Skip to content

Commit 753d507

Browse files
RushitRushit Patel
Rushit
authored and
Rushit Patel
committed
feat: zanzibar style authorization (authz) core
0 parents  commit 753d507

25 files changed

Lines changed: 5443 additions & 0 deletions

‎.cargo/config.toml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
# No platform-specific linker flags needed for authz-core (no pgrx).

‎.githooks/commit-msg‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
#!/bin/sh
2+
# Commit-msg: reject "authorized by cursor", Co-authored-by, and enforce conventional commit (feat:, fix:, etc.)
3+
4+
msg_file="$1"
5+
if [ ! -f "$msg_file" ]; then
6+
echo "commit-msg: no message file" >&2
7+
exit 1
8+
fi
9+
10+
11+
# Reject Co-authored-by trailers
12+
if grep -qiE 'co-authored-by:' "$msg_file"; then
13+
echo "commit-msg: commit message must not contain 'Co-authored-by' with agent tags." >&2
14+
exit 1
15+
fi
16+
17+
# First line: conventional commit (type: message or type(scope): message)
18+
# Types: feat, fix, docs, style, refactor, perf, test, ci, chore, build
19+
# Allow: Merge..., Revert "...", and blank first line only for squash/merge
20+
first_line=$(sed -n '1p' "$msg_file")
21+
if [ -z "$first_line" ]; then
22+
echo "commit-msg: first line of commit message must not be empty." >&2
23+
exit 1
24+
fi
25+
if echo "$first_line" | grep -qE '^(Merge |Revert ")'; then
26+
: # merge or revert, allow
27+
elif ! echo "$first_line" | grep -qE '^(feat|fix|docs|style|refactor|perf|test|ci|chore|build)(\([^)]+\))?!?: .+'; then
28+
echo "commit-msg: first line must follow conventional commits, e.g. feat: add xyz, fix(scope): bar." >&2
29+
echo " Allowed types: feat, fix, docs, style, refactor, perf, test, ci, chore, build" >&2
30+
exit 1
31+
fi
32+
exit 0

‎.githooks/pre-commit‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
#!/bin/sh
2+
# Pre-commit: run make fmt and reject if formatting changed files (so you re-add and commit).
3+
4+
set -e
5+
cd "$(git rev-parse --show-toplevel)"
6+
7+
# Stash unstaged changes so we only format what's staged (optional: format all)
8+
# Run fmt on the repo; if it changes anything, fail so user can re-add and commit.
9+
make fmt
10+
11+
make ci || exit 1
12+
13+
# If fmt changed any tracked files, they're now modified; reject so user re-adds.
14+
if ! git diff --quiet; then
15+
echo "make fmt changed some files. Please stage the changes and commit again:"
16+
echo " git add -u && git commit"
17+
exit 1
18+
fi
19+
exit 0

‎.github/workflows/ci.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
branches: [main]
8+
9+
env:
10+
CARGO_TERM_COLOR: always
11+
12+
jobs:
13+
ci:
14+
name: CI
15+
runs-on: ubuntu-latest
16+
steps:
17+
- uses: actions/checkout@v4
18+
19+
- name: Install Rust
20+
uses: dtolnay/rust-toolchain@stable
21+
with:
22+
components: rustfmt, clippy
23+
24+
- name: Cache cargo
25+
uses: actions/cache@v4
26+
with:
27+
path: |
28+
~/.cargo/registry
29+
~/.cargo/git
30+
target
31+
key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
32+
restore-keys: |
33+
${{ runner.os }}-cargo-
34+
35+
- name: Run CI
36+
run: make ci

‎.gitignore‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
# Rust build artifacts
2+
/target/
3+
Cargo.lock
4+
5+
# Editor / IDE
6+
.vscode/
7+
.idea/
8+
*.iml
9+
*.swp
10+
*.swo
11+
*~
12+
13+
# macOS
14+
.DS_Store
15+
.AppleDouble
16+
.LSOverride
17+
18+
# Environment / secrets
19+
.env
20+
.env.*
21+
*.pem
22+
*.key
23+
24+
# Test and benchmark output
25+
/flamegraph.svg
26+
/perf.data
27+
/perf.data.old
28+
29+
# Coverage
30+
/lcov.info
31+
/coverage/
32+
tarpaulin-report.html
33+
tarpaulin-report.json
34+
35+
# Generated docs (local build)
36+
/doc/

‎Cargo.toml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
[package]
2+
name = "authz-core"
3+
version = "0.1.0"
4+
edition = "2024"
5+
description = "Zanzibar-style authorization engine — model parser, resolver, policy traits, and CEL condition evaluation"
6+
license = "Apache-2.0"
7+
repository = "https://github.com/YOUR_ORG/authz-core"
8+
documentation = "https://docs.rs/authz-core"
9+
readme = "README.md"
10+
keywords = ["authorization", "zanzibar", "rbac", "abac", "fga"]
11+
categories = ["authentication"]
12+
13+
[dependencies]
14+
async-trait = "0.1.80"
15+
pest = "2.7.10"
16+
pest_derive = "2.7.10"
17+
tokio = { version = "1", features = ["sync", "rt-multi-thread"] }
18+
futures = "0.3"
19+
thiserror = "2"
20+
tracing = "0.1"
21+
opentelemetry = "0.21"
22+
serde = { version = "1.0", features = ["derive"] }
23+
serde_json = "1"
24+
# CEL (Common Expression Language) — merged from authz-cel
25+
cel = "0.12.0"
26+
27+
[dev-dependencies]
28+
tokio = { version = "1", features = ["rt", "macros"] }
29+
pretty_assertions = "1.4.0"

