README
- ::newCheckRequest::new
- ::to_jsonCheckResult::to_json
T
DecisionChange
T
DecisionChangeKind
- ::keyObjectRef::key
- ::newObjectRef::new
- ::add_rulePolicyEngine::add_rule
- ::add_tuplePolicyEngine::add_tuple
- ::checkPolicyEngine::check
- ::check_manyPolicyEngine::check_many
- ::filter_allowedPolicyEngine::filter_allowed
- ::newPolicyEngine::new
- ::remove_tuplePolicyEngine::remove_tuple
- ::rule_countPolicyEngine::rule_count
- ::statsPolicyEngine::stats
- ::to_jsonPolicyEngine::to_json
- ::tuple_countPolicyEngine::tuple_count
- ::validatePolicyEngine::validate
- ::has_privilege_expansionPolicyImpactReport::has_privilege_expansion
- ::to_jsonPolicyImpactReport::to_json
- ::direct_allowPolicyRule::direct_allow
- ::direct_denyPolicyRule::direct_deny
- ::traverse_allowPolicyRule::traverse_allow
- ::traverse_denyPolicyRule::traverse_deny
- ::to_jsonPolicyStats::to_json
- ::keyRelationTuple::key
- ::newRelationTuple::new
- ::directSubjectRef::direct
- ::keySubjectRef::key
- ::objectSubjectRef::object
- ::usersetSubjectRef::userset
T
ValidationIssue
V
analyze_policy_impact

moonpolicykit

A backend-neutral, explainable relationship-based authorization toolkit for MoonBit.

authorization

policy

rbac

rebac

access-control

Download zip

Author

jhshuai

Version

0.2.0

License

Apache-2.0

Repository

github.com/jhshuai/MoonPolicyKit

Last updated

2 months ago

Downloads

#MoonPolicyKit API

MoonPolicyKit provides explainable relationship-based authorization primitives for MoonBit applications.

#Core API

ObjectRef::new
SubjectRef::direct
SubjectRef::userset
RelationTuple::new
PolicyRule::direct_allow
PolicyRule::direct_deny
PolicyRule::traverse_allow
PolicyRule::traverse_deny
PolicyEngine::check
PolicyEngine::check_many
PolicyEngine::filter_allowed
PolicyEngine::validate
PolicyEngine::stats
PolicyEngine::to_json

CheckResult includes the final decision, reason, traversal depth, cycle flag, and proof steps used to reach the decision.

CheckRequest

source

pub(all) struct CheckRequest {
  object : ObjectRef
  permission : String
  principal : SubjectRef
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

CheckRequest::new

source

fn CheckRequest::new(object : ObjectRef, permission : String, principal : SubjectRef) -> CheckRequest

CheckResult

source

pub(all) struct CheckResult {
  allowed : Bool
  denied : Bool
  reason : String
  steps : Array[String]
  max_depth_seen : Int
  cycle_detected : Bool
} derive(@moonbitlang/core/debug.Debug
Debug)

CheckResult::to_json

source

fn CheckResult::to_json(self : CheckResult) -> String

DecisionChange

source

pub(all) struct DecisionChange {
  request : CheckRequest
  kind : DecisionChangeKind
  before : CheckResult
  after : CheckResult
} derive(@moonbitlang/core/debug.Debug
Debug)

DecisionChangeKind

source

pub(all) enum DecisionChangeKind {
  NewlyAllowed
  NewlyDenied
  Unchanged
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

ObjectRef

source

pub(all) struct ObjectRef {
  kind : String
  id : String
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

ObjectRef::key

source

fn ObjectRef::key(self : ObjectRef) -> String

ObjectRef::new

source

fn ObjectRef::new(kind : String, id : String) -> ObjectRef

PolicyEngine

source

pub(all) struct PolicyEngine {
  tuples : Array[RelationTuple]
  rules : Array[PolicyRule]
  max_depth : Int
} derive(@moonbitlang/core/debug.Debug
Debug)

PolicyEngine::add_rule

source

fn PolicyEngine::add_rule(self : PolicyEngine, rule : PolicyRule) -> Bool

PolicyEngine::add_tuple

source

fn PolicyEngine::add_tuple(self : PolicyEngine, tuple : RelationTuple) -> Bool

PolicyEngine::check

source

fn PolicyEngine::check(self : PolicyEngine, object : ObjectRef, permission : String, principal : SubjectRef) -> CheckResult

PolicyEngine::check_many

source

fn PolicyEngine::check_many(self : PolicyEngine, requests : Array[CheckRequest]) -> Array[CheckResult]

PolicyEngine::filter_allowed

source

fn PolicyEngine::filter_allowed(self : PolicyEngine, objects : Array[ObjectRef], permission : String, principal : SubjectRef) -> Array[ObjectRef]

PolicyEngine::new

source

fn PolicyEngine::new(max_depth? : Int) -> PolicyEngine

PolicyEngine::remove_tuple

source

fn PolicyEngine::remove_tuple(self : PolicyEngine, tuple : RelationTuple) -> Bool

PolicyEngine::rule_count

source

fn PolicyEngine::rule_count(self : PolicyEngine) -> Int

PolicyEngine::stats

source

fn PolicyEngine::stats(self : PolicyEngine) -> PolicyStats

PolicyEngine::to_json

source

fn PolicyEngine::to_json(self : PolicyEngine) -> String

PolicyEngine::tuple_count

source

fn PolicyEngine::tuple_count(self : PolicyEngine) -> Int

PolicyEngine::validate

source

fn PolicyEngine::validate(self : PolicyEngine) -> Array[ValidationIssue]

