Crate rocketmq_security_api 

Runtime-neutral security contracts.

Re-exports

pub use layered_authorization::combine_layered_authorization;

pub use layered_authorization::AuthorizationDecision;

pub use layered_authorization::AuthorizationDenial;

pub use layered_authorization::DetailedDecision;

pub use layered_authorization::IngressDecision;

pub use layered_authorization::IngressPolicy;

pub use layered_authorization::LayerEvaluation;

pub use layered_authorization::LayerFailureKind;

pub use layered_authorization::LayerRequirement;

pub use maintenance::MaintenanceAuthorizationContext;

pub use maintenance::MaintenanceAuthorizationDenial;

pub use maintenance::MaintenanceAuthorizationGrant;

pub use maintenance::MaintenanceAuthorizer;

pub use maintenance::MaintenanceCapability;

pub use maintenance::MaintenancePolicy;

pub use maintenance::MaintenancePrincipalBinding;

pub use maintenance::MaintenanceRequestClass;

pub use maintenance::MaintenanceResourceBudget;

pub use maintenance::MaintenanceRole;

pub use maintenance::MaintenanceRoleGrant;

pub use maintenance::ValidatedMaintenancePolicy;

pub use maintenance::MAINTENANCE_POLICY_SCHEMA_VERSION;

pub use resource_pattern::ResourcePattern;

pub use resource_type::ResourceType;

pub use secret_provider::SecretAccess;

pub use secret_provider::SecretMaterial;

pub use secret_provider::SecretName;

pub use secret_provider::SecretPersistence;

pub use secret_provider::SecretProvider;

pub use secret_provider::SecretProviderCapabilities;

pub use secret_provider::SecretProviderId;

pub use secret_provider::SecretVersion;

pub use secret_provider::SecretVersioning;

pub use secret_provider::VersionedSecret;

pub use secure_deployment::validate_deployment_security;

pub use secure_deployment::validate_security_bootstrap_from_env;

pub use secure_deployment::BootstrapReadinessView;

pub use secure_deployment::DeploymentOrigin;

pub use secure_deployment::DeploymentSecurityConfigView;

pub use secure_deployment::DeploymentSecurityFailure;

pub use secure_deployment::DeploymentSecurityReport;

pub use secure_deployment::SecurityBootstrap;

pub use secure_deployment::SecurityBootstrapConfig;

pub use secure_deployment::SecurityBootstrapMaterial;

pub use secure_deployment::SecurityBootstrapOutcome;

pub use secure_deployment::SecurityBootstrapProfile;

pub use secure_deployment::SecurityMigrationStatus;

pub use secure_deployment::SecurityProfileResolution;

pub use secure_deployment::SecurityProfileSelection;

pub use secure_deployment::ValidatedSecurityBootstrap;

pub use secure_deployment::MOUNTED_FILES_SECRET_PROVIDER;

pub use secure_deployment::SECURITY_ADMIN_IDENTITY_ENV;

pub use secure_deployment::SECURITY_PROFILE_ENV;

pub use secure_deployment::SECURITY_REQUEST_POLICY_ENV;

pub use secure_deployment::SECURITY_SECRET_PROVIDER_ENV;

pub use secure_deployment::SECURITY_TLS_CERT_ENV;

pub use secure_deployment::SECURITY_TLS_KEY_ENV;

pub use secure_deployment::SECURITY_TRUST_ANCHOR_ENV;

Modules

layered_authorization

Layered ingress and detailed authorization contracts. Runtime-neutral contracts for staged authorization.

maintenance

Runtime-neutral, fail-closed authorization for maintenance operations.

resource_pattern

Resource pattern types and operations.

resource_type

Resource type types and operations.

secret_provider

Runtime-neutral contracts for injected secret providers.

secure_deployment

Pure profile resolution and readiness contracts for secure deployments.

Structs

AuthenticatedRequestContext

Policy input for which the principal invariant has been established.

PeerInfo

Read-only peer metadata made available to security policies.

Principal

Authenticated identity without credential material.

RequestContext

Complete security input before authentication has been required.

Resource

Resource selected for a policy decision.

Secret

Sensitive value whose debug representation is always redacted.

SecretFilePermissions

Portable projection of secret-file permissions.

SecurityConfigView

Borrowed configuration input for a side-effect-free readiness check.

SecurityProviderError

Operational failure at a security-provider boundary.

SecurityReadinessReport

Result of a side-effect-free security configuration dry run.

SecurityRequestView

Minimal borrowed projection of an inbound or outbound request.

Signature

Redacted signature fields produced by an outbound signer.

Enums

Action

Security-relevant operation requested on a resource.

DeploymentProfile

Deployment security profile selected by configuration.

MaintenancePolicyRule

Closed semantic rules for maintenance policies.

ResourceKind

Protected resource category.

SecurityContractViolation

Deterministic violation of a security input, configuration, or policy contract.

SecurityIdentifierRule

Closed validation rules for provider identifiers and logical secret names.

SecurityOperation

Closed operation performed at a security-provider boundary.

SecurityProviderFailure

Stable category of a security provider failure.

SecurityReadinessFailure

Stable reasons why a profile is not ready.

Traits

OutboundSigner

Contract implemented by transport-specific outbound signers in rocketmq-auth.

RequestPolicy

Authorization policy that can only evaluate authenticated requests.

Functions

evaluate_request

Applies the mandatory fail-closed identity gate before invoking a policy.

read_secret_file

Opens, permission-checks and reads a secret using the same file handle.

validate_security_config

Validates a configuration snapshot without reading file contents or writing external state.