Examples

This page provides complete runnable examples for common use cases.

Running Examples

All examples can be run from the workspace root:

# acls-rs examples
cargo run --package acls-rs --example basic_usage
cargo run --package acls-rs --example rbac_abac_demo
cargo run --package acls-rs --example predictive_calculation

# hbac-rs examples
cargo run --package bac-examples --example hbac_basic_usage
cargo run --package bac-examples --example hbac_advanced_features
cargo run --package bac-examples --example hbac_sssd_deployment

# abac-rs examples
cargo run --package abac-rs --example basic_usage
cargo run --package abac-rs --example multi_type_attributes
cargo run --package abac-rs --example custom_matchers

Example: Temporal Permissions

For temporal ABAC policies, see the ABAC examples.

// Conceptual example - see abac-rs for working temporal rule implementation
use acls_rs::prelude::*;

fn main() {
    // Temporal permissions are implemented via ABAC temporal rules
    // See crates/abac-rs/examples/temporal_rules.rs for working code
}

Example: HBAC with Deny Rules

use hbac_rs::prelude::*;
use acls_rs::Subject;

fn main() {
    let mut policy = HbacPolicy::new();
    
    // Allow all users to SSH
    let allow_ssh = HbacRule::builder("allow_ssh")
        .user_category_all()
        .host_category_all()
        .service("sshd")
        .enabled(true)
        .build()
        .unwrap();
    policy.add_rule(allow_ssh);
    
    // Deny contractors from production servers
    let deny_contractors = HbacRule::builder("deny_contractors_prod")
        .deny()
        .user_group("contractors")
        .host_group("production")
        .service_category_all()
        .enabled(true)
        .build()
        .unwrap();
    policy.add_rule(deny_contractors);
    
    // Contractor trying to access production
    let mut contractor = Subject::new("bob");
    contractor.roles.push("contractors".to_string());
    
    let request = HbacRequest::builder()
        .user(contractor)
        .targethost("prod-web1.example.com")
        .targethost_group("production")
        .service("sshd")
        .build()
        .unwrap();
    
    let result = policy.evaluate(&request);
    assert!(!result.is_allowed());  // Denied!
}

Example: HBAC+RBAC Composition

use hbac_rs::prelude::*;
use acls_rs::prelude::*;

fn main() {
    // Setup HBAC policy
    let mut hbac = HbacPolicy::new();
    let rule = HbacRule::builder("web_servers")
        .user_category_all()
        .host_group("webservers")
        .service("httpd")
        .enabled(true)
        .build()
        .unwrap();
    hbac.add_rule(rule);
    
    // Setup RBAC policy
    let mut rbac = RbacPolicy::new();
    let grants = [AtomicPermission::new("web01.example.com", "httpd")].into();
    let admin_role = Role::new("webadmin", GrantDenialPair::new(grants, PermissionSet::new()));
    rbac.add_role(admin_role);
    
    // Compose with AND mode (both must allow)
    let policy = ComposedPolicy::new(hbac, rbac, CompositionMode::And);
    
    // User with webadmin role
    let mut user = Subject::new("alice");
    user.roles.push("webadmin".to_string());
    user.grant(AtomicPermission::new("web01.example.com", "httpd"));
    
    let request = HbacRequest::builder()
        .user(user)
        .targethost("web01.example.com")
        .targethost_group("webservers")
        .service("httpd")
        .build()
        .unwrap();
    
    let result = policy.evaluate(&request);
    assert!(result.is_allowed());  // Both HBAC and RBAC allow
}

Example: SSSD Caching Deployment

use hbac_rs::cache::*;
use hbac_rs::prelude::*;

fn main() {
    // Setup for local host
    let hostname = "web01.prod.example.com";
    let host_groups = vec!["webservers".to_string(), "production".to_string()];
    
    // Create pipeline with host-specific filtering
    let mut pipeline = RulePipeline::builder()
        .with_filter(
            HostFilter::for_host(hostname)
                .with_groups(host_groups.clone())
        )
        .with_cache(IndexedCache::new())
        .build();
    
    // Load rules (from LDAP in production)
    let rules = create_sample_rules();
    pipeline.load(rules);
    
    println!("Cached rules: {}", pipeline.rule_count());
    println!("Memory usage: {} bytes", pipeline.stats().memory_bytes);
    
    // Fast indexed evaluation
    let user = Subject::new("alice");
    let request = HbacRequest::new(user, hostname, "sshd");
    let result = pipeline.evaluate(&request);
    
    println!("Access: {}", if result.is_allowed() { "ALLOW" } else { "DENY" });
}

fn create_sample_rules() -> Vec<HbacRule> {
    // See examples/sssd_deployment.rs for full implementation
    vec![]
}

Example: Performance Testing

See the benchmarks in crates/*/benches/ for performance testing examples.

// Conceptual example - see crates/hbac-rs/benches for actual benchmarks
use perf_testing::*;
use perf_testing::synthesis::*;
use perf_testing::runner::*;

fn main() -> anyhow::Result<()> {
    // Generate 1000 rules
    let synthesizer = HbacSynthesizer::new(42);
    let config = SynthesisConfig {
        rule_count: 1000,
        distributions: Distributions::sssd_production(),
        seed: 42,
    };
    let rules = synthesizer.synthesize(&config);
    
    // Save as fixture
    let fixture_mgr = FixtureManager::new("fixtures")?;
    let metadata = FixtureMetadata::new(
        rules.len(),
        config,
        synthesizer.entity_pools(),
    );
    fixture_mgr.save("bench_1k", "hbac", &rules, metadata)?;
    
    // Run benchmark
    let mut runner = BenchmarkRunner::new("fixtures".into())?;
    let scenario = Scenario::single_request_latency(
        "bench_1k".to_string(),
        "hbac".to_string(),
        true,  // with cache
    );
    
    let metrics = runner.run_scenario(&scenario)?;
    println!("{}", ReportFormatter::format_terminal(&metrics));
    
    Ok(())
}

More Examples

See the examples/ directory in each crate for more:

• acls-rs/examples/: RBAC, ABAC, predictive calculations
• examples/: Cross-crate examples (HBAC, NT↔POSIX translation, AD schema access)
• hbac-rs/: JIT compilation, temporal rules
• abac-rs/examples/: Multi-type attributes, custom matchers, deny rules
• abac-wasm/examples/: Node.js usage, browser demo, TypeScript sensor monitoring
• hbac-wasm/examples/: Node.js usage, browser demo
• perf-testing: Fixture generation, benchmarking workflows

All examples are fully documented and can be used as templates for your own code.