🥮 mooncakes.io

moonpolicykit

A backend-neutral, explainable relationship-based authorization toolkit for MoonBit.

authorization
policy
rbac
rebac
access-control
moon add jhshuai/moonpolicykit@0.2.0
Download zip
Author
Version
0.2.0
License
Apache-2.0
Repository
Last updated
last month
Downloads
11
README

#MoonPolicyKit API

MoonPolicyKit provides explainable relationship-based authorization primitives for MoonBit applications.

#Core API

  • ObjectRef::new
  • SubjectRef::direct
  • SubjectRef::userset
  • RelationTuple::new
  • PolicyRule::direct_allow
  • PolicyRule::direct_deny
  • PolicyRule::traverse_allow
  • PolicyRule::traverse_deny
  • PolicyEngine::check
  • PolicyEngine::check_many
  • PolicyEngine::filter_allowed
  • PolicyEngine::validate
  • PolicyEngine::stats
  • PolicyEngine::to_json

CheckResult includes the final decision, reason, traversal depth, cycle flag, and proof steps used to reach the decision.

#
CheckRequest

source
pub(all) struct CheckRequest {
  object : ObjectRef
  permission : String
  principal : SubjectRef
} derive(Eq, 
Debug)

#
CheckRequest::new

source
fn CheckRequest::new(object : ObjectRef, permission : String, principal : SubjectRef) -> CheckRequest

#
CheckResult

source
pub(all) struct CheckResult {
  allowed : Bool
  denied : Bool
  reason : String
  steps : Array[String]
  max_depth_seen : Int
  cycle_detected : Bool
} derive(
Debug)

#
CheckResult::to_json

source
fn CheckResult::to_json(self : CheckResult) -> String

#
DecisionChange

source
pub(all) struct DecisionChange {
  request : CheckRequest
  kind : DecisionChangeKind
  before : CheckResult
  after : CheckResult
} derive(
Debug)

#
DecisionChangeKind

source
pub(all) enum DecisionChangeKind {
  NewlyAllowed
  NewlyDenied
  Unchanged
} derive(Eq, 
Debug)

#
ObjectRef

source
pub(all) struct ObjectRef {
  kind : String
  id : String
} derive(Eq, 
Debug)

#
ObjectRef::key

source
fn ObjectRef::key(self : ObjectRef) -> String

#
ObjectRef::new

source
fn ObjectRef::new(kind : String, id : String) -> ObjectRef

#
PolicyEngine

source
pub(all) struct PolicyEngine {
  tuples : Array[RelationTuple]
  rules : Array[PolicyRule]
  max_depth : Int
} derive(
Debug)

#
PolicyEngine::add_rule

source
fn PolicyEngine::add_rule(self : PolicyEngine, rule : PolicyRule) -> Bool

#
PolicyEngine::add_tuple

source
fn PolicyEngine::add_tuple(self : PolicyEngine, tuple : RelationTuple) -> Bool

#
PolicyEngine::check

source
fn PolicyEngine::check(self : PolicyEngine, object : ObjectRef, permission : String, principal : SubjectRef) -> CheckResult

#
PolicyEngine::check_many

source
fn PolicyEngine::check_many(self : PolicyEngine, requests : Array[CheckRequest]) -> Array[CheckResult]

#
PolicyEngine::filter_allowed

source
fn PolicyEngine::filter_allowed(self : PolicyEngine, objects : Array[ObjectRef], permission : String, principal : SubjectRef) -> Array[ObjectRef]

#
PolicyEngine::new

source
fn PolicyEngine::new(max_depth? : Int) -> PolicyEngine

#
PolicyEngine::remove_tuple

source
fn PolicyEngine::remove_tuple(self : PolicyEngine, tuple : RelationTuple) -> Bool

#
PolicyEngine::rule_count

source
fn PolicyEngine::rule_count(self : PolicyEngine) -> Int

#
PolicyEngine::stats

source

#
PolicyEngine::to_json

source
fn PolicyEngine::to_json(self : PolicyEngine) -> String

#
PolicyEngine::tuple_count

source
fn PolicyEngine::tuple_count(self : PolicyEngine) -> Int

#
PolicyEngine::validate

source

#
PolicyImpactReport

source
pub(all) struct PolicyImpactReport {
  changes : Array[DecisionChange]
  newly_allowed : Int
  newly_denied : Int
  unchanged : Int
} derive(
Debug)

#
PolicyImpactReport::has_privilege_expansion

source
fn PolicyImpactReport::has_privilege_expansion(self : PolicyImpactReport) -> Bool

#
PolicyImpactReport::to_json

source
fn PolicyImpactReport::to_json(self : PolicyImpactReport) -> String

#
PolicyRule

source
pub(all) struct PolicyRule {
  object_namespace : String
  permission : String
  source_relation : String
  target_permission : String
  effect : Int
} derive(Eq, 
Debug)

#
PolicyRule::direct_allow

source
fn PolicyRule::direct_allow(object_namespace : String, permission : String, source_relation : String) -> PolicyRule

#
PolicyRule::direct_deny

source
fn PolicyRule::direct_deny(object_namespace : String, permission : String, source_relation : String) -> PolicyRule

#
PolicyRule::traverse_allow

source
fn PolicyRule::traverse_allow(object_namespace : String, permission : String, source_relation : String, target_permission : String) -> PolicyRule

#
PolicyRule::traverse_deny

source
fn PolicyRule::traverse_deny(object_namespace : String, permission : String, source_relation : String, target_permission : String) -> PolicyRule

#
PolicyStats

source
pub(all) struct PolicyStats {
  tuples : Int
  rules : Int
  object_kinds : Int
  relations : Int
  permissions : Int
} derive(Eq, 
Debug)

#
PolicyStats::to_json

source
fn PolicyStats::to_json(self : PolicyStats) -> String

#
RelationTuple

source
pub(all) struct RelationTuple {
  object : ObjectRef
  relation : String
  subject : SubjectRef
} derive(Eq, 
Debug)

#
RelationTuple::key

source
fn RelationTuple::key(self : RelationTuple) -> String

#
RelationTuple::new

source
fn RelationTuple::new(object : ObjectRef, relation : String, subject : SubjectRef) -> RelationTuple

#
SubjectRef

source
pub(all) struct SubjectRef {
  kind : String
  id : String
  relation : String
} derive(Eq, 
Debug)

#
SubjectRef::direct

source
fn SubjectRef::direct(kind : String, id : String) -> SubjectRef

#
SubjectRef::key

source
fn SubjectRef::key(self : SubjectRef) -> String

#
SubjectRef::object

source
fn SubjectRef::object(self : SubjectRef) -> ObjectRef

#
SubjectRef::userset

source
fn SubjectRef::userset(kind : String, id : String, relation : String) -> SubjectRef

#
ValidationIssue

source
pub(all) struct ValidationIssue {
  code : String
  message : String
} derive(Eq, 
Debug)

#
analyze_policy_impact

source
fn analyze_policy_impact(before : PolicyEngine, after : PolicyEngine, requests : Array[CheckRequest]) -> PolicyImpactReport

Compares two policy engines over an explicit, deterministic request set.

Newly allowed decisions represent privilege expansion and should normally receive security review before deployment.

Source Files

Powered by MoonBit

Site sourceReport issuePackagesBuild queueSkillsStatistics

© 2026 mooncakes.io