‎LICENSE‎

Lines changed: 198 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,198 @@
1+
Copyright 2026 authz-core Contributors
2+
3+
Apache License
4+
Version 2.0, January 2004
5+
http://www.apache.org/licenses/
6+
7+
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
8+
9+
1. Definitions.
10+
11+
"License" shall mean the terms and conditions for use, reproduction,
12+
and distribution as defined by Sections 1 through 9 of this document.
13+
14+
"Licensor" shall mean the copyright owner or entity authorized by
15+
the copyright owner that is granting the License.
16+
17+
"Legal Entity" shall mean the union of the acting entity and all
18+
other entities that control, are controlled by, or are under common
19+
control with that entity. For the purposes of this definition,
20+
"control" means (i) the power, direct or indirect, to cause the
21+
direction or management of such entity, whether by contract or
22+
otherwise, or (ii) ownership of fifty percent (50%) or more of the
23+
outstanding shares, or (iii) beneficial ownership of such entity.
24+
25+
"You" (or "Your") shall mean an individual or Legal Entity
26+
exercising permissions granted by this License.
27+
28+
"Source" form shall mean the preferred form for making modifications,
29+
including but not limited to software source code, documentation
30+
source, and configuration files.
31+
32+
"Object" form shall mean any form resulting from mechanical
33+
transformation or translation of a Source form, including but
34+
not limited to compiled object code, generated documentation,
35+
and conversions to other media types.
36+
37+
"Work" shall mean the work of authorship, whether in Source or
38+
Object form, made available under the License, as indicated by a
39+
copyright notice that is included in or attached to the work
40+
(an example is provided in the Appendix below).
41+
42+
"Derivative Works" shall mean any work, whether in Source or Object
43+
form, that is based on (or derived from) the Work and for which the
44+
editorial revisions, annotations, elaborations, or other modifications
45+
represent, as a whole, an original work of authorship. For the purposes
46+
of this License, Derivative Works shall not include works that remain
47+
separable from, or merely link (or bind by name) to the interfaces of,
48+
the Work and Derivative Works thereof.
49+
50+
"Contribution" shall mean any work of authorship, including the original
51+
version of the Work and any modifications or additions to that Work or
52+
Derivative Works thereof, that is intentionally submitted to the Licensor
53+
for inclusion in the Work by the copyright owner or by an individual or
54+
Legal Entity authorized to submit on behalf of the copyright owner. For
55+
the purposes of this definition, "submitted" means any form of electronic,
56+
verbal, or written communication sent to the Licensor or its
57+
representatives, including but not limited to communication on electronic
58+
mailing lists, source code control systems, and issue tracking systems
59+
that are managed by, or on behalf of, the Licensor for the purpose of
60+
discussing and improving the Work, but excluding communication that is
61+
conspicuously marked or otherwise designated in writing by the copyright
62+
owner as "Not a Contribution."
63+
64+
"Contributor" shall mean Licensor and any individual or Legal Entity
65+
on behalf of whom a Contribution has been received by the Licensor and
66+
subsequently incorporated within the Work.
67+
68+
2. Grant of Copyright License. Subject to the terms and conditions of
69+
this License, each Contributor hereby grants to You a perpetual,
70+
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
71+
copyright license to reproduce, prepare Derivative Works of,
72+
publicly display, publicly perform, sublicense, and distribute the
73+
Work and such Derivative Works in Source or Object form.
74+
75+
3. Grant of Patent License. Subject to the terms and conditions of
76+
this License, each Contributor hereby grants to You a perpetual,
77+
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
78+
(except as stated in this section) patent license to make, have made,
79+
use, offer to sell, sell, import, and otherwise transfer the Work,
80+
where such license applies only to those patent claims licensable by
81+
such Contributor that are necessarily infringed by their Contribution(s)
82+
alone or by combination of their Contribution(s) with the Work to which
83+
such Contribution(s) was submitted. If You institute patent litigation
84+
against any entity (including a cross-claim or counterclaim in a
85+
lawsuit) alleging that the Work or a Contribution incorporated within
86+
the Work constitutes direct or contributory patent infringement, then
87+
any patent licenses granted to You under this License for that Work
88+
shall terminate as of the date such litigation is filed.
89+
90+
4. Redistribution. You may reproduce and distribute copies of the Work
91+
or Derivative Works thereof in any medium, with or without
92+
modifications, and in Source or Object form, provided that You meet
93+
the following conditions:
94+
95+
(a) You must give any other recipients of the Work or Derivative Works
96+
a copy of this License; and
97+
98+
(b) You must cause any modified files to carry prominent notices
99+
stating that You changed the files; and
100+
101+
(c) You must retain, in the Source form of any Derivative Works that
102+
You distribute, all copyright, patent, trademark, and attribution
103+
