wasm_dbms_memory/acl/
traits.rs

1// Rust guideline compliant 2026-04-27
2// X-WHERE-CLAUSE, M-PUBLIC-DEBUG, M-CANONICAL-DOCS
3
4//! Granular access-control trait.
5
6use wasm_dbms_api::prelude::{
7    IdentityPerms, MemoryResult, PermGrant, PermRevoke, TableFingerprint, TablePerms,
8};
9
10use crate::{MemoryManager, MemoryProvider};
11
12/// Trait for granular access-control providers.
13///
14/// Implementations gate every CRUD-relevant operation through `granted*`
15/// predicates. Mutations persist via `mm`.
16///
17/// The `Id` associated type lets runtimes use native identity
18/// representations (`Vec<u8>` for the generic layer, `Principal` for the
19/// IC adapter, `()` for the no-op provider).
20pub trait AccessControl: Default {
21    /// Native identity type used by this provider.
22    type Id;
23
24    /// Loads ACL state from persisted memory.
25    fn load<M>(mm: &mut MemoryManager<M>) -> MemoryResult<Self>
26    where
27        M: MemoryProvider,
28        Self: Sized;
29
30    /// Returns whether `id` is granted `perm` on `table`.
31    fn granted(&self, id: &Self::Id, table: TableFingerprint, perm: TablePerms) -> bool;
32
33    /// Returns whether `id` carries the `admin` bypass flag.
34    fn granted_admin(&self, id: &Self::Id) -> bool;
35
36    /// Returns whether `id` carries the `manage_acl` flag.
37    fn granted_manage_acl(&self, id: &Self::Id) -> bool;
38
39    /// Returns whether `id` carries the `migrate` flag.
40    fn granted_migrate(&self, id: &Self::Id) -> bool;
41
42    /// Applies a grant to `id`, creating the entry if missing.
43    fn grant<M>(
44        &mut self,
45        id: Self::Id,
46        grant: PermGrant,
47        mm: &mut MemoryManager<M>,
48    ) -> MemoryResult<()>
49    where
50        M: MemoryProvider;
51
52    /// Applies a revoke to `id`. No-op if `id` is not present.
53    fn revoke<M>(
54        &mut self,
55        id: &Self::Id,
56        revoke: PermRevoke,
57        mm: &mut MemoryManager<M>,
58    ) -> MemoryResult<()>
59    where
60        M: MemoryProvider;
61
62    /// Removes `id` entirely from the ACL.
63    fn remove_identity<M>(&mut self, id: &Self::Id, mm: &mut MemoryManager<M>) -> MemoryResult<()>
64    where
65        M: MemoryProvider;
66
67    /// Returns the [`IdentityPerms`] currently held by `id`, or the
68    /// default (no perms) if `id` is unknown.
69    fn perms(&self, id: &Self::Id) -> IdentityPerms;
70
71    /// Returns every identity in the ACL together with its perms.
72    fn identities(&self) -> Vec<(Self::Id, IdentityPerms)>;
73}
wasm_dbms_memory/acl/traits.rs

wasm_dbms_memory/acl/
traits.rs
