Struct WamiContext 

pub struct WamiContext { /* private fields */ }

WAMI Context - carries authentication and authorization information

This context is created during authentication and passed to all service operations. It contains information about who is performing the operation and where it should be executed.

Implementations

impl WamiContext

pub fn builder() -> WamiContextBuilder

Create a new context builder

pub fn is_root(&self) -> bool

Check if the caller is a root user

Root users have full access and bypass all authorization checks.

pub fn caller_arn(&self) -> &WamiArn

Get the caller’s ARN

pub fn provenance(&self) -> &[Step]

How authority reached the current caller, oldest first.

The chain answers “by what route”, which no ARN should: an ARN names a thing, and one that grows a segment per service traversed stops being comparable — policies matching on it would break, and a trailing wildcard added to compensate would swallow segments nobody intended.

pub fn provenance_trail(&self) -> String

The provenance as one string, for an audit log.

The first principal, then one service:type/value segment per hand-off:

arn:wami:iam:12345678:wami:999:user/alice:sts:assumed-role/DataScientist/session1

It exists to be queried. A trail in a text column answers “which requests went through STS then SSO” with LIKE '%:sts:%:sso:%' — one index, no join, no JSON operators. That is the most common question asked of an audit log, and the structured chain answers it poorly.

This is a projection, not a serialisation: it is deliberately lossy, and there is no parser back. Reconstructing a context from it would give something that looks authoritative while having lost the full ARNs — use WamiContext::provenance when the structure is what matters.

Note it is not the caller’s ARN, and must never be used as one. An identifier that grows a segment per service traversed stops comparing equal to itself, and every policy written against it silently stops matching.

pub fn through( &self, principal: WamiArn, via: Transition, ) -> Result<WamiContext>

Derive the context that results from authority passing to principal.

One call writes both the new caller and the step recording the move, so the chain cannot end up describing someone other than the caller. The tenant path and instance follow the new principal, exactly as they do when a context is built.

Root is never regained: a context that was not root cannot become root by assuming something, whatever that something is named. It can only be kept, and only by staying on a root principal.

Fails past MAX_PROVENANCE_DEPTH.

pub fn tenant_path(&self) -> &TenantPath

Get the tenant path

pub fn instance_id(&self) -> &str

Get the instance ID

pub fn region(&self) -> Option<&str>

Get the default region (if set)

pub fn session_info(&self) -> Option<&SessionInfo>

Get session information (if temporary credentials)

pub fn source_ip(&self) -> Option<&str>

Get the source IP address (if set)

pub fn mfa_present(&self) -> Option<bool>

Check if MFA was used for this request (if known)

pub fn secure_transport(&self) -> Option<bool>

Check if the request uses secure transport (if known)

pub fn can_access_tenant(&self, target_tenant: &TenantPath) -> bool

Check if this context can access a specific tenant path

A context can access:

• Its own tenant
• Any child tenant below it in the hierarchy
• If root user: any tenant in the instance

pub fn is_expired(&self) -> bool

Check if the session has expired (for temporary credentials)

Trait Implementations

impl Clone for WamiContext

fn clone(&self) -> WamiContext

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for WamiContext

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for WamiContext

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl From<&WamiContext> for MatchContext

Build a MatchContext from a WamiContext.

fn from(ctx: &WamiContext) -> Self

Converts to this type from the input type.

impl Serialize for WamiContext

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.