Crate headless_lms_authorization 

Decides whether a user may perform an Action on a Resource.

A passing check hands out an AuthorizationToken. Its only field is private, so the token cannot be forged outside this crate and therefore proves that a check was made; callers that answer requests are expected to require one before responding.

Modules

error

Contains error and result types for the authorization checks.

Structs

ActionOnResource

AuthorizationToken

Proof that an authorization check passed.

Enums

Action

Describes an action that a user can take on some resource.

Resource

The target of an action.

RoleSource 🔒

Where a check gets the user’s roles: a snapshot the caller already holds, or a query this crate runs only if the check gets far enough to need one.

Functions

access_to_chatbot 🔒

access_to_course_material 🔒

authorize

Checks whether the user may perform action on resource, fetching their roles.

authorize_access_to_chatbot

Handles authorization for global chatbots and course chatbots

authorize_access_to_chatbot_with_fetched_list_of_roles

Same as authorize_access_to_chatbot, but takes already-fetched roles instead of querying for them.

authorize_access_to_course_material

Checks whether the user may view course material.

authorize_access_to_course_material_with_fetched_list_of_roles

Same as authorize_access_to_course_material, but takes already-fetched roles instead of querying for them.

authorize_with_fetched_list_of_roles

Same as authorize, but takes already-fetched roles instead of querying for them; use when checking several actions for the same user.

can_user_view_chapter

Checks whether the user may view a chapter, which may be closed to everyone but certain roles.

can_user_view_chapter_with_fetched_list_of_roles

Same as can_user_view_chapter, but takes already-fetched roles instead of querying for them.

check_course_instance_permission 🔒

Also checks organization and course roles which are valid for course instances.

check_course_or_exam_permission 🔒

check_course_permission 🔒

Also checks organization role which is valid for courses.

check_exam_permission 🔒

Also checks organization role which is valid for exams.

check_organization_permission 🔒

check_study_registry_permission 🔒

create_authorization_error 🔒

Builds the generic Forbidden error shown to the user, nesting the actual roles and attempted action in the source error so they only surface in logs.

fetch_user_roles

The roles a user holds, for callers that check several permissions and want to pay for the roles query once by passing the result to authorize_with_fetched_list_of_roles.

has_permission 🔒

is_permitted

Whether user_roles allow action on resource.

is_user_global_admin

Whether the user holds a global admin role.

skip_authorize

Skips authorize(), for anonymous and test-user code paths where there is no user to check.

user_can_view_chapter 🔒