Trait AuthorizationProvider 

pub trait AuthorizationProvider: Send + Sync {
    // Required methods
    fn initialize(&mut self, config: AuthConfig) -> AuthServiceResult<()>;
    async fn authorize(
        &self,
        context: &DefaultAuthorizationContext,
    ) -> AuthServiceResult<AuthorizationDecision>;

    // Provided methods
    fn initialize_with_metadata(
        &mut self,
        config: AuthConfig,
        metadata_service: Option<Box<dyn Any + Send + Sync>>,
    ) -> AuthServiceResult<()> { ... }
    fn new_contexts_from_grpc_metadata(
        &self,
        metadata: &dyn Any,
        message: &dyn Any,
    ) -> AuthServiceResult<Vec<DefaultAuthorizationContext>> { ... }
    fn new_contexts_from_remoting_command(
        &self,
        auth_context: &RemotingAuthContext,
        command: &RemotingCommand,
    ) -> AuthServiceResult<Vec<DefaultAuthorizationContext>> { ... }
}

Authorization provider trait.

This trait defines the core abstraction for authorization in RocketMQ. Implementors can provide different authorization strategies such as:

• ACL (Access Control Lists)
• RBAC (Role-Based Access Control)
• ABAC (Attribute-Based Access Control)
• Integration with external policy engines (e.g., Open Policy Agent)

Design Considerations

• Async-first: All methods are async to support asynchronous implementations
• Context-based: Authorization decisions are made based on DefaultAuthorizationContext
• Extensible: Implementations can maintain internal state via initialize
• Error handling: All failures are expressed through AuthServiceError

Examples

use rocketmq_auth::{AuthorizationProvider, AuthServiceResult};
use rocketmq_auth::DefaultAuthorizationContext;
use rocketmq_auth::AuthConfig;

struct MyAuthProvider;

impl AuthorizationProvider for MyAuthProvider {
    fn initialize(&mut self, config: AuthConfig) -> AuthServiceResult<()> {
        // Initialize provider with configuration
        Ok(())
    }

    async fn authorize(
        &self,
        context: &DefaultAuthorizationContext,
    ) -> AuthServiceResult<AuthorizationDecision> {
        // Implement authorization logic
        Ok(AuthorizationDecision::Allow)
    }
}

Required Methods

fn initialize(&mut self, config: AuthConfig) -> AuthServiceResult<()>

Initialize the authorization provider with configuration.

This method is called once during provider setup. Implementations should:

• Load configuration
• Initialize metadata services (database, cache, etc.)
• Establish connections to external services if needed
• Validate configuration parameters

Arguments

• config - Authorization configuration including provider-specific settings

Errors

Returns AuthFailureKind::InvalidConfiguration if configuration is invalid or initialization fails.

async fn authorize( &self, context: &DefaultAuthorizationContext, ) -> AuthServiceResult<AuthorizationDecision>

Authorize an operation based on the given context.

This is the core authorization method. Implementations should:

• Extract subject, resource, and action from context
• Evaluate authorization policies
• Check permissions and constraints (IP whitelist, time-based rules, etc.)
• Audit log the authorization decision

Arguments

• context - Authorization context containing subject, resource, actions, and metadata

Returns

• Ok(AuthorizationDecision::Allow) if authorization succeeds
• Ok(AuthorizationDecision::Deny(_)) if policy denies the request
• Err(AuthServiceError) if no decision can be made

Examples

let context = DefaultAuthorizationContext::new(
    subject,
    resource,
    vec![Action::Pub],
    source_ip
);
match provider.authorize(&context).await? {
    AuthorizationDecision::Allow => proceed(),
    AuthorizationDecision::Deny(reason) => reject(reason),
}

Provided Methods

fn initialize_with_metadata( &mut self, config: AuthConfig, metadata_service: Option<Box<dyn Any + Send + Sync>>, ) -> AuthServiceResult<()>

Initialize with both configuration and optional metadata service.

This is an extended version of initialize that accepts a metadata service supplier for advanced scenarios (e.g., shared metadata across components).

Default implementation delegates to initialize(config).

Arguments

• config - Authorization configuration
• metadata_service - Optional metadata service supplier

Errors

Returns AuthFailureKind::InvalidConfiguration if initialization fails.

fn new_contexts_from_grpc_metadata( &self, metadata: &dyn Any, message: &dyn Any, ) -> AuthServiceResult<Vec<DefaultAuthorizationContext>>

Create authorization contexts from gRPC metadata and request message.

Parses gRPC request metadata (headers) and the protocol buffer message to construct authorization contexts. Multiple contexts may be returned if the request involves multiple resources (e.g., batch operations).

Arguments

• metadata - gRPC metadata containing authentication tokens, source IP, etc.
• message - Protocol buffer message (e.g., SendMessageRequest)

Returns

List of authorization contexts to be evaluated. Empty list if no authorization needed.

Errors

Returns AuthFailureKind::InvalidInput if context cannot be constructed.

fn new_contexts_from_remoting_command( &self, auth_context: &RemotingAuthContext, command: &RemotingCommand, ) -> AuthServiceResult<Vec<DefaultAuthorizationContext>>

Create authorization contexts from trusted remoting ingress facts and command.

Parses typed ingress facts and RocketMQ remoting command to construct authorization contexts for TCP-based protocols.

Arguments

• auth_context - Trusted, read-only source and session facts
• command - RocketMQ remoting command containing request code and data

Returns

List of authorization contexts to be evaluated.

Errors

Returns AuthFailureKind::InvalidInput if context cannot be constructed.

Dyn Compatibility

This trait is not dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors

impl AuthorizationProvider for DefaultAuthorizationProvider