Struct AuthzEngine 

pub struct AuthzEngine { /* private fields */ }

The central authorization engine.

Combines role-based access control, rate limiting, audit logging, and field redaction into a single, coherent API.

use stateset_authz::{AuthzEngineBuilder, Role, Action, Resource};

let mut engine = AuthzEngineBuilder::new()
    .add_role(Role::admin())
    .add_role(Role::viewer())
    .assign_role("alice", "admin")
    .assign_role("bob", "viewer")
    .build();

let decision = engine.authorize("alice", &Resource::new("orders"), &Action::Delete);
assert!(decision.is_allowed());

let decision = engine.authorize("bob", &Resource::new("orders"), &Action::Delete);
assert!(decision.is_denied());

Implementations

impl AuthzEngine

pub fn authorize( &mut self, actor_id: &str, resource: &Resource, action: &Action, ) -> AccessDecision

Checks whether actor_id is allowed to perform action on resource.

This method:

1. Looks up the actor’s role
2. Checks the role’s permission for the resource type
3. Checks rate limits
4. Checks approval-required rules
5. Records an audit entry

use stateset_authz::{AuthzEngineBuilder, Role, Action, Resource};

let mut engine = AuthzEngineBuilder::new()
    .add_role(Role::viewer())
    .assign_role("bob", "viewer")
    .build();

let d = engine.authorize("bob", &Resource::new("orders"), &Action::Read);
assert!(d.is_allowed());

pub fn add_role(&mut self, role: Role)

Adds a new role to the engine.

If a role with the same name already exists, it is replaced.

pub fn assign_role( &mut self, actor_id: &str, role_name: &str, ) -> AuthzResult<()>

Assigns a role to an actor.

Returns an error if the role does not exist.

pub fn remove_role(&mut self, actor_id: &str)

Removes a role assignment for an actor.

pub fn actor_role(&self, actor_id: &str) -> Option<&str>

Returns the role assigned to an actor, if any.

pub const fn rate_limiter(&self) -> &RateLimiter

Returns a reference to the rate limiter.

pub const fn rate_limiter_mut(&mut self) -> &mut RateLimiter

Returns a mutable reference to the rate limiter.

pub const fn audit_log(&self) -> &AuditLog

Returns a reference to the audit log.

pub fn query_audit(&self, filter: &AuditFilter) -> Vec<&AuditRecord>

Queries the audit log with the given filter.

pub const fn redaction_config(&self) -> &RedactionConfig

Returns a reference to the redaction config.

pub fn redact(&self, value: &mut Value)

Redacts sensitive fields in a JSON value using the engine’s redaction config.

pub fn add_rate_limit_rule(&mut self, rule: RateLimitRule)

Adds a rate limit rule.

pub fn require_approval( &mut self, resource_type: Option<String>, action: Option<Action>, )

Requires explicit approval for operations matching the criteria.

Trait Implementations

impl Debug for AuthzEngine

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.