notices from the Source form of the Work, excluding those notices
104+
that do not pertain to any part of the Derivative Works; and
105+
106+
(d) If the Work includes a "NOTICE" text file as part of its
107+
distribution, You must include a readable copy of the attribution
108+
notices contained within such NOTICE file, in at least one of the
109+
following places: within a NOTICE text file distributed as part of
110+
the Derivative Works; within the Source form or documentation, if
111+
provided along with the Derivative Works; or, within a display
112+
generated by the Derivative Works, if and wherever such third-party
113+
notices normally appear. The contents of the NOTICE file are for
114+
informational purposes only and do not modify the License. You may
115+
add Your own attribution notices within Derivative Works that You
116+
distribute, alongside or as an addendum to the NOTICE text from the
117+
Work, provided that such additional attribution notices cannot be
118+
construed as modifying the License.
119+
120+
You may add Your own copyright statement to Your modifications and may
121+
provide additional or different license terms and conditions for use,
122+
reproduction, or distribution of Your modifications, or for such
123+
Derivative Works as a whole, provided Your use, reproduction, and
124+
distribution of the Work otherwise complies with the conditions stated
125+
in this License.
126+
127+
5. Submission of Contributions. Unless You explicitly state otherwise,
128+
any Contribution intentionally submitted for inclusion in the Work by
129+
You to the Licensor shall be under the terms and conditions of this
130+
License, without any additional terms or conditions. Notwithstanding
131+
the above, nothing herein shall supersede or modify the terms of any
132+
separate license agreement you may have executed with Licensor regarding
133+
such Contributions.
134+
135+
6. Trademarks. This License does not grant permission to use the trade
136+
names, trademarks, service marks, or product names of the Licensor,
137+
except as required for reasonable and customary use in describing the
138+
origin of the Work and reproducing the content of the NOTICE file.
139+
140+
7. Disclaimer of Warranty. Unless required by applicable law or agreed
141+
to in writing, Licensor provides the Work (and each Contributor
142+
provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES
143+
OR CONDITIONS OF ANY KIND, either express or implied, including,
144+
without limitation, any warranties or conditions of TITLE,
145+
NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE.
146+
You are solely responsible for determining the appropriateness of using
147+
or redistributing the Work and assume any risks associated with Your
148+
exercise of permissions under this License.
149+
150+
8. Limitation of Liability. In no event and under no legal theory,
151+
whether in tort (including negligence), contract, or otherwise, unless
152+
required by applicable law (such as deliberate and grossly negligent
153+
acts) or agreed to in writing, shall any Contributor be liable to You
154+
for damages, including any direct, indirect, special, incidental, or
155+
consequential damages of any character arising as a result of this
156+
License or out of the use or inability to use the Work (including but
157+
not limited to damages for loss of goodwill, work stoppage, computer
158+
failure or malfunction, or all other commercial damages or losses),
159+
even if such Contributor has been advised of the possibility of such
160+
damages.
161+
162+
9. Accepting Warranty or Additional Liability. While redistributing the
163+
Work or Derivative Works thereof, You may choose to offer, and charge
164+
a fee for, acceptance of support, warranty, indemnity, or other
165+
liability obligations and/or rights consistent with this License.
166+
However, in accepting such obligations, You may act only on Your own
167+
behalf and on Your sole responsibility, not on behalf of any other
168+
Contributor, and only if You agree to indemnify, defend, and hold each
169+
Contributor harmless for any liability incurred by, or claims asserted
170+
against, such Contributor by reason of your accepting any such warranty
171+
or additional liability.
172+
173+
END OF TERMS AND CONDITIONS
174+
175+
APPENDIX: How to apply the Apache License to your work.
176+
177+
To apply the Apache License to your work, attach the following
178+
boilerplate notice, with the fields enclosed by brackets "[]"
179+
replaced with your own identifying information. (Don't include
180+
the brackets!) The text should be enclosed in the appropriate
181+
comment syntax for the file format. We also recommend that a
182+
file or class name and description of purpose be included on the
183+
same "printed page" as the copyright notice for easier identification
184+
within third-party archives.
185+
186+
Copyright 2026 authz-core Contributors
187+
188+
Licensed under the Apache License, Version 2.0 (the "License");
189+
you may not use this file except in compliance with the License.
190+
You may obtain a copy of the License at
191+
192+
http://www.apache.org/licenses/LICENSE-2.0
193+
194+
Unless required by applicable law or agreed to in writing, software
195+
distributed under the License is distributed on an "AS IS" BASIS,
196+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
197+
See the License for the specific language governing permissions and
198+
limitations under the License.

0 commit comments

Comments
 (0)