        );
    }

    println!();
    println!("-------------------------------------------");
    println!("Authorization flow completed successfully.");

    Ok(())
}

pub fn new_unversioned(name: impl Into<String>) -> Result<Policy, PolicyError>

Create a policy without timestamps (for testing/legacy)

Errors

Returns PolicyError::NameTooLong if name exceeds MAX_POLICY_NAME_LENGTH

pub fn add_rule(self, rule: PolicyRule) -> Result<Policy, PolicyError>

Add a rule to this policy

Errors

Returns PolicyError::TooManyRules if adding this rule would exceed MAX_RULES_PER_POLICY

Examples found in repository

examples/simple_auth_flow.rs (lines 57-61)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    println!("p47h Open Core - Simple Authorization Flow");
    println!("-------------------------------------------");
    println!();

    // -------------------------------------------------------------------------
    // Step 1: Create Identities
    // -------------------------------------------------------------------------
    // Each user or device in the network has a unique cryptographic identity.
    // The identity is an Ed25519 keypair. We use the public key hash as the
    // peer identifier for policy rules.

    let mut rng = rand::thread_rng();

    let alice = Identity::generate(&mut rng)?;
    let alice_id = format!("alice-{}", hex::encode(&alice.public_key_hash()[..4]));

    let bob = Identity::generate(&mut rng)?;
    let bob_id = format!("bob-{}", hex::encode(&bob.public_key_hash()[..4]));

    println!("Created identities:");
    println!("  Alice: {}", alice_id);
    println!("  Bob:   {}", bob_id);
    println!();

    // -------------------------------------------------------------------------
    // Step 2: Define a Policy
    // -------------------------------------------------------------------------
    // A policy is a collection of rules that define who can do what on which
    // resources. Each rule specifies:
    //   - peer_id: The identity this rule applies to
    //   - action: What operation is allowed (Read, Write, Execute, Delete, All)
    //   - resource: What resource pattern this applies to (supports wildcards)

    // Policy parameters:
    //   - name: Human-readable identifier
    //   - valid_duration: How long the policy is valid (in seconds)
    //   - current_time: Unix timestamp when the policy was created
    let current_time = 1700000000; // Fixed timestamp for reproducibility
    let valid_duration = 86400; // 24 hours

    let policy = Policy::new("file-access-policy", valid_duration, current_time)?
        // Rule 1: Alice can read any file under /data/
        .add_rule(PolicyRule::new(
            alice_id.clone(),
            Action::Read,
            Resource::File("/data/*".into()),
        ))?
        // Rule 2: Alice can write to her personal directory
        .add_rule(PolicyRule::new(
            alice_id.clone(),
            Action::Write,
            Resource::File("/home/alice/*".into()),
        ))?
        // Rule 3: Bob has full access to the /shared/ directory
        .add_rule(PolicyRule::new(
            bob_id.clone(),
            Action::All,
            Resource::File("/shared/*".into()),
        ))?;

    println!("Created policy: {}", policy.name());
    println!("  Rules: {}", policy.rules().len());
    println!("  Valid until: {} (Unix timestamp)", policy.valid_until());
    println!();

    // -------------------------------------------------------------------------
    // Step 3: Evaluate Access Requests
    // -------------------------------------------------------------------------
    // The PolicyAuthorizer evaluates whether a specific peer can perform a
    // specific action on a specific resource. It checks all rules and returns
    // true if at least one rule allows the access.

    let authorizer = PolicyAuthorizer::new(policy.rules());

    // Define test cases: (peer, action, resource, expected_result)
    let test_cases = [
        // Alice reading from /data/ - should be ALLOWED (Rule 1)
        (&alice_id, Action::Read, "/data/report.txt", true),
        // Alice writing to /data/ - should be DENIED (no rule allows this)
        (&alice_id, Action::Write, "/data/report.txt", false),
        // Alice writing to her home - should be ALLOWED (Rule 2)
        (&alice_id, Action::Write, "/home/alice/notes.txt", true),
        // Bob reading from /data/ - should be DENIED (no rule for Bob on /data/)
        (&bob_id, Action::Read, "/data/report.txt", false),
        // Bob writing to /shared/ - should be ALLOWED (Rule 3, Action::All)
        (&bob_id, Action::Write, "/shared/document.pdf", true),
        // Bob deleting from /shared/ - should be ALLOWED (Rule 3, Action::All)
        (&bob_id, Action::Delete, "/shared/old-file.txt", true),
        // Unknown user - should be DENIED (no rules match)
        (
            &"unknown-user".to_string(),
            Action::Read,
            "/data/file.txt",
            false,
        ),
    ];

    println!("Evaluating access requests:");
    println!();

    for (peer_id, action, resource_path, expected) in test_cases {
        let resource = Resource::File(resource_path.into());
        let allowed = authorizer.is_allowed(peer_id, &action, &resource);

        // Verify our expectations match the actual result
        let status = if allowed { "ALLOWED" } else { "DENIED" };
        let check = if allowed == expected {
            "OK"
        } else {
            "MISMATCH"
        };

        println!(
            "  {} {:?} {} -> {} [{}]",
            peer_id, action, resource_path, status, check
        );
    }

    println!();
    println!("-------------------------------------------");
    println!("Authorization flow completed successfully.");

    Ok(())
}

pub fn with_metadata( self, key: impl Into<String>, value: impl Into<String>, ) -> Policy

Add metadata to this policy

pub fn is_allowed( &self, peer_id: &str, action: &Action, resource: &Resource, ) -> bool

Check if a peer is allowed to perform an action on a resource

This method delegates to PolicyAuthorizer (SRP - Single Responsibility Principle). The Policy struct focuses on construction and management, while authorization logic is handled by the dedicated PolicyAuthorizer.

pub fn validate(&self) -> Result<(), PolicyError>

Validate policy (check for conflicts, invalid rules, etc.)

Errors

Returns PolicyError::InvalidRule if:

• Policy name is empty
• Policy has no rules
• Any rule has an empty peer ID

pub fn from_toml(toml_str: &str) -> Result<Policy, PolicyError>

Load policy from TOML string

Errors

Returns an error if:

• TOML parsing fails
• Validation fails (see validate())

pub fn to_toml(&self) -> Result<String, PolicyError>

Serialize policy to TOML string

Errors

Returns PolicyError::SerializationError if TOML serialization fails

Trait Implementations

impl Clone for Policy

fn clone(&self) -> Policy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Policy

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Policy

fn deserialize<__D>( __deserializer: __D, ) -> Result<Policy, <__D as Deserializer<'de>>::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for Policy

fn serialize<__S>( &self, __serializer: __S, ) -> Result<<__S as Serializer>::Ok, <__S as Serializer>::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl TryFrom<PolicyRaw> for Policy

Convert PolicyRaw to Policy with validation

This is called automatically during deserialization due to the #[serde(try_from = "PolicyRaw")] attribute on Policy.

Errors

Returns PolicyError if validation fails:

• TooManyRules: More than MAX_RULES_PER_POLICY rules
• NameTooLong: Policy name exceeds MAX_POLICY_NAME_LENGTH
• InvalidRule: Other validation failures (empty name, no rules, etc.)

type Error = PolicyError

The type returned in the event of a conversion error.

fn try_from(raw: PolicyRaw) -> Result<Policy, PolicyError>

Performs the conversion.