Struct DefaultAuthorizationProvider 

pub struct DefaultAuthorizationProvider { /* private fields */ }

Default authorization provider implementation.

This provider implements a chain-of-responsibility pattern for authorization, delegating to specialized handlers:

1. UserAuthorizationHandler: Handles super-user bypass logic
2. AclAuthorizationHandler: Performs ACL-based permission checks

Architecture

The provider follows RocketMQ’s authorization model:

• Subject-based access control (users, roles, service accounts)
• Resource-level permissions (topics, groups, clusters)
• Action-based authorization (PUB, SUB, CREATE, UPDATE, DELETE, GET, LIST)
• Policy evaluation with ALLOW/DENY decisions
• IP whitelist support
• Default-deny security policy

Authorization Flow

1. Extract subject, resource, and actions from context
2. Check if user is a super-user (bypass authorization)
3. Query ACL metadata for the subject
4. Evaluate policies against the requested resource and actions
5. Check environment constraints (IP whitelist, time-based rules)
6. Apply decision (ALLOW/DENY) with default-deny policy
7. Audit log the authorization decision

Thread Safety

This implementation is thread-safe and can be shared across multiple async tasks. Internal state is protected using Arc and atomic operations.

Examples

use rocketmq_auth::DefaultAuthorizationProvider;
use std::sync::Arc;

let mut provider = DefaultAuthorizationProvider::new();
provider.initialize(config)?;

// Authorize a request
match provider.authorize(&context).await? {
    AuthorizationDecision::Allow => proceed(),
    AuthorizationDecision::Deny(reason) => reject(reason),
}

Implementations

impl DefaultAuthorizationProvider

pub fn new() -> Self

Create a new default authorization provider.

pub fn authentication_metadata_provider( &self, ) -> Option<Arc<UserMetadataHandle>>

pub fn authorization_metadata_provider(&self) -> Option<Arc<AclMetadataHandle>>

pub fn initialize_with_registry( &mut self, config: AuthConfig, provider_registry: ProviderRegistry, ) -> AuthServiceResult<()>

Trait Implementations

impl AuthorizationProvider for DefaultAuthorizationProvider

fn initialize(&mut self, config: AuthConfig) -> AuthServiceResult<()>

Initialize the authorization provider with configuration.

fn initialize_with_metadata( &mut self, config: AuthConfig, metadata_service: Option<Box<dyn Any + Send + Sync>>, ) -> AuthServiceResult<()>

Initialize with both configuration and optional metadata service.

async fn authorize( &self, context: &DefaultAuthorizationContext, ) -> AuthServiceResult<AuthorizationDecision>

Authorize an operation based on the given context.

fn new_contexts_from_remoting_command( &self, auth_context: &RemotingAuthContext, command: &RemotingCommand, ) -> AuthServiceResult<Vec<DefaultAuthorizationContext>>

Create authorization contexts from trusted remoting ingress facts and command.

fn new_contexts_from_grpc_metadata( &self, metadata: &dyn Any, message: &dyn Any, ) -> AuthServiceResult<Vec<DefaultAuthorizationContext>>

Create authorization contexts from gRPC metadata and request message.

impl Default for DefaultAuthorizationProvider

fn default() -> Self

Returns the “default value” for a type.