Crate praetor 

Praetor is a small, strongly typed authorization library for Rust built around composable can and cannot rules.

Praetor defines authorization mechanics, not an application’s authorization model. Actions, subjects, claims, roles, permissions, and JWT formats all belong to the consuming application.

use praetor::{Ability, AbilitySubject};

#[derive(Clone, Copy, PartialEq, Eq)]
enum Action { Read, Update }

#[derive(Clone, Copy, PartialEq, Eq)]
enum Subject { Message }

struct Claims { user_id: u64 }

struct Message { author_id: u64, deleted: bool }
impl AbilitySubject<Subject> for Message {
    fn subject_type(&self) -> Subject { Subject::Message }
}

let ability = Ability::builder(Claims { user_id: 1 })
    .can(Action::Read, Subject::Message)
    .can_if(Action::Update, Subject::Message, |claims, m: &Message| {
        claims.user_id == m.author_id
    })
    .cannot_if(Action::Read, Subject::Message, |_, m: &Message| m.deleted)
    .build();

let mine = Message { author_id: 1, deleted: false };
assert!(ability.can(Action::Read, Subject::Message)); // unconditional allow
assert!(ability.can(Action::Update, &mine));          // predicate: author matches
assert!(ability.authorize(Action::Update, &mine).is_ok());

Predicates are ordinary Rust closures. Evaluation is default deny, and the last matching rule wins.

Modules

axumaxum

Axum integration (enabled by the axum feature).

Structs

Ability

An immutable set of authorization rules evaluated against a fixed set of claims.

AbilityBuilder

Builds an Ability by accumulating rules.

Forbidden

Returned by Ability::authorize when a request is denied.

ResourceTarget

Marker selecting the resource-reference branch of IntoTarget.

SubjectTarget

Marker selecting the subject-value branch of IntoTarget.

Target

An authorization target resolved to its subject, optionally carrying the concrete resource instance for conditional-rule evaluation.

Enums

Effect

Whether a matching rule grants or denies access.

Traits

AbilitySubject

Associates a concrete resource type with its logical subject S.

IntoTarget

Resolves an authorization target into a Target.