iet-auth-acl

Decides resource access from a selected grant store; explicit and deny-by-default.

How to use it

iet-auth-acl is a ResourceAuthorizer: it decides whether the current principal may perform one action on one specific resource, delegating the decision to a selected AccessStore. It is explicit and deny-by-default, and the grant storage stays in a separate adapter crate.

// crates/features/iet-auth-acl/tests/acl.rs
use iet_auth_acl::Acl;
use iet_authz::{AccessStore, ResourceAuthorizer};
use iet_core::{AppResult, CallContext, Principal};

struct Store;
impl AccessStore for Store {
    async fn allows(&self, identity: &Principal, action: &str, resource: &str) -> AppResult<bool> {
        Ok(identity.subject == "user" && action == "read" && resource == "document:1")
    }
}

let context = CallContext {
    principal: Some(Principal {
        subject: "user".into(),
        profile: None,
    }),
    ..Default::default()
};
Acl(Store).authorize(&context, "read", "document:1").await?;
assert!(Acl(Store).authorize(&context, "write", "document:1").await.is_err());

• Access is bound to the triple (identity, action, resource); a missing principal is auth.required, a refusal is authz.denied.
• Action is bounded to 1024 bytes and resource to 4096; empty values are denied.
• Filter the resource identifier in your store so it cannot be used to widen access.

How it works

authorize resolves the Principal from the CallContext, rejects empty or oversized action and resource values, and asks the AccessStore whether that identity may act on that one resource.

sequenceDiagram
  participant C as "Caller"
  participant A as "Acl"
  participant S as "AccessStore"
  C->>A: "authorize context action resource"
  alt "checks fail"
    A-->>C: "auth.required or authz.denied"
  else "checks pass"
    A->>S: "allows identity action resource"
    S-->>A: "bool"
    alt "allowed"
      A-->>C: "Ok"
    else "denied or error"
      A-->>C: "authz.denied or error"
    end
  end

What it implements

• Implements iet_authz::Authorizer from iet-authz.
• Implements iet_authz::ResourceAuthorizer from iet-authz.

What's inside

Modules

• src/lib.rs

Public API

(root)

• struct Acl

Impl map

• ResourceAuthorizer for Acl<S>
• AccessStore for Store

Depends on

• iet-telemetry
• iet-core
• iet-authz

Used by

• No other framework crate depends on it directly.

In this repository

• Not used by a checked-in example yet.

Source: crates/features/iet-auth-acl