rskit_authz/boundary.rs
1/// Transport-agnostic authorization decision.
2#[derive(Debug, Clone, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
3#[non_exhaustive]
4pub enum AuthzDecision {
5 /// Request is allowed.
6 Allow,
7 /// Request is denied with a reason.
8 Deny(String),
9 /// Request requires human approval.
10 RequiresHumanApproval(String),
11}
12
13/// Transport-agnostic authorization request for a principal, action, and resource.
14#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
15pub struct AuthzRequest {
16 /// Principal identifier.
17 pub principal: String,
18 /// Action being performed.
19 pub action: String,
20 /// Resource identifier.
21 pub resource: String,
22 /// Scopes relevant to the request.
23 #[serde(default)]
24 pub scopes: Vec<String>,
25 /// Additional structured attributes.
26 #[serde(default)]
27 pub attributes: serde_json::Value,
28}
29
30/// Object-safe authorization decider used at integration boundaries.
31pub trait Decider: Send + Sync {
32 /// Decide one authorization request.
33 fn decide(&self, request: &AuthzRequest) -> AuthzDecision;
34}