Struct PolicyEngine 

pub struct PolicyEngine { /* private fields */ }

A policy engine that evaluates manifest policies against auth context.

Policy allow expressions are evaluated with simple pattern matching:

• "auth.userId != null" — requires authenticated user
• "auth.userId == data.authorId" — requires user matches data field
• "auth.userId == input.authorId" — requires user matches input field
• "true" — always allowed

This is NOT a full expression evaluator. It handles the common patterns from the manifest contract. Complex expressions are treated as denied with a clear message.

Implementations

impl PolicyEngine

pub fn from_manifest(manifest: &AppManifest) -> Self

Build a policy engine from a manifest.

pub fn check_entity_read( &self, entity_name: &str, auth: &AuthContext, data: Option<&Value>, ) -> PolicyResult

Check if an entity read is allowed for the given auth context. data is the row being accessed (for field-level checks).

pub fn check_entity_write( &self, entity_name: &str, auth: &AuthContext, data: Option<&Value>, ) -> PolicyResult

Check if an entity write (insert/update/delete) is allowed.

data is the incoming payload (for insert/update) or the existing row (for delete). Delegates to the specific insert/update/delete path when the caller knows the operation; kept as a generic entry point for legacy call sites that don’t discriminate.

pub fn check_entity_insert( &self, entity_name: &str, auth: &AuthContext, data: Option<&Value>, ) -> PolicyResult

Check if an entity insert is allowed. data is the incoming row.

pub fn check_entity_update( &self, entity_name: &str, auth: &AuthContext, data: Option<&Value>, ) -> PolicyResult

Check if an entity update is allowed. data should be the existing row so ownership checks like data.authorId == auth.userId evaluate against truth instead of the incoming patch.

pub fn check_entity_delete( &self, entity_name: &str, auth: &AuthContext, data: Option<&Value>, ) -> PolicyResult

Check if an entity delete is allowed. data is the row about to be removed so delete-gates can look at the row’s author/tenant fields.

pub fn check_action( &self, action_name: &str, auth: &AuthContext, input: Option<&Value>, ) -> PolicyResult

Check if an action execution is allowed. input is the action input data.