pub struct EntityStore { /* private fields */ }Expand description
In-memory entity store for ABAC principal/resource attributes.
§Security
This store is the authority for group membership lookups used by ABAC
principal matching. Membership queries (is_member_of) are bounded
by [MAX_MEMBERSHIP_DEPTH] and use a visited set to prevent cycles
and exponential blowup in diamond-shaped group hierarchies.
Implementations§
Source§impl EntityStore
impl EntityStore
Sourcepub fn from_config(entities: &[AbacEntity]) -> Self
pub fn from_config(entities: &[AbacEntity]) -> Self
Build an entity store from config entities.
SECURITY (R242-ENG-2): Keys are normalized via normalize_full() to match
the normalized lookup keys constructed in matches_principal(). Without this,
entities with non-ASCII type/id would never match normalized lookup keys.
Sourcepub fn lookup(&self, entity_type: &str, id: &str) -> Option<&AbacEntity>
pub fn lookup(&self, entity_type: &str, id: &str) -> Option<&AbacEntity>
Look up an entity by type and ID.
SECURITY (R242-ENG-2): Normalize lookup key to match storage normalization.
Sourcepub fn is_member_of(&self, entity_key: &str, group_key: &str) -> bool
pub fn is_member_of(&self, entity_key: &str, group_key: &str) -> bool
Check if an entity is a (transitive) member of a group. Bounded to MAX_MEMBERSHIP_DEPTH to prevent infinite loops. Uses a visited set to prevent exponential blowup through diamond-shaped membership graphs (FIND-R44-001).