Module rebac 

Relationship-based access control (Zanzibar style): tuples, a schema, a store and the check that walks them.

A tuple says a subject has a relation to an object: doc:42#editor@user:alice, or with a set of subjects doc:42#viewer@group:eng#member (every member of group:eng).

The schema says, per object type, how each relation is made up — a union (|) of terms:

Term	Means
user	tuples naming a user:… directly
group#member	tuples naming group:…#member — those members
owner	whoever has owner on the same object
parent->viewer	the viewers of whatever this object’s parent is

use rust_web_server::authz::{Authorizer, MemoryStore, Schema};

let schema = Schema::new()
    .relation("group", "member", "user").unwrap()
    .relation("folder", "viewer", "user | group#member").unwrap()
    .relation("doc", "parent", "folder").unwrap()
    .relation("doc", "owner", "user").unwrap()
    .relation("doc", "viewer", "user | owner | parent->viewer").unwrap();
let authz = Authorizer::new(schema, MemoryStore::new()).unwrap();
for tuple in ["group:eng#member@user:bob", "folder:specs#viewer@group:eng#member", "doc:42#parent@folder:specs"] {
    authz.write_str(tuple).unwrap();
}
assert!(authz.check("user:bob", "viewer", "doc:42").unwrap());
assert!(!authz.check("user:eve", "viewer", "doc:42").unwrap());

Structs

Authorizer

A schema and a tuple store: writes checked against the schema, and check.

MemoryStore

Tuples in memory: for tests, small apps, and tuples seeded from the config file. Lost on restart.

ObjectRef

An object: type:id.

Schema

Object types and their relations.

Subject

Who a tuple names: an object (user:alice) or a set (group:eng#member).

Tuple

object#relation@subject.

TupleFilter

Which tuples to list: any field left None matches everything.

Enums

AuthzError

What can go wrong.

Term

One term of a relation’s definition.

Constants

MAX_DEPTH

The longest chain of relations a check follows.

MAX_NAME

Longest type name, id or relation name accepted.

MAX_READS

The most store reads one check makes.

Traits

TupleStore

Where tuples live.

Functions

parse_expression

Parse a relation definition: terms separated by |. A bare name is a type when the schema has such a type, else a relation on the same object (resolved by Schema::relation); here it comes back as Direct.