Struct AuthorizationService 

pub struct AuthorizationService<S>
where
    S: UserStore + GroupStore + RoleStore + PolicyStore + Send + Sync,
{ /* private fields */ }

Authorization Service

Handles permission checking based on IAM policies.

Implementations

impl<S> AuthorizationService<S>

where S: UserStore + GroupStore + RoleStore + PolicyStore + Send + Sync,

pub fn new(store: Arc<RwLock<S>>) -> Self

Create a new authorization service

pub async fn authorize( &self, context: &WamiContext, action: &str, resource_arn: &WamiArn, ) -> Result<Decision>

Authorize an action on a resource

This is the main authorization method. It checks if the caller (from the context) is allowed to perform the specified action on the target resource.

Arguments

• context - The authenticated context (contains caller info)
• action - The action to perform (e.g., “iam:GetUser”)
• resource_arn - The target resource ARN

Returns

true if the action is allowed, false otherwise

Errors

Returns an error if there’s a problem accessing the store or evaluating policies.

pub async fn check_or_deny( &self, context: &WamiContext, action: &str, resource_arn: &WamiArn, ) -> Result<()>

Check if access is denied (returns an error if not authorized)

Convenience wrapper over AuthorizationService::authorize for callers that only need to proceed or stop. The refusal names what decided, so a caller gets a usable message without handling Decision itself.

Trait Implementations

impl<S> Authorizer for AuthorizationService<S>

where S: UserStore + GroupStore + RoleStore + PolicyStore + Send + Sync + 'static,

fn authorize<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, context: &'life1 WamiContext, action: &'life2 str, resource_arn: &'life3 WamiArn, ) -> Pin<Box<dyn Future<Output = Result<Decision>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait,

Decide whether context may perform action on resource_arn.

fn check_or_deny<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, context: &'life1 WamiContext, action: &'life2 str, resource_arn: &'life3 WamiArn, ) -> Pin<Box<dyn Future<Output = Result<()>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait,

Like Authorizer::authorize, but returns Err(AccessDenied) on refusal.