Trait Gate

Source

pub trait Gate:
    Send
    + Sync
    + 'static {
    type Identity: Identity;
    type Rule: Send + Sync + 'static;

    // Required methods
    fn authenticate(&self, req: &Request<'_>) -> Result<Self::Identity, Denial>;
    fn authorize(
        &self,
        who: &Self::Identity,
        rule: &Self::Rule,
        req: &Request<'_>,
    ) -> Result<(), Denial>;
}

Expand description

Authentication and authorization, the two checkpoints a request passes before a handler runs.

One trait, so an application has one type parameter. An implementation backed by remote state fails closed: when it cannot decide, it denies.

use web_net::{Denial, Gate, Identity, Request};

struct User { admin: bool }
impl Identity for User {
    fn is_guest(&self) -> bool { false }
}

enum Rule { Admin }

struct Demo;
impl Gate for Demo {
    type Identity = User;
    type Rule = Rule;
    fn authenticate(&self, req: &Request<'_>) -> Result<User, Denial> {
        Ok(User { admin: req.header("x-demo-admin").is_some() })
    }
    fn authorize(&self, who: &User, rule: &Rule, _req: &Request<'_>) -> Result<(), Denial> {
        match rule {
            Rule::Admin if who.admin => Ok(()),
            Rule::Admin => Err(Denial::forbidden("demo.not_admin")),
        }
    }
}