Struct AbacEngine 

pub struct AbacEngine { /* private fields */ }

The ABAC policy evaluation engine.

Compiles policies at construction time and evaluates them with forbid-overrides semantics (any matching forbid wins over all permits).

Implementations

impl AbacEngine

pub fn new( policies: &[AbacPolicy], entities: &[AbacEntity], ) -> Result<Self, String>

Create an ABAC engine from policies and entities.

Compiles all policies and builds the entity store. Returns an error if any policy pattern is invalid or entity bounds are exceeded.

pub fn evaluate( &self, action: &Action, ctx: &AbacEvalContext<'_>, ) -> AbacDecision

Evaluate an action against all ABAC policies.

Uses forbid-overrides semantics:

1. Collect matching policies (principal + action + resource + conditions)
2. If any matching policy is Forbid → Deny
3. If any matching policy is Permit (and no Forbid) → Allow
4. If nothing matches → NoMatch (caller decides)

pub fn entity_store(&self) -> &EntityStore

Get a reference to the entity store.

pub fn find_conflicts(&self) -> Vec<AbacConflict>

Detect conflicts where permit and forbid policies overlap.

pub fn policy_count(&self) -> usize

Return the number of compiled policies.