Struct Abilities 

pub struct Abilities<M> { /* private fields */ }

A policy that answers each Ability from the check declared for it, and denies every ability it declares none for.

A closure policy that ends in _ => true allows whatever it does not name, such as the restore a soft delete adds or an action declared later. Abilities allows only what it names:

let policy = Abilities::<Post>::new()
    .view_any(is_editor)
    .view(|_cx, _post| true)
    .create(is_editor)
    .update(|cx, post| is_editor(cx) && !post.locked);
// No delete, restore or action: each is refused until the policy declares it.

A write’s record check also allows the write at all: delete allows DeleteAny, restore allows RestoreAny, force_delete allows ForceDeleteAny, and run allows RunAny for its action, since the panel asks the record’s check before each of these writes. The _any methods narrow it; declared alone, they allow no record. view does not allow ViewAny: the list asks ViewAny alone and shows every row the resource’s query returns, so view_any is declared on its own.

Declaring an ability twice replaces its earlier check; combine the checks in one closure.

The model’s type is named on new, Abilities::<Post>::new(): a closure is checked before the chain learns the model from where the policy goes.

Implementations

impl<M> Abilities<M>

pub fn new() -> Self

A policy that denies every ability.

pub fn view_any( self, check: impl Fn(&Cx) -> bool + Send + Sync + 'static, ) -> Self

Who may see the resource at all: ViewAny, which opens the list with every row of the resource’s query, the sidebar entry, the export, related tables, relationship options and header actions. Refused until declared, whether or not view is.

pub fn view( self, check: impl Fn(&Cx, &M) -> bool + Send + Sync + 'static, ) -> Self

Who may see a record: View, asked by its detail page, its edit form, each write to it, the export and relationship options. The list shows a row without it, and asks it only to offer the row’s actions.

pub fn create(self, check: impl Fn(&Cx) -> bool + Send + Sync + 'static) -> Self

Who may create a record: Create.

pub fn update( self, check: impl Fn(&Cx, &M) -> bool + Send + Sync + 'static, ) -> Self

Who may edit a record: Update.

pub fn delete_any( self, check: impl Fn(&Cx) -> bool + Send + Sync + 'static, ) -> Self

Who may delete at all: DeleteAny. Defaults to whether delete is declared.

pub fn delete( self, check: impl Fn(&Cx, &M) -> bool + Send + Sync + 'static, ) -> Self

Who may delete a record: Delete.

pub fn restore_any( self, check: impl Fn(&Cx) -> bool + Send + Sync + 'static, ) -> Self

Who may restore trashed records at all: RestoreAny. Defaults to whether restore is declared.

pub fn restore( self, check: impl Fn(&Cx, &M) -> bool + Send + Sync + 'static, ) -> Self

Who may restore a trashed record: Restore.

pub fn force_delete_any( self, check: impl Fn(&Cx) -> bool + Send + Sync + 'static, ) -> Self

Who may delete trashed records for good at all: ForceDeleteAny, which the panel also asks DeleteAny of. Defaults to whether force_delete is declared.

pub fn force_delete( self, check: impl Fn(&Cx, &M) -> bool + Send + Sync + 'static, ) -> Self

Who may delete a trashed record for good: ForceDelete, which the panel also asks Delete of.

impl<M> Abilities<M>

pub fn and<P>(self, other: P) -> And<Self, P>

Allows what both self and other allow.

pub fn or<P>(self, other: P) -> Or<Self, P>

Allows what either self or other allows.

impl<M> Abilities<M>

pub fn run<A, R>( self, check: impl Fn(&Cx, &M) -> bool + Send + Sync + 'static, ) -> Self

where A: Action<R>, R: Resource<Model = M>,

Who may run the record action A on a record: Run with A’s NAME. It also allows RunAny for A, which run_any narrows. An action no run declares is refused.

let policy = Abilities::<Post>::new()
    .view_any(|_cx| true)
    .view(|_cx, _post| true)
    .run::<Publish, _>(|_cx, post| !post.published);

pub fn run_any<A, R>( self, check: impl Fn(&Cx) -> bool + Send + Sync + 'static, ) -> Self

where A: Action<R>, R: Resource<Model = M>,

Who may run the record action A at all: RunAny with A’s NAME. Defaults to whether run declares A.

impl<M> Abilities<M>

pub fn run_header<A: HeaderAction>( self, check: impl Fn(&Cx) -> bool + Send + Sync + 'static, ) -> Self

Who may run the header action A from the list’s header: RunHeader with A’s NAME. A header action no run_header declares is refused.

Trait Implementations

impl<M> Debug for Abilities<M>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Lists the declared abilities by method name; their checks are closures.

impl<M> Default for Abilities<M>

fn default() -> Self

Returns the “default value” for a type.

impl<M: 'static> Policy<M> for Abilities<M>

fn allows(&self, cx: &Cx, ability: Ability<'_, M>) -> bool

Whether the current user may do ability.