1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
|
use uuid::Uuid;
use crate::{Secd, SecdError};
pub type Namespace = String;
pub type Object = (Namespace, Uuid);
pub type Relation = String;
pub struct Relationship {
pub subject: Subject,
pub object: Object,
pub relation: Relation,
}
#[derive(Clone)]
pub enum Subject {
User(Object),
UserSet { user: Object, relation: Relation },
}
impl Secd {
pub async fn check(&self, r: &Relationship) -> Result<bool, SecdError> {
let spice = self
.spice
.clone()
.expect("TODO: only supports postgres right now");
Ok(spice.check_permission(r).await?)
}
pub async fn expand(&self) -> Result<(), SecdError> {
todo!()
}
pub async fn read(&self) -> Result<(), SecdError> {
todo!()
}
pub async fn watch(&self) -> Result<(), SecdError> {
unimplemented!()
}
pub async fn write(&self, ts: &[Relationship]) -> Result<(), SecdError> {
let spice = self
.spice
.clone()
.expect("TODO: only supports postgres right now");
// Since spice doesn't really have a great schema pattern, we
// prefix all incoming write relationships with an r_ to indicate
// they are "relationships" rather than what spice calls permissions
spice
.write_relationship(
&ts.into_iter()
.map(|r| Relationship {
subject: r.subject.clone(),
object: r.object.clone(),
relation: format!("r_{}", r.relation),
})
.collect::<Vec<Relationship>>(),
)
.await?;
Ok(())
}
}
|
