Struct AccessControlRepository 

pub struct AccessControlRepository { /* private fields */ }

Implementations

impl AccessControlRepository

pub async fn get_entity( &self, entity_type: EntityKind, entity_id: &str, ) -> AuthzResult<Option<EntityRow>>

Look up one entity catalog row. Ok(None) means the entity has no catalog row at all (publish-pipeline bootstrap gap) — the resolver turns this into crate::authz::DenyReason::UnknownEntity.

pub async fn upsert_entity( &self, entity_type: EntityKind, entity_id: &str, default_included: bool, source: &str, ) -> AuthzResult<()>

Upsert an entity catalog row. Always overwrites default_included and source so the most recent bootstrap pass wins — the publish pipeline is the source of truth and runs ahead of YAML grant ingestion.

pub async fn upsert_entities( &self, entity_type: EntityKind, ids: &[&str], default_included: bool, source: &str, ) -> AuthzResult<()>

Upsert many entity catalog rows of one kind in a single round-trip, sharing the same default_included and source. Equivalent to calling Self::upsert_entity once per id but issues one statement instead of ids.len() awaits.

pub async fn list_entities( &self, entity_type: EntityKind, ) -> AuthzResult<Vec<EntityRow>>

Bulk-fetch every catalog row for a given kind. Used by the CLI lint and the publish-pipeline validator to detect rules pointing at entities the bootstrap pass never registered.

impl AccessControlRepository

pub async fn list_role_rules_for_export( &self, ) -> AuthzResult<Vec<ExportRuleRow>>

pub async fn list_rules_for_entity( &self, entity_type: EntityKind, entity_id: &str, ) -> AuthzResult<Vec<AccessRule>>

pub async fn list_rules_bulk( &self, entity_type: EntityKind, entity_ids: &[String], ) -> AuthzResult<HashMap<String, Vec<AccessRule>>>

pub async fn upsert_rule( &self, params: UpsertRuleParams<'_>, ) -> AuthzResult<AccessRule>

Fails with a foreign-key violation if no entity catalog row exists for (entity_type, entity_id) — register the entity via Self::upsert_entity first.

pub async fn set_justification( &self, rule_id: &RuleId, justification: Option<&str>, ) -> AuthzResult<bool>

None clears the operator note.

pub async fn delete_rule(&self, rule_id: &RuleId) -> AuthzResult<bool>

impl AccessControlRepository

pub fn new(db: &DbPool) -> AuthzResult<Self>

pub fn from_pool(pool: Arc<PgPool>) -> Self

Trait Implementations

impl Clone for AccessControlRepository

fn clone(&self) -> AccessControlRepository

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AccessControlRepository

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.