Struct PermissionSet 

pub struct PermissionSet(/* private fields */);

Subsumption-aware permission collection.

Implementations

impl PermissionSet

pub fn new() -> Self

Construct an empty set.

pub fn insert(&mut self, permission: Permission)

Insert one permission while keeping the set minimal.

A grant is dropped only when another grant Permission::subsumes it, so an explicit gateway grant survives beside all in either order.

pub fn contains(&self, required: &Permission) -> bool

True if the set covers required.

pub fn contains_object_scoped(&self, required: &Permission) -> bool

True if a grant naming specific objects, not PermissionScope::All, covers required.

A granted gateway deployment admits only such a grant, so the unscoped invoke grant of the built-in Roles never reaches it.

pub fn covers_operation(&self, resource: &Resource, action: &Action) -> bool

True when the set grants action on resource under any object scope.

This is coarse admission, not authorization: it answers “does this principal hold this capability at all”, which is what a public route needs before it can resolve the objects a request actually touches. The authoritative decision is Self::contains against the resolved object, and no caller may substitute this for it.

pub fn intersection( &self, other: &Self, ) -> Result<Self, UnrepresentableIntersection>

The authority both sets grant: every permission covered by self and by other, and nothing else.

Delegation mints with this so a delegated token can never carry more than its caller holds. Each pair of grants meets axis by axis through the same covers relations authorization uses: an AnyOf is split into its members, each axis keeps the narrower side when one covers the other, and a pair with a disjoint axis contributes nothing. A wildcard therefore yields the other grant, and a schema grant meeting a table grant in that schema yields the table grant.

The one meet no scope can state is all against an explicit gateway grant: all reaches only open deployments, so their shared authority is “that deployment, only while it is open”. Such a meet is accepted only when the rest of the result already covers it — both sides also hold all, or both grant the deployment explicitly; otherwise the complete intersection is unrepresentable.

Errors

Returns UnrepresentableIntersection naming the first gateway grant whose shared authority depends on deployment access, so delegation can refuse instead of widening or silently dropping it.

pub fn iter(&self) -> impl Iterator<Item = &Permission>

Iterate over stored permissions.

pub fn len(&self) -> usize

Number of stored permissions.

pub fn is_empty(&self) -> bool

True when empty.

Trait Implementations

impl Clone for PermissionSet

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for PermissionSet

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for PermissionSet

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for PermissionSet

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for PermissionSet

impl FromIterator<Permission> for PermissionSet

fn from_iter<T: IntoIterator<Item = Permission>>(iter: T) -> Self

Creates a value from an iterator.

impl PartialEq for PermissionSet

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for PermissionSet

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for PermissionSet