Struct Gate 

pub struct Gate<A: Actor> { /* private fields */ }

A registry of authorization abilities.

Checks are synchronous. An authorization decision that needs a database round-trip is a sign the subject should have been loaded already — the controller has the record in hand by the time it authorizes, and re-fetching it inside the check would double every query.

Implementations

impl<A: Actor> Gate<A>

pub fn new() -> Self

A gate with no abilities. Everything is denied until defined.

pub fn define<S, F>(self, ability: impl Into<String>, check: F) -> Self

where S: 'static, F: Fn(&A, Option<&S>) -> bool + Send + Sync + 'static,

Define an ability taking the actor and an optional subject.

pub fn define_simple<F>(self, ability: impl Into<String>, check: F) -> Self

where F: Fn(&A) -> bool + Send + Sync + 'static,

Define an ability that ignores its subject.

pub fn before<F>(self, check: F) -> Self

where F: Fn(&A, &str) -> Option<bool> + Send + Sync + 'static,

Register a check that runs before every ability.

Returning Some(true) grants regardless of the ability — the “an admin may do anything” rule, in one place instead of at the top of every check. None defers.

pub fn allows<S: 'static>( &self, ability: &str, actor: &A, subject: Option<&S>, ) -> bool

Whether actor may perform ability on subject.

An undefined ability is denied. Defaulting to “allow” would mean a typo in an ability name silently opens a hole.

pub fn denies<S: 'static>( &self, ability: &str, actor: &A, subject: Option<&S>, ) -> bool

The inverse of allows.

pub fn allows_any(&self, ability: &str, actor: &A) -> bool

Whether actor may perform ability, with no subject.

pub fn authorize<S: 'static>( &self, ability: &str, actor: &A, subject: Option<&S>, ) -> Result<()>

Grant, or fail with a 403.

pub fn has(&self, ability: &str) -> bool

Whether ability has been defined.

pub fn abilities(&self) -> Vec<&str>

Every defined ability, sorted.

Trait Implementations

impl<A: Actor> Debug for Gate<A>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<A: Actor> Default for Gate<A>

fn default() -> Self

Returns the “default value” for a type.