API Reference

This page lists the public types and their key methods across all crates. For full documentation with examples, generate rustdoc:

cargo doc --workspace --no-deps --open

Or for a specific crate:

cargo doc --package acls-rs --open
cargo doc --package hbac-rs --open
cargo doc --package abac-rs --open
cargo doc --package perf-testing --open

acls-rs

Algebraic access control: permissions, subjects, roles, attributes, and temporal rules.

`acls_rs::permission`

Core permission types.

Type	Description
`AtomicPermission`	Single `namespace:action` permission. `new(ns, action)`, `FromStr`, `Display`.
`PermissionSet`	Set of atomic permissions. `from([...])`, `combine()` (union), `meet()` (intersection), `join()` (join), `difference()`. Operators: `\|`, `&`, `-`.
`GrantDenialPair`	Grants + denials with denial precedence. `new(grants, denials)`, `empty()`, `has_permission()`, `effective_permissions()`.
`PermissionDelta`	Batch permission change. `builder().grant_str(ns, act).remove_str(ns, act).build()`, `apply_to(set)`.
`TemporalPermission`	Time-windowed permission. `new(perm, from, until)`, `is_valid_at(ts)`, `is_currently_valid()`.
`TemporalPermissionSet`	Collection of temporal permissions. `new()`, `add()`, `effective_at(ts)`, `currently_effective()`.
`DenialSet`	Set of denied permissions.
`Timestamp`	Type alias for `u64` (milliseconds since epoch).
`current_timestamp_millis()`	Returns the current time as a `Timestamp`.

See Permissions and Subjects, Temporal Permissions.

`acls_rs::subject`

Type	Description
`Subject`	User or service account. `new(id)`, `builder().id(id).grant(perm).role(r).build().unwrap()`, `has_permission()`, `grant()`, `deny()`, `effective_permissions_at(ts)`. Fields: `id`, `roles`, `temporal_permissions`.
`BuilderError`	Error from `Subject::builder().build()`.

`acls_rs::resource`

Type	Description
`Resource`	Protected object. `new(name).requires(perm).resource_type(t)`, `can_access(&subject)`, `missing_permissions(&subject)`.

Type	Description
`RbacPolicy`	Role-based policy. `new()`, `add_role()`, `resolve_permissions(&roles)`, `effective_permissions(&roles)`.
`Role`	Named permission bundle. `new(name, GrantDenialPair)`, `with_parent(name)`. Field: `parent_roles`.
`RbacError`	Error enum. Variant: `CyclicDependency`.
`AbacPolicy`	Attribute-based policy. `new()` (MeetResolver default), `with_resolver(resolver)`, `add_rule()`, `evaluate(&context)`.
`AttributeRule`	Attribute-based rule. `new().grant(perm, attrs).deny(perm, attrs)`.
`AttributeContext`	Type alias for `HashMap<String, String>`.
`AttributePermission`	Result of ABAC evaluation. `has_permission()`, `effective_permissions()`.
`MeetResolver`	Conflict resolver: most restrictive wins (default).
`JoinResolver`	Conflict resolver: most permissive wins.
`PriorityResolver`	Conflict resolver: priority-ordered.
`ConflictResolver`	Trait for custom resolvers.

`acls_rs::algebra`

Algebraic traits implemented by permