pub trait Actor:
Send
+ Sync
+ 'static { }Expand description
Anything a gate can authorize.
Not Authenticatable — deliberately. A gate
answers may this actor do this, and in a service with machine callers the
actor is often not a person:
| The actor | Where it comes from |
|---|---|
| a user | a session or a bearer token |
| an API client | the client-credentials grant, where there is no user at all |
| a cloud principal | an assumed IAM role, an STS identity |
| a service account | a Kubernetes token, a signed internal request |
Requiring an actor to be authenticatable made two of those unrepresentable: an API client has no password hash and no session, and inventing one so it could be authorized is the kind of shape that ends in a machine identity accidentally being able to log in.
There is nothing to implement. This is a blanket alias over the bounds a
gate genuinely needs — Send + Sync + 'static — so every existing
Gate<User> keeps working untouched and Gate<ApiClient> starts working
without ApiClient having to pretend to be a person.
Dyn Compatibility§
This trait is dyn compatible.
In older versions of Rust, dyn compatibility was called "object safety".