Crate pgroles_cli 

Testable CLI logic for pgroles.

All pure functions that don’t require a live database connection live here. The binary (main.rs) delegates to these, making validation, plan formatting, and output rendering fully unit-testable.

Modules

candidate

pgroles candidate — file, list, inspect and diff PostgresPolicyCandidate objects.

Structs

PlanSummary

Summary statistics for a plan.

ValidatedBundle

The result of successfully validating a composed policy bundle.

ValidatedManifest

The result of successfully validating a manifest.

Constants

RENDERED_MANIFEST_SCHEMA

Schema identifier for the YAML body emitted by render-bundle. Bumped only on incompatible changes to the PolicyManifest serialization shape. Recorded in the header so --check failures after a pgroles upgrade can be diagnosed as “schema bump → re-render required” rather than mystery drift, and so consumers parsing the rendered file can detect mismatches.

Functions

apply_role_retirements

Insert explicit retirement actions before any matching role drops.

compute_plan

Compute the list of changes needed to bring current state to desired state.

format_bundle_plan_json

Format a bundle plan as JSON with ownership annotations for each change.

format_bundle_validation_result

Format bundle validation results for human-readable output.

format_managed_scope_summary

Format a composed managed scope for human-readable debug output.

format_plan_json

Format a plan as JSON for machine consumption.

format_plan_sql

Format a plan as SQL statements.

format_plan_sql_with_context

Format a plan as SQL statements using an explicit SQL context.

format_rendered_bundle

Render a validated bundle as a single composed manifest YAML.

format_role_graph_summary

Format a RoleGraph as a human-readable summary.

format_validation_result

Format validation results for human-readable output.

inject_password_changes

Inject SetPassword changes into a plan for roles with resolved passwords.

parse

Parse and validate a YAML string into a PolicyManifest.

parse_and_expand

Parse, validate, and expand a manifest YAML string into an ExpandedManifest.

planned_role_drops

Collect the role names that the current plan intends to drop.

read_manifest_file

Read a manifest file from disk and return the raw YAML string.

resolve_passwords

Resolve password sources from environment variables for roles that declare them.

validate_bundle_file

Load, validate, and compose a policy bundle from disk.

validate_manifest

Full validation: parse, expand, and build a RoleGraph from a manifest string. Returns the expanded manifest and the desired RoleGraph.