Module authz 

Authorization (18.14.0, #32): who the caller is (Identity), and — from later tranches — what they may do, as relationship-based access control (Zanzibar-style tuples and a schema).

Every authenticator in rws hands the authenticated caller to what runs after it as one Identity: JwtLayer, OidcAuth, SamlSp, BasicAuthLayer, ForwardAuthLayer (with identity_header) and MCP bearer / OAuth tokens. A handler reads it with Identity::current:

use rust_web_server::app::App;
use rust_web_server::authz::Identity;
use rust_web_server::response::{Response, STATUS_CODE_REASON_PHRASE};

let app = App::with_state(()).get("/me", |_, _, _, _| match Identity::current() {
    Some(me) => Response::text(STATUS_CODE_REASON_PHRASE.n200_ok, me.subject()),
    None => Response::text(STATUS_CODE_REASON_PHRASE.n401_unauthorized, "who are you?"),
});

The identity is not a request header: the authenticator runs the rest of the request inside with_identity, so a client can’t send one.

Re-exports

pub use rebac::AuthzError;

pub use rebac::Authorizer;

pub use rebac::MemoryStore;

pub use rebac::ObjectRef;

pub use rebac::Schema;

pub use rebac::Subject;

pub use rebac::Tuple;

pub use rebac::TupleFilter;

pub use rebac::TupleStore;

Modules

rebac

Relationship-based access control (Zanzibar style): tuples, a schema, a store and the check that walks them.

Structs

AuthzLayer

Middleware that lets a request through when its caller (Identity::current, set by an authenticator wrapped before — outside — this layer) has a relation to an object: 401 without a caller, 403 when the answer is no, the object can’t be named, or the check fails (logged).

Identity

The authenticated caller of the current request: an object (a type and an id) — never a set like group:eng#member.

ObjectTemplate

An object name built from the request: literal text with {path:N} (the Nth path segment, from 1, percent-decoded), {query:name} and {header:Name}. doc:{path:2} on /docs/42/edit is doc:42. Query parameters and headers come from the client as sent — use a header only when something in front (forward auth’s copy_header) sets it.

Functions

scope_identity

with_identity for async code: future runs as identity.

with_identity

Run f as identity (what Identity::current returns inside it); the previous one comes back afterwards, also on panic. Authenticators call this around the rest of the request.