iet-auth-acl-timescale

Persists per-resource grants for ACL policy.

How to use it

Persists resource grants (subject, profile, action, resource) in the fw_auth_grants table and satisfies the iet_authz::AccessStore port. Register the owned table with register(&mut registry) after the shared identity table, then build an AccessStore and optionally attach a profile policy with with_profiles(...).

// examples/htmx-starter/servers/web/tests/framework_live_generated.rs
use iet_authz::AccessStore as _;

// Registration (framework_auth_common/mod.rs): identity first, then the capability.
let mut registry = EntityRegistry::default();
iet_auth_identity_timescale::register(&mut registry)?;
iet_auth_acl_timescale::register(&mut registry)?;

// Construct the store; `NoProfiles` is the default until a policy is attached.
let acl = iet_auth_acl_timescale::AccessStore::new(db.clone());
let profiled_acl = acl.clone().with_profiles(profiles.clone());

let allowed = profiled_acl.allows(&identity, "read", "document:1").await?;
assert!(allowed);

• The profile policy is re-checked after the database read, so disabling a profile fails closed.
• Empty or oversized action/resource values are rejected before any query.

How it works

AccessStore::allows validates the action and resource, consults the attached ProfileStore policy, then runs one repository::allows query that joins fw_auth_grants with fw_auth_identities; the policy is checked again before returning the decision.

flowchart LR
  Call["AccessStore allows"] --> Store["AccessStore"]
  Store --> Check["valid action and resource"]
  Store --> Policy["profile_enabled"]
  Policy --> Prof["ProfileStore"]
  Check --> Repo["repository allows"]
  Policy --> Repo
  Repo --> Grants["fw_auth_grants"]
  Repo --> Id["fw_auth_identities"]
  Repo --> Dec["true or false"]

What it implements

• Implements iet_authz::AccessStore from iet-authz.
• Implements iet_auth::ProfileStore (policy) from iet-auth.

Database schema

The details below come from #[derive(Persistent)] entity metadata:

fw_auth_grants

Entity Grant (hard delete).

Foreign key auth_grant_subject: (subject) → fw_auth_identities (id)

Entities register into an EntityRegistry; EntityRegistry::initial emits a reviewed migration pair, and Migrations applies reviewed files. See iet-db-timescale and iet-db.

What's inside

Modules

• src/entity.rs
• src/lib.rs
• src/repository.rs
• src/stores.rs

Public API

(root)

• pub fn register(registry: &mut EntityRegistry) -> AppResult<()> — Register only grants; register the shared identity table separately.

entity

• struct Grant

stores

• struct AccessStore
• pub fn new(database: TimescaleDatabase) -> Self
• pub fn with_profiles<Q: ProfileStore>(self, profiles: Q) -> AccessStore<Q>

Impl map

• iet_authz::AccessStore for AccessStore<P>

Depends on

• iet-telemetry
• iet-core
• iet-auth
• iet-authz
• iet-db-timescale
• iet-db-macros

External crates: sqlx, uuid

Used by

• No other framework crate depends on it directly.

In this repository

• examples/htmx-starter

Source: crates/integrations/iet-auth-acl-timescale