iet-auth-rbac

Decides permissions from a selected role store; no embedded storage.

How to use it

iet-auth-rbac is an Authorizer that decides named permissions from a selected role store. It extracts the Principal from the CallContext and delegates the allow/deny decision to a RoleStore, so role storage lives in a separate adapter crate and can be swapped without touching call sites.

// crates/features/iet-auth-rbac/tests/rbac.rs
use iet_auth_rbac::Rbac;
use iet_authz::{Authorizer, RoleStore};
use iet_core::{AppResult, CallContext, Principal};

struct Store;
impl RoleStore for Store {
    async fn allows(&self, identity: &Principal, permission: &str) -> AppResult<bool> {
        Ok(identity.subject == "user"
            && identity.profile.as_deref() == Some("buyer")
            && permission == "read")
    }
}

let context = CallContext {
    principal: Some(Principal {
        subject: "user".into(),
        profile: Some("buyer".into()),
    }),
    ..Default::default()
};
Rbac(Store).authorize(&context, "read").await?;
assert!(Rbac(Store).authorize(&context, "write").await.is_err());

• No principal (or an empty subject) fails with auth.required; a denied permission yields authz.denied (Forbidden).
• A store error remains an error rather than a denial, so callers can tell "no" apart from "backend down".
• Composes with iet_authz::{All, Any} and the default-deny DenyPermissions.

How it works

authorize resolves the Principal from the CallContext, rejects an empty or oversized permission, and delegates the allow-or-deny decision to the RoleStore; a store error stays an error.

sequenceDiagram
  participant C as "Caller"
  participant R as "Rbac"
  participant S as "RoleStore"
  C->>R: "authorize context permission"
  alt "checks fail"
    R-->>C: "auth.required or authz.denied"
  else "checks pass"
    R->>S: "allows identity permission"
    S-->>R: "bool"
    alt "allowed"
      R-->>C: "Ok"
    else "denied or error"
      R-->>C: "authz.denied or error"
    end
  end

What it implements

• Implements iet_authz::Authorizer from iet-authz.

What's inside

Modules

• src/lib.rs

Public API

(root)

• struct Rbac

Impl map

• Authorizer for Rbac<S>
• RoleStore for Store

Depends on

• iet-telemetry
• iet-core
• iet-authz

Used by

• No other framework crate depends on it directly.

In this repository

• Not used by a checked-in example yet.

Source: crates/features/iet-auth-rbac