1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
|
#![allow(dead_code)] // TODO: Remove when implemented
#![allow(unused_variables)]
mod graph;
use crate::{Authorization, Secd, SecdError};
use async_trait::async_trait;
use uuid::Uuid;
pub type Namespace = String;
pub type Object = (Namespace, Uuid);
pub type Relation = String;
pub struct Relationship {
pub subject: Subject,
pub object: Object,
pub relation: Relation,
}
#[derive(Clone)]
pub enum Subject {
User(Object),
UserSet { user: Object, relation: Relation },
}
#[async_trait]
impl Authorization for Secd {
async fn check(&self, r: &Relationship) -> Result<bool, SecdError> {
let spice = self
.spice
.clone()
.expect("TODO: only supports postgres right now");
Ok(spice.check_permission(r).await?)
}
async fn expand(&self) -> Result<(), SecdError> {
todo!()
}
async fn read(&self) -> Result<(), SecdError> {
todo!()
}
async fn watch(&self) -> Result<(), SecdError> {
unimplemented!()
}
async fn write(&self, ts: &[Relationship]) -> Result<(), SecdError> {
let spice = self
.spice
.clone()
.expect("TODO: only supports postgres right now");
// Since spice doesn't really have a great schema pattern, we
// prefix all incoming write relationships with an r_ to indicate
// they are "relationships" rather than what spice calls permissions
spice
.write_relationship(
&ts.iter()
.map(|r| Relationship {
subject: r.subject.clone(),
object: r.object.clone(),
relation: format!("r_{}", r.relation),
})
.collect::<Vec<Relationship>>(),
)
.await?;
Ok(())
}
}
enum RelationToken {
Start,
Or,
And,
Exclude,
}
struct RelationContainer {
name: Relation,
bins: Vec<(RelationToken, Relation)>,
}
struct NamespaceContainer {
relations: Vec<RelationContainer>,
}
impl Secd {
async fn write_namespace(&self, ns: &NamespaceContainer) -> Result<(), SecdError> {
todo!()
}
async fn read_namespace(&self) -> Result<NamespaceContainer, SecdError> {
todo!()
}
}
|
