Struct AuthorizationMetadataManagerImpl 

pub struct AuthorizationMetadataManagerImpl { /* private fields */ }

Production implementation of Authorization Metadata Manager.

This struct manages ACL (Access Control List) operations by coordinating authorization and authentication metadata providers. It provides a unified, type-safe API with comprehensive validation for all ACL operations.

Provider Coordination

• AuthorizationMetadataProvider: Handles ACL persistence (create, update, delete, query)
• AuthenticationMetadataProvider: Validates subject existence for USER subjects

Examples

use rocketmq_auth::AuthorizationMetadataManagerImpl;
use rocketmq_auth::AuthConfig;
use rocketmq_auth::LocalAuthorizationMetadataProvider;
use std::sync::Arc;

// Create manager with local provider
let mut provider = LocalAuthorizationMetadataProvider::new();
provider.initialize(AuthConfig::default(), None)?;

let manager = AuthorizationMetadataManagerImpl::new(Arc::new(provider), None);

// Create ACL for a user
let acl = Acl::of("user:alice", SubjectType::User, policy);
manager.create_acl(acl).await?;

// Query ACL
let user = UserSubject::new("alice");
if let Some(acl) = manager.get_acl(&user).await? {
    println!("ACL found: {:?}", acl);
}

// Cleanup
manager.shutdown().await;

Implementations

impl AuthorizationMetadataManagerImpl

pub fn new( authorization_provider: Arc<LocalAuthorizationMetadataProvider>, authentication_provider: Option<Arc<dyn AuthenticationMetadataProvider>>, ) -> Self

Create a new Authorization Metadata Manager with providers.

Arguments

• authorization_provider - Provider for ACL storage (required, must be initialized)
• authentication_provider - Optional provider for subject validation

Examples

let auth_provider = Arc::new(LocalAuthorizationMetadataProvider::new());
let manager = AuthorizationMetadataManagerImpl::new(auth_provider, None);

pub fn with_registry(registry: &ProviderRegistry) -> Self

pub fn from_config(config: &AuthConfig) -> AuthServiceResult<Self>

Create a manager from configuration.

This factory method instantiates providers based on configuration.

Arguments

• config - Authorization configuration

Errors

Returns AuthFailureKind::InvalidConfiguration if:

• Provider initialization fails
• Required configuration is missing
• Configuration contains invalid values

pub async fn shutdown(&mut self)

Shutdown the manager and release resources.

This method:

• Calls shutdown on authentication provider (if present)
• Calls shutdown on authorization provider
• Flushes pending operations
• Releases system resources

This method is idempotent (safe to call multiple times).

Examples

manager.shutdown().await;

pub async fn shutdown_until( &self, deadline: ShutdownDeadline, ) -> AuthServiceResult<()>

pub async fn create_acl(&self, acl: Acl) -> AuthServiceResult<()>

Create a new ACL.

This method performs the following steps:

1. Validate ACL structure (subject, policies, entries, resources, actions)
2. Initialize default policy types (sets CUSTOM if not specified)
3. Verify subject exists (for USER type, via authentication provider)
4. Check for existing ACL:
   • If exists: merge policies and update
   • If not: create new ACL

Arguments

• acl - The ACL to create

Errors

• AuthFailureKind::InvalidInput if ACL validation fails
• AuthFailureKind::NotFound if subject doesn’t exist
• AuthFailureKind::Unavailable if storage operation fails

Examples

let acl = Acl::of("user:alice", SubjectType::User, policy);
manager.create_acl(acl).await?;

pub async fn update_acl(&self, acl: Acl) -> AuthServiceResult<()>

Update an existing ACL.

This method:

1. Validates the ACL structure
2. Initializes default policy types
3. Verifies the subject exists
4. Merges with existing ACL or creates new if not found

Arguments

• acl - The ACL with updated policies

Errors

• AuthFailureKind::InvalidInput if ACL validation fails
• AuthFailureKind::NotFound if subject doesn’t exist
• AuthFailureKind::Unavailable if storage operation fails

Examples

let mut acl = manager.get_acl(&user).await?.unwrap();
acl.add_policy(new_policy);
manager.update_acl(acl).await?;

pub async fn delete_acl<S: Subject + Send + Sync>( &self, subject: &S, ) -> AuthServiceResult<()>

Delete an ACL for a subject.

This is a convenience method that deletes the entire ACL.

Arguments

• subject - The subject whose ACL should be deleted

Errors

• AuthFailureKind::NotFound if subject doesn’t exist
• AuthFailureKind::InvalidInput if ACL doesn’t exist
• AuthFailureKind::Unavailable if storage operation fails

Examples

let user = UserSubject::new("alice");
manager.delete_acl(&user).await?;

pub async fn delete_acl_with_filter<S: Subject + Send + Sync>( &self, subject: &S, policy_type: Option<PolicyType>, resource: Option<&Resource>, ) -> AuthServiceResult<()>

Delete an ACL or specific policy entries.

This method provides fine-grained deletion:

• If resource is specified: deletes specific policy entry for that resource
• If only policy_type is specified: deletes entire policy of that type
• If neither specified: deletes entire ACL

Arguments

• subject - The subject whose ACL to modify
• policy_type - Optional policy type filter (defaults to CUSTOM)
• resource - Optional resource to delete from the policy

Errors

• AuthFailureKind::NotFound if subject doesn’t exist
• AuthFailureKind::InvalidInput if ACL doesn’t exist
• AuthFailureKind::Unavailable if storage operation fails

Examples

// Delete entire ACL
manager.delete_acl_with_filter(&user, None, None).await?;

// Delete a specific policy type
manager.delete_acl_with_filter(&user, Some(PolicyType::Custom), None).await?;

// Delete specific resource from policy
let resource = Resource::of_topic("test-topic");
manager.delete_acl_with_filter(&user, Some(PolicyType::Custom), Some(&resource)).await?;

pub async fn get_acl<S: Subject + Send + Sync>( &self, subject: &S, ) -> AuthServiceResult<Option<Acl>>

Get the ACL for a subject.

Arguments

• subject - The subject to query

Returns

• Ok(Some(Acl)) if ACL exists
• Ok(None) if no ACL found
• Err(...) if operation fails

Errors

• AuthFailureKind::NotFound if subject doesn’t exist
• AuthFailureKind::Unavailable if storage operation fails

Examples

let user = UserSubject::new("alice");
if let Some(acl) = manager.get_acl(&user).await? {
    println!("Found ACL with {} policies", acl.policies().len());
}

pub async fn list_acl( &self, subject_filter: Option<&str>, resource_filter: Option<&str>, ) -> AuthServiceResult<Vec<Acl>>

List ACLs with optional filtering.

Arguments

• subject_filter - Optional subject name filter (substring match)
• resource_filter - Optional resource name filter (substring match)

Returns

A vector of matching ACLs. Empty vector if no matches found.

Errors

• AuthFailureKind::Unavailable if storage operation fails

Examples

// List all ACLs
let all_acls = manager.list_acl(None, None).await?;

// Filter by subject
let user_acls = manager.list_acl(Some("user:"), None).await?;

// Filter by resource
let topic_acls = manager.list_acl(None, Some("Topic:test")).await?;