Struct RoleSystem

pub struct RoleSystem<S = MemoryStorage>
where
    S: Storage,
{ /* private fields */ }

The main role-based access control system.

Implementations

impl RoleSystem<MemoryStorage>

pub fn new() -> Self

Create a new role system with default configuration and memory storage.

pub fn with_config(config: RoleSystemConfig) -> Self

Create a new role system with custom configuration and memory storage.

impl<S> RoleSystem<S>

where S: Storage,

pub fn with_storage(storage: S, config: RoleSystemConfig) -> Self

Create a new role system with custom storage.

pub fn register_role(&mut self, role: Role) -> Result<()>

Register a new role in the system.

pub fn get_role(&self, name: &str) -> Result<Option<Role>>

Get a role by name.

pub fn update_role(&mut self, role: Role) -> Result<()>

Update an existing role.

pub fn add_role_inheritance(&mut self, child: &str, parent: &str) -> Result<()>

Add role inheritance (child inherits from parent).

pub fn remove_role_inheritance( &mut self, child: &str, parent: &str, ) -> Result<()>

Remove role inheritance.

pub fn assign_role(&mut self, subject: &Subject, role_name: &str) -> Result<()>

Assign a role to a subject.

pub fn remove_role(&mut self, subject: &Subject, role_name: &str) -> Result<()>

Remove a role from a subject.

pub fn elevate_role( &mut self, subject: &Subject, role_name: &str, duration: Option<Duration>, ) -> Result<()>

Temporarily elevate a subject’s role.

pub fn check_permission( &self, subject: &Subject, action: &str, resource: &Resource, ) -> Result<bool>

Check if a subject has a specific permission on a resource.

pub fn check_permission_with_context( &self, subject: &Subject, action: &str, resource: &Resource, context: &HashMap<String, String>, ) -> Result<bool>

Check permission with additional context.

pub fn get_subject_roles(&self, subject: &Subject) -> Result<HashSet<String>>

Get all roles assigned to a subject (including inherited roles).

pub fn create_standard_roles(&mut self) -> Result<()>

Creates standard roles commonly used in applications.

This method creates the following roles:

• admin: Full system access
• editor: Create and edit content
• viewer: Read-only access
• guest: Limited read access

pub fn create_application_roles( &mut self, app_type: ApplicationType, ) -> Result<()>

Creates roles appropriate for specific application types.

impl<S: Storage> RoleSystem<S>

pub fn storage(&self) -> &S

Get access to the internal storage backend (for query operations).

pub fn subject_roles(&self) -> &DashMap<String, HashSet<String>>

Get access to the subject roles mapping (for query operations).

pub fn role_hierarchy(&self) -> &DashMap<String, HashSet<String>>

Get access to the role hierarchy mapping (for query operations).

pub fn config(&self) -> &RoleSystemConfig

Get access to the configuration (for query operations).

impl<S: Storage> RoleSystem<S>

pub fn assign_roles<I>(&mut self, subject: &Subject, roles: I) -> Result<()>

where I: IntoIterator, I::Item: AsRef<str>,

Assign multiple roles to a subject in a single operation.

pub fn remove_roles<I>(&mut self, subject: &Subject, roles: I) -> Result<()>

where I: IntoIterator, I::Item: AsRef<str>,

Remove multiple roles from a subject in a single operation.

pub fn check_permissions_batch( &self, subject: &Subject, permissions: &[(&str, &Resource)], ) -> Result<Vec<(String, String, bool)>>

Check multiple permissions for a subject in a single operation.

pub fn bulk_assign_roles( &mut self, assignments: &[(Subject, Vec<String>)], ) -> Result<Vec<Result<()>>>

Bulk role assignment with validation.

pub fn get_permission_summary( &self, subject: &Subject, ) -> Result<PermissionSummary>

Get detailed permission summary for a subject.

impl<S: Storage> RoleSystem<S>

Health check extension for RoleSystem.

pub fn health_check(&self) -> HealthReport

Perform a health check on the role system.

pub fn health_check_with_config( &self, config: HealthCheckConfig, ) -> HealthReport

Perform a health check with custom configuration.

pub fn is_healthy(&self) -> bool

Get a simple health status (useful for load balancer health checks).

Trait Implementations

impl BatchOperations for RoleSystem

fn batch_check_permissions( &self, checks: Vec<BatchPermissionCheck>, ) -> Result<BatchResult<bool>, Error>

Perform batch permission checks

fn batch_role_operations( &mut self, operations: Vec<BatchRoleAssignment>, ) -> Result<BatchResult<()>, Error>

Perform batch role assignments and revocations (requires mutable access)

impl<S, T> ContextualPermissions<T> for RoleSystem<S>

where S: Storage, T: AuthenticationContext,

fn check_contextual_permission( &self, context: &T, action: &str, resource: &Resource, _additional_context: Option<HashMap<String, String>>, ) -> Result<bool>

Check permission using an authentication context.

This method combines role-based permissions with any scopes/permissions granted directly by the authentication context (e.g., JWT token scopes).

Arguments

• context - The authentication context to use
• action - The action to check permission for
• resource - The resource to check permission for
• additional_context - Additional context values for conditional permissions

Returns

true if permission is granted, false otherwise

fn check_scope_permission( &self, context: &T, required_scopes: &[String], ) -> Result<bool>

Check permission against a list of required scopes.

This is useful for API endpoints that require specific scopes.

Arguments

• context - The authentication context to use
• required_scopes - List of required scopes (any match grants permission)

Returns

true if any required scope is granted, false otherwise

impl<S> Default for RoleSystem<S>

where S: Storage + Default,

fn default() -> Self

Returns the “default value” for a type.

impl<S> MetricsProvider for RoleSystem<S>

where S: Storage,

fn metrics(&self) -> &RoleSystemMetrics

Get the metrics instance.

fn start_timer(&self, operation: &str) -> MetricsTimer

Start a timer for an operation.

impl<S: Storage> RoleSystemQuery<S> for RoleSystem<S>

fn query(&self) -> RoleQuery<'_, S>

Get a query interface for this role system.