systemprompt_security/authz/repository/
mod.rs

1//! `AccessControlRepository` — sqlx-backed access to the two-table authz
2//! schema.
3//!
4//! `access_control_entities` owns one row per `(entity_type, entity_id)` and
5//! carries the `default_included` flag plus a `source` provenance string.
6//! `access_control_rules` is the per-(entity, subject) grant table, with a
7//! foreign key back to the entity catalog. Callers fetch the entity row
8//! first (a `None` result signals an entity unknown to access control), then
9//! list rules for it, and hand both to [`super::resolver::resolve`].
10//!
11//! Copyright (c) systemprompt.io — Business Source License 1.1.
12//! See <https://systemprompt.io> for licensing details.
13
14mod entities;
15mod rules;
16
17use std::sync::Arc;
18
19use sqlx::PgPool;
20use systemprompt_database::DbPool;
21
22use super::error::{AuthzError, AuthzResult};
23use super::types::{Access, EntityKind, RuleType};
24
25#[derive(Debug, Clone)]
26pub struct ExportRuleRow {
27    pub entity_type: String,
28    pub entity_id: String,
29    pub rule_type: String,
30    pub rule_value: String,
31    pub access: String,
32    pub justification: Option<String>,
33}
34
35#[derive(Debug, Clone, Copy)]
36pub struct UpsertRuleParams<'a> {
37    pub entity_type: EntityKind,
38    pub entity_id: &'a str,
39    pub rule_type: RuleType,
40    pub rule_value: &'a str,
41    pub access: Access,
42    pub justification: Option<&'a str>,
43}
44
45#[derive(Clone, Debug)]
46pub struct AccessControlRepository {
47    pool: Arc<PgPool>,
48    write_pool: Arc<PgPool>,
49}
50
51impl AccessControlRepository {
52    pub fn new(db: &DbPool) -> AuthzResult<Self> {
53        let pool = db
54            .pool_arc()
55            .map_err(|err| AuthzError::Validation(err.to_string()))?;
56        let write_pool = db
57            .write_pool_arc()
58            .map_err(|err| AuthzError::Validation(err.to_string()))?;
59        Ok(Self { pool, write_pool })
60    }
61
62    pub fn from_pool(pool: Arc<PgPool>) -> Self {
63        let write_pool = Arc::clone(&pool);
64        Self { pool, write_pool }
65    }
66}
systemprompt_security/authz/repository/mod.rs

systemprompt_security/authz/repository/
mod.rs
