Trait AuthorizationMetadataProvider 

pub trait AuthorizationMetadataProvider: Send + Sync {
    // Required methods
    fn initialize(
        &mut self,
        config: AuthConfig,
        metadata_service: Option<Box<dyn Any + Send + Sync>>,
    ) -> AuthServiceResult<()>;
    fn shutdown(&mut self);
    async fn create_acl(&self, acl: Acl) -> AuthServiceResult<()>;
    async fn delete_acl<S: Subject + Send + Sync>(
        &self,
        subject: &S,
    ) -> AuthServiceResult<()>;
    async fn update_acl(&self, acl: Acl) -> AuthServiceResult<()>;
    fn get_acl<S: Subject + Send + Sync>(
        &self,
        subject: &S,
    ) -> impl Future<Output = AuthServiceResult<Option<Acl>>> + Send;
    async fn list_acl(
        &self,
        subject_filter: Option<&str>,
        resource_filter: Option<&str>,
    ) -> AuthServiceResult<Vec<Acl>>;
}

Authorization metadata provider trait.

This trait defines the interface for managing Access Control List (ACL) metadata in RocketMQ’s authorization system. It provides CRUD operations for ACLs and supports querying and filtering metadata.

Design Principles

• Async-first: All I/O operations are async to support scalable implementations
• Flexible storage: Implementations can use any backend (files, databases, remote services)
• Query support: Built-in filtering capabilities for listing ACLs
• Error handling: Comprehensive error reporting through AuthServiceError

Thread Safety

Implementations must be Send + Sync to support concurrent access from multiple RocketMQ components (broker, namesrv, proxy).

Examples

use rocketmq_auth::{AuthorizationMetadataProvider, AuthServiceResult};
use rocketmq_auth::Acl;
use rocketmq_auth::Subject;
use rocketmq_auth::AuthConfig;

struct MyMetadataProvider {
    // Storage implementation
}

impl AuthorizationMetadataProvider for MyMetadataProvider {
    fn initialize(
        &mut self,
        config: AuthConfig,
        metadata_service: Option<Box<dyn Any + Send + Sync>>,
    ) -> AuthServiceResult<()> {
        // Initialize storage backend
        Ok(())
    }

    async fn create_acl(&self, acl: Acl) -> AuthServiceResult<()> {
        // Store ACL in backend
        Ok(())
    }

    async fn get_acl<S: Subject>(&self, subject: &S) -> AuthServiceResult<Option<Acl>> {
        // Retrieve ACL from backend
        Ok(None)
    }

    // ... implement other methods
}

Required Methods

fn initialize( &mut self, config: AuthConfig, metadata_service: Option<Box<dyn Any + Send + Sync>>, ) -> AuthServiceResult<()>

Initialize the metadata provider with configuration.

This method is called once during provider setup. Implementations should:

• Initialize storage backend (open database, connect to remote service, etc.)
• Load initial configuration and validate parameters
• Set up caching layers if needed
• Establish connection pools or prepare resources

Arguments

• config - Authorization configuration containing provider-specific settings
• metadata_service - Optional metadata service for advanced integration scenarios. Can be downcast to implementation-specific types if needed.

Errors

Returns AuthFailureKind::InvalidConfiguration if:

• Configuration parameters are invalid
• Storage backend cannot be initialized
• Required resources are unavailable

Examples

let mut provider = MyMetadataProvider::new();
provider.initialize(auth_config, None)?;

fn shutdown(&mut self)

Shutdown the metadata provider and release resources.

This method should:

• Close database connections
• Flush pending writes
• Release file handles
• Cleanup temporary resources

Implementations should be idempotent (safe to call multiple times).

async fn create_acl(&self, acl: Acl) -> AuthServiceResult<()>

Create a new ACL for a subject.

If an ACL already exists for the subject, implementations should return an error. Use update_acl to modify existing ACLs.

Arguments

• acl - The ACL to create, containing subject information and policies

Errors

• AuthFailureKind::InvalidInput if ACL already exists
• AuthFailureKind::Unavailable if storage operation fails
• AuthFailureKind::InvalidInput if ACL data is malformed

Examples

let acl = Acl::of("user:alice", SubjectType::User, policy);
provider.create_acl(acl).await?;

async fn delete_acl<S: Subject + Send + Sync>( &self, subject: &S, ) -> AuthServiceResult<()>

Delete an ACL for a subject.

If the ACL does not exist, implementations should not return an error (idempotent operation).

Arguments

• subject - The subject whose ACL should be deleted

Errors

• AuthFailureKind::Unavailable if storage operation fails

Examples

let user = User::new("alice");
provider.delete_acl(&user).await?;

async fn update_acl(&self, acl: Acl) -> AuthServiceResult<()>

Update an existing ACL.

This operation completely replaces the existing ACL. To perform partial updates, implementations should first retrieve the ACL, modify it, then call this method.

Arguments

• acl - The updated ACL data

Errors

• AuthFailureKind::NotFound if ACL doesn’t exist
• AuthFailureKind::Unavailable if storage operation fails
• AuthFailureKind::InvalidInput if ACL data is malformed

Examples

let mut acl = provider.get_acl(&user).await?.unwrap();
acl.add_policy(new_policy);
provider.update_acl(acl).await?;

fn get_acl<S: Subject + Send + Sync>( &self, subject: &S, ) -> impl Future<Output = AuthServiceResult<Option<Acl>>> + Send

Get the ACL for a specific subject.

Returns None if no ACL exists for the subject.

Arguments

• subject - The subject to query

Returns

• Ok(Some(Acl)) if ACL exists
• Ok(None) if no ACL found
• Err(...) if operation fails

Errors

• AuthFailureKind::Unavailable if storage operation fails

Examples

let user = User::new("alice");
if let Some(acl) = provider.get_acl(&user).await? {
    println!("ACL found: {:?}", acl);
}

async fn list_acl( &self, subject_filter: Option<&str>, resource_filter: Option<&str>, ) -> AuthServiceResult<Vec<Acl>>

List ACLs with optional filtering.

This method supports filtering by subject name pattern and resource pattern. Both filters are optional and use substring matching.

Arguments

• subject_filter - Optional subject name filter (substring match)
• resource_filter - Optional resource name filter (substring match)

Returns

A vector of matching ACLs. Empty vector if no matches found.

Errors

• AuthFailureKind::Unavailable if storage operation fails

Examples

// List all ACLs
let all_acls = provider.list_acl(None, None).await?;

// Filter by subject
let user_acls = provider.list_acl(Some("user:"), None).await?;

// Filter by resource
let topic_acls = provider.list_acl(None, Some("Topic:test")).await?;

// Both filters
let filtered = provider.list_acl(Some("user:alice"), Some("Topic:")).await?;

Dyn Compatibility

This trait is not dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors

impl AuthorizationMetadataProvider for LocalAuthorizationMetadataProvider

impl AuthorizationMetadataProvider for NoopMetadataProvider