Struct AuthorizationMetadataManager 

pub struct AuthorizationMetadataManager { /* private fields */ }

Authorization metadata manager.

This struct manages ACL (Access Control List) operations by coordinating two metadata providers:

• AuthorizationMetadataProvider: Persists ACL data
• AuthenticationMetadataProvider: Validates USER subject existence

Examples

use rocketmq_auth::AuthorizationMetadataManager;
use rocketmq_auth::AuthConfig;

// Create manager with configuration
let config = AuthConfig::default();
let manager = AuthorizationMetadataManager::new(config)?;

// Create ACL for a user
let acl = Acl::of("user:alice", SubjectType::User, policy);
manager.create_acl(acl).await?;

// Retrieve ACL
let user = User::of("alice");
if let Some(acl) = manager.get_acl(&user).await? {
    println!("ACL found: {:?}", acl);
}

// Shutdown
manager.shutdown().await;

Implementations

impl AuthorizationMetadataManager

pub fn with_providers( authorization_provider: Arc<LocalAuthorizationMetadataProvider>, authentication_provider: Option<Arc<dyn AuthenticationMetadataProvider>>, ) -> Self

Create a new manager with the given providers.

Arguments

• authorization_provider - Provider for ACL storage operations
• authentication_provider - Optional provider for subject validation

Examples

let auth_provider = Arc::new(LocalAuthorizationMetadataProvider::new(...));
let manager = AuthorizationMetadataManager::with_providers(
    auth_provider,
    None
);

pub fn with_registry(registry: &ProviderRegistry) -> Self

pub fn new(config: AuthConfig) -> AuthServiceResult<Self>

Create a manager from configuration.

This will instantiate providers based on the configuration.

Arguments

• config - Authorization configuration

Errors

Returns AuthFailureKind::InvalidConfiguration if provider initialization fails

pub async fn shutdown(&mut self)

Shutdown the manager and release resources.

Managers created from configuration close their providers. Managers borrowing a registry leave provider finalization to its runtime owner.

pub async fn shutdown_until( &self, deadline: ShutdownDeadline, ) -> AuthServiceResult<()>

pub async fn create_acl(&self, acl: Acl) -> AuthServiceResult<()>

Create a new ACL.

This method:

1. Validates the ACL structure
2. Initializes default policy types
3. Verifies the subject exists (if authentication provider is available)
4. Checks if ACL already exists
5. Creates or updates the ACL

Arguments

• acl - The ACL to create

Errors

• AuthFailureKind::NotFound if subject doesn’t exist
• AuthFailureKind::InvalidInput if ACL validation fails
• AuthFailureKind::InvalidInput if ACL already exists (and merge fails)
• AuthFailureKind::Unavailable if storage operation fails

Examples

let acl = Acl::of("user:alice", SubjectType::User, policy);
manager.create_acl(acl).await?;

pub async fn update_acl(&self, acl: Acl) -> AuthServiceResult<()>

Update an existing ACL.

This method:

1. Validates the ACL structure
2. Initializes default policy types
3. Verifies the subject exists
4. Creates the ACL if it doesn’t exist, or merges with existing ACL

Arguments

• acl - The ACL with updated policies

Errors

• AuthFailureKind::NotFound if subject doesn’t exist
• AuthFailureKind::InvalidInput if ACL validation fails
• AuthFailureKind::Unavailable if storage operation fails

Examples

let mut acl = manager.get_acl(&user).await?.unwrap();
acl.add_policy(new_policy);
manager.update_acl(acl).await?;

pub async fn delete_acl<S: Subject + Send + Sync>( &self, subject: &S, ) -> AuthServiceResult<()>

Delete an ACL for a subject.

This is a convenience method that calls delete_acl_with_filter with no filters.

Arguments

• subject - The subject whose ACL should be deleted

Errors

• AuthFailureKind::NotFound if subject doesn’t exist
• AuthFailureKind::Unavailable if storage operation fails

pub async fn delete_acl_with_filter<S: Subject + Send + Sync>( &self, subject: &S, policy_type: Option<PolicyType>, resource: Option<&Resource>, ) -> AuthServiceResult<()>

Delete an ACL or specific policy entries.

This method provides fine-grained deletion:

• If resource is specified: deletes specific policy entry for that resource
• If only policy_type is specified: deletes entire policy of that type
• If neither specified: deletes entire ACL

Arguments

• subject - The subject whose ACL to modify
• policy_type - Optional policy type filter (defaults to CUSTOM if resource specified)
• resource - Optional resource to delete from the policy

Errors

• AuthFailureKind::NotFound if subject doesn’t exist
• AuthFailureKind::InvalidInput if ACL doesn’t exist
• AuthFailureKind::Unavailable if storage operation fails

Examples

// Delete entire ACL
manager.delete_acl_with_filter(&user, None, None).await?;

// Delete a specific policy type
manager.delete_acl_with_filter(&user, Some(PolicyType::CUSTOM), None).await?;

// Delete specific resource from policy
let resource = Resource::of_topic("test-topic");
manager.delete_acl_with_filter(&user, Some(PolicyType::CUSTOM), Some(&resource)).await?;

pub async fn get_acl<S: Subject + Send + Sync>( &self, subject: &S, ) -> AuthServiceResult<Option<Acl>>

Get the ACL for a subject.

Arguments

• subject - The subject to query

Returns

• Ok(Some(Acl)) if ACL exists
• Ok(None) if no ACL found
• Err(...) if operation fails

Errors

• AuthFailureKind::NotFound if subject doesn’t exist
• AuthFailureKind::Unavailable if storage operation fails

Examples

let user = User::of("alice");
if let Some(acl) = manager.get_acl(&user).await? {
    println!("Found ACL with {} policies", acl.policies().len());
}

pub async fn list_acl( &self, subject_filter: Option<&str>, resource_filter: Option<&str>, ) -> AuthServiceResult<Vec<Acl>>

List ACLs with optional filtering.

Arguments

• subject_filter - Optional subject name filter (substring match)
• resource_filter - Optional resource name filter (substring match)

Returns

A vector of matching ACLs. Empty vector if no matches found.

Errors

• AuthFailureKind::Unavailable if storage operation fails

Examples

// List all ACLs
let all_acls = manager.list_acl(None, None).await?;

// Filter by subject
let user_acls = manager.list_acl(Some("user:"), None).await?;

// Filter by resource
let topic_acls = manager.list_acl(None, Some("Topic:test")).await?;