iet-auth-rbac-timescale

Persists roles, permissions, and assignments for RBAC policy.

How to use it

Owns fw_auth_roles, fw_auth_permissions, and fw_auth_role_assignments and implements iet_authz::RoleStore. Register it after the identity table, then attach an optional profile policy with with_profiles(...) so a disabled persona stops granting permissions.

// examples/htmx-starter/servers/web/tests/framework_live_generated.rs
use iet_authz::RoleStore as _;

// Registration (framework_auth_common/mod.rs): identity first, then the capability.
let mut registry = EntityRegistry::default();
iet_auth_identity_timescale::register(&mut registry)?;
iet_auth_rbac_timescale::register(&mut registry)?;

let roles = iet_auth_rbac_timescale::RoleStore::new(db.clone());
let profiled_roles = roles.clone().with_profiles(profiles.clone());

let allowed = profiled_roles.allows(&identity, "read").await?;

• Assignments are keyed by (subject, profile, role); the empty profile covers identity-only principals.
• Disabling a role, or a profile, immediately denies (allows returns false), not an error.

How it works

RoleStore::allows checks the attached ProfileStore policy, then runs one repository::allows query that joins fw_auth_role_assignments through fw_auth_roles and fw_auth_permissions, requiring an enabled fw_auth_identities row; it re-checks the policy before returning.

flowchart LR
  Call["RoleStore allows"] --> Policy["profile_enabled"]
  Policy --> Store["ProfileStore"]
  Policy --> Repo["repository allows"]
  Repo --> Assign["fw_auth_role_assignments"]
  Repo --> Roles["fw_auth_roles"]
  Repo --> Perm["fw_auth_permissions"]
  Repo --> Id["fw_auth_identities"]

What it implements

• Implements iet_authz::RoleStore from iet-authz.
• Implements iet_auth::ProfileStore (policy) from iet-auth.

Database schema

The details below come from #[derive(Persistent)] entity metadata:

fw_auth_roles

Entity Role (hard delete).

fw_auth_permissions

Entity Permission (hard delete).

Foreign key auth_permission_role: (role) → fw_auth_roles (role)

fw_auth_role_assignments

Entity RoleAssignment (hard delete).

Foreign key auth_assignment_subject: (subject) → fw_auth_identities (id)

Foreign key auth_assignment_role: (role) → fw_auth_roles (role)

Entities register into an EntityRegistry; EntityRegistry::initial emits a reviewed migration pair, and Migrations applies reviewed files. See iet-db-timescale and iet-db.

What's inside

Modules

• src/entity.rs
• src/lib.rs
• src/repository.rs
• src/stores.rs

Public API

(root)

• pub fn register(registry: &mut EntityRegistry) -> AppResult<()> — Register only RBAC tables; register the shared identity table separately.

entity

• struct Role
• struct Permission
• struct RoleAssignment

stores

• struct RoleStore
• pub fn new(database: TimescaleDatabase) -> Self
• pub fn with_profiles<Q: ProfileStore>(self, profiles: Q) -> RoleStore<Q>

Impl map

• iet_authz::RoleStore for RoleStore<P>

Depends on

• iet-telemetry
• iet-core
• iet-auth
• iet-authz
• iet-db-timescale
• iet-db-macros

External crates: sqlx, uuid

Used by

• No other framework crate depends on it directly.

In this repository

• examples/htmx-starter

Source: crates/integrations/iet-auth-rbac-timescale