PolicyImpactReport

source

pub(all) struct PolicyImpactReport {
  changes : Array[DecisionChange]
  newly_allowed : Int
  newly_denied : Int
  unchanged : Int
} derive(@moonbitlang/core/debug.Debug
Debug)

PolicyImpactReport::has_privilege_expansion

source

fn PolicyImpactReport::has_privilege_expansion(self : PolicyImpactReport) -> Bool

PolicyImpactReport::to_json

source

fn PolicyImpactReport::to_json(self : PolicyImpactReport) -> String

PolicyRule

source

pub(all) struct PolicyRule {
  object_namespace : String
  permission : String
  source_relation : String
  target_permission : String
  effect : Int
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

PolicyRule::direct_allow

source

fn PolicyRule::direct_allow(object_namespace : String, permission : String, source_relation : String) -> PolicyRule

PolicyRule::direct_deny

source

fn PolicyRule::direct_deny(object_namespace : String, permission : String, source_relation : String) -> PolicyRule

PolicyRule::traverse_allow

source

fn PolicyRule::traverse_allow(object_namespace : String, permission : String, source_relation : String, target_permission : String) -> PolicyRule

PolicyRule::traverse_deny

source

fn PolicyRule::traverse_deny(object_namespace : String, permission : String, source_relation : String, target_permission : String) -> PolicyRule

PolicyStats

source

pub(all) struct PolicyStats {
  tuples : Int
  rules : Int
  object_kinds : Int
  relations : Int
  permissions : Int
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

PolicyStats::to_json

source

fn PolicyStats::to_json(self : PolicyStats) -> String

RelationTuple

source

pub(all) struct RelationTuple {
  object : ObjectRef
  relation : String
  subject : SubjectRef
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

RelationTuple::key

source

fn RelationTuple::key(self : RelationTuple) -> String

RelationTuple::new

source

fn RelationTuple::new(object : ObjectRef, relation : String, subject : SubjectRef) -> RelationTuple

SubjectRef

source

pub(all) struct SubjectRef {
  kind : String
  id : String
  relation : String
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

SubjectRef::direct

source

fn SubjectRef::direct(kind : String, id : String) -> SubjectRef

SubjectRef::key

source

fn SubjectRef::key(self : SubjectRef) -> String

SubjectRef::object

source

fn SubjectRef::object(self : SubjectRef) -> ObjectRef

SubjectRef::userset

source

fn SubjectRef::userset(kind : String, id : String, relation : String) -> SubjectRef

ValidationIssue

source

pub(all) struct ValidationIssue {
  code : String
  message : String
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

analyze_policy_impact

source

fn analyze_policy_impact(before : PolicyEngine, after : PolicyEngine, requests : Array[CheckRequest]) -> PolicyImpactReport

Compares two policy engines over an explicit, deterministic request set.

Newly allowed decisions represent privilege expansion and should normally receive security review before deployment.

Source Files

Site source Report issue Packages Build queue Skills Statistics

moonpolicykit

#MoonPolicyKit API

#Core API

#CheckRequest

#CheckRequest::new

#CheckResult

#CheckResult::to_json

#DecisionChange

#DecisionChangeKind

#ObjectRef

#ObjectRef::key

#ObjectRef::new

#PolicyEngine

#PolicyEngine::add_rule

#PolicyEngine::add_tuple

#PolicyEngine::check

#PolicyEngine::check_many

#PolicyEngine::filter_allowed

#PolicyEngine::new

#PolicyEngine::remove_tuple

#PolicyEngine::rule_count

#PolicyEngine::stats

#PolicyEngine::to_json

#PolicyEngine::tuple_count

#PolicyEngine::validate

#PolicyImpactReport

#PolicyImpactReport::has_privilege_expansion

#PolicyImpactReport::to_json

#PolicyRule

#PolicyRule::direct_allow

#PolicyRule::direct_deny

#PolicyRule::traverse_allow

#PolicyRule::traverse_deny

#PolicyStats

#PolicyStats::to_json

#RelationTuple

#RelationTuple::key

#RelationTuple::new

#SubjectRef

#SubjectRef::direct

#SubjectRef::key

#SubjectRef::object

#SubjectRef::userset

#ValidationIssue

#analyze_policy_impact

Source Files

CheckRequest

CheckRequest::new

CheckResult

CheckResult::to_json

DecisionChange

DecisionChangeKind

ObjectRef

ObjectRef::key

ObjectRef::new

PolicyEngine

PolicyEngine::add_rule

PolicyEngine::add_tuple

PolicyEngine::check

PolicyEngine::check_many

PolicyEngine::filter_allowed

PolicyEngine::new

PolicyEngine::remove_tuple

PolicyEngine::rule_count

PolicyEngine::stats

PolicyEngine::to_json

PolicyEngine::tuple_count

PolicyEngine::validate

PolicyImpactReport

PolicyImpactReport::has_privilege_expansion

PolicyImpactReport::to_json

PolicyRule

PolicyRule::direct_allow

PolicyRule::direct_deny

PolicyRule::traverse_allow

PolicyRule::traverse_deny

PolicyStats

PolicyStats::to_json

RelationTuple

RelationTuple::key

RelationTuple::new

SubjectRef

SubjectRef::direct

SubjectRef::key

SubjectRef::object

SubjectRef::userset

ValidationIssue

analyze_policy_impact