Crate stateset_authz 

StateSet Authorization

IO-free, framework-agnostic authorization engine for the StateSet iCommerce platform. This crate is a Rust port of the permission model in cli/src/permissions.js, designed to be reusable across runtimes (CLI, server, WASM, NAPI bindings).

Features

• Permission levels — None < Read < Preview < Write < Delete < Admin
• Role-based access control — built-in roles (admin, operator, viewer, none) plus a RoleBuilder for custom roles
• Window-based rate limiting — per-actor, per-resource request tracking
• Audit logging — in-memory ring buffer with filtering by actor, resource, time
• Sensitive field redaction — recursive JSON traversal + partial string masking
• Access decisions — Allowed, Denied, RequiresApproval with reasons
• Zero IO — no filesystem, network, or database access; bring your own persistence

Quick Start

use stateset_authz::{AuthzEngineBuilder, Role, Action, Resource, RateLimitRule};
use std::time::Duration;

let mut engine = AuthzEngineBuilder::new()
    .add_role(Role::admin())
    .add_role(Role::viewer())
    .assign_role("alice", "admin")
    .assign_role("bob", "viewer")
    .rate_limit_rule(RateLimitRule::new("orders", 100, Duration::from_secs(60)))
    .build();

// Alice (admin) can create orders
let decision = engine.authorize("alice", &Resource::new("orders"), &Action::Create);
assert!(decision.is_allowed());

// Bob (viewer) cannot create orders
let decision = engine.authorize("bob", &Resource::new("orders"), &Action::Create);
assert!(decision.is_denied());

// Every decision is recorded in the audit log
assert_eq!(engine.audit_log().len(), 2);

Custom Roles

use stateset_authz::{RoleBuilder, PermissionLevel, Action};

let order_manager = RoleBuilder::new("order-manager")
    .default_level(PermissionLevel::Read)
    .allow("orders", PermissionLevel::Admin)
    .allow("customers", PermissionLevel::Write)
    .build();

assert!(order_manager.check("orders", &Action::Delete).is_allowed());
assert!(order_manager.check("customers", &Action::Create).is_allowed());
assert!(order_manager.check("inventory", &Action::Create).is_denied());

Redaction

use stateset_authz::{RedactionConfig, redact_value, redact_string};
use serde_json::json;

let config = RedactionConfig::default();
let mut data = json!({ "name": "Alice", "password": "s3cr3t", "token": "abc" });
redact_value(&mut data, &config);

assert_eq!(data["name"], "Alice");
assert_eq!(data["password"], "[REDACTED]");
assert_eq!(data["token"], "[REDACTED]");

assert_eq!(redact_string("secret123"), "sec***123");

Structs

AuditFilter

Filter criteria for querying the audit log.

AuditLog

An in-memory audit log with configurable maximum size and auto-truncation.

AuditRecord

A single audit record capturing an authorization decision.

AuthzEngine

The central authorization engine.

AuthzEngineBuilder

Builder for constructing an AuthzEngine.

ParsePermissionLevelError

Error returned when parsing an invalid permission level string.

RateLimitRule

Configuration for a single rate limit rule.

RateLimiter

A window-based rate limiter.

RedactionConfig

Configuration for which fields to redact.

Resource

A resource to be protected by authorization.

Role

A named role with per-resource permission levels and a default fallback.

RoleBuilder

Builder for constructing custom Role instances.

Enums

AccessDecision

The outcome of an authorization check.

Action

An action to be performed on a resource.

AuthzError

Errors that can occur during authorization operations.

PermissionLevel

Permission levels ordered from least to most privileged.

RateLimitDecision

The result of a rate limit check.

Functions

redact_string

Partially masks a string by keeping the first 3 and last 3 characters, replacing the middle with ***.

redact_value

Recursively walks a JSON value and replaces matching field values with "[REDACTED]".

Type Aliases

AuthzResult

Type alias for results using AuthzError.