identity-rbac — IMP FORGE

Role-based access control with hierarchy levels and effective dating

Tier	identity
Role	unclassified (baselined)
Path	`crates/identity/rbac`
Edition	2021
Targets	identity_rbac
Public items	71 across 7 modules
Tests	77

What it is for

# identity-rbac

Role-Based Access Control with hierarchy levels and effective dating.

Core Concepts

Roles have hierarchy levels (10-100)
Users can only manage users with strictly lower levels
Role assignments support effective dating (valid_from/valid_to)
Permissions use module.action format

Hierarchy Levels

Level 100: Superuser
Level 80:  Administrator
Level 60:  Manager
Level 40:  Professional
Level 30:  Technician
Level 20:  Staff (default)
Level 10:  Customer
Level 0:   No roles

Example

use identity_rbac::{Role, UserRole, SimpleUser, RBACUser, hierarchy};
use uuid::Uuid;

// Create roles
let manager_role = Role::new("Manager", hierarchy::MANAGER).expect("valid");
let staff_role = Role::new("Staff", hierarchy::STAFF).expect("valid");

// Assign role to user
let user_role = UserRole::new(Uuid::new_v4(), manager_role.id)
.with_role(manager_role.clone());

// Create user with role
let manager = SimpleUser::new(Uuid::new_v4()).with_role(user_role);

// Check hierarchy level
assert_eq!(manager.hierarchy_level(), 60);

// Manager can manage staff
let staff_ur = UserRole::new(Uuid::new_v4(), staff_role.id)
.with_role(staff_role);
let staff = SimpleUser::new(Uuid::new_v4()).with_role(staff_ur);

assert!(manager.can_manage_user(&staff));

Capabilities

`RBACError`

Error types for RBAC.

Item
`pub enum RBACError`

`verb:constants`

Hierarchy level constants for RBAC.

Item
`pub const SUPERUSER: i32`
`pub const ADMINISTRATOR: i32`
`pub const MANAGER: i32`
`pub const PROFESSIONAL: i32`
`pub const TECHNICIAN: i32`
`pub const STAFF: i32`
`pub const CUSTOMER: i32`
`pub const NO_ROLES: i32`
`pub const MIN_LEVEL: i32`
`pub const MAX_LEVEL: i32`
`pub const DEFAULT_LEVEL: i32`

`verb:is`

Hierarchy level constants for RBAC.

Item
`fn is_valid_level(level : i32) -> bool`

`verb:level`

Hierarchy level constants for RBAC.

Item
`fn level_name(level : i32) -> & 'static str`

`Permission`

Permission model for RBAC.

Item
`pub struct Permission`
`Permission :: fn new(codename : impl Into <String>) -> Self`
`Permission :: fn from_module_action(module : & str, action : & str) -> Self`
`Permission :: fn with_description(mut self, description : impl Into <String>) -> Self`
`Permission :: fn module(& self) -> Option <& str>`
`Permission :: fn action(& self) -> Option <& str>`
`Permission :: fn matches(& self, module : & str, action : & str) -> bool`

`RolePermission`

Permission model for RBAC.

Item
`pub struct RolePermission`
`RolePermission :: fn new(role_id : Uuid, permission_id : Uuid) -> Self`

`permission::actions (other)`

_No module-level documentation is present in the source._

Item
`pub const VIEW: & str`
`pub const EDIT: & str`
`pub const CREATE: & str`
`pub const DELETE: & str`
`pub const MANAGE: & str`
`pub const READ_RAW: & str`

`Role:Role`

Role model for RBAC.

Item
`pub struct Role`

`Role:can`

Role model for RBAC.

Item
`Role :: fn can_manage(& self, other : & Role) -> bool`

`Role:created`

Role model for RBAC.

Item
`Role :: fn created_at(& self) -> DateTime <Utc>`

`Role:deleted`

Role model for RBAC.

Item
`Role :: fn deleted_at(& self) -> Option <DateTime <Utc>>`

`Role:id`

Role model for RBAC.

Item
`Role :: fn id(& self) -> Uuid`

`Role:inactive`

Role model for RBAC.

Item
`Role :: fn inactive(mut self) -> Self`

`Role:is`

Role model for RBAC.

Item
`Role :: fn is_valid_level(& self) -> bool`

`Role:level`

Role model for RBAC.

Item
`Role :: fn level_name(& self) -> & 'static str`

`Role:new`

Role model for RBAC.

Item
`Role :: fn new(name : impl Into <String>, hierarchy_level : i32) -> Result <Self, RBACError>`

`Role:slugify`

Role model for RBAC.

Item
`Role :: fn slugify(name : & str) -> String`

`Role:updated`

Role model for RBAC.

Item
`Role :: fn updated_at(& self) -> DateTime <Utc>`

`Role:with`

Role model for RBAC.

Item
`Role :: fn with_default_level(name : impl Into <String>) -> Self`
`Role :: fn with_description(mut self, description : impl Into <String>) -> Self`
`Role :: fn with_slug(mut self, slug : impl Into <String>) -> Self`

`RBACUser`

RBAC traits for user types.

Item
`pub trait RBACUser`