road_runner_common/
capabilities.rs

1//! Account-level capabilities (entitlements) shared across services.
2//!
3//! Distinct from API-key [`crate::permissions`] (per key) and roles (operational). A user is
4//! granted a default set at registration; the platform admin can restrict/grant per user. The
5//! effective set is computed in the identity service and propagated to every service as the
6//! signed `x-auth-capabilities` header; enforcement is per-endpoint via
7//! [`crate::UserContext::require_capability`].
8
9/// Read account data (balances / orders / history).
10pub const ACCOUNT_READ: &str = "account.read";
11/// Place / cancel spot orders.
12pub const SPOT_TRADE: &str = "spot.trade";
13/// Crypto deposits.
14pub const DEPOSIT_CRYPTO: &str = "deposit.crypto";
15/// Crypto withdrawals.
16pub const WITHDRAW_CRYPTO: &str = "withdraw.crypto";
17/// Internal transfers.
18pub const TRANSFER_INTERNAL: &str = "transfer.internal";
19/// Create / use API keys.
20pub const API_ACCESS: &str = "api.access";
21/// Earn / staking.
22pub const EARN_STAKE: &str = "earn.stake";
23/// Fiat deposits (off by default).
24pub const FIAT_DEPOSIT: &str = "fiat.deposit";
25/// Fiat withdrawals (off by default).
26pub const FIAT_WITHDRAW: &str = "fiat.withdraw";
27
28/// Every known capability, in canonical order.
29pub const ALL: &[&str] = &[
30    ACCOUNT_READ,
31    SPOT_TRADE,
32    DEPOSIT_CRYPTO,
33    WITHDRAW_CRYPTO,
34    TRANSFER_INTERNAL,
35    API_ACCESS,
36    EARN_STAKE,
37    FIAT_DEPOSIT,
38    FIAT_WITHDRAW,
39];
40
41/// Capabilities granted to every user at registration (everything except fiat, which the admin
42/// enables explicitly).
43pub const DEFAULT_ON: &[&str] = &[
44    ACCOUNT_READ,
45    SPOT_TRADE,
46    DEPOSIT_CRYPTO,
47    WITHDRAW_CRYPTO,
48    TRANSFER_INTERNAL,
49    API_ACCESS,
50    EARN_STAKE,
51];
52
53/// True when `cap` is a recognized capability.
54pub fn is_valid(cap: &str) -> bool {
55    ALL.contains(&cap)
56}
57
58/// True when `cap` is on by default at registration.
59pub fn is_default_on(cap: &str) -> bool {
60    DEFAULT_ON.contains(&cap)
61}
road_runner_common/capabilities.rs

road_runner_common/
capabilities.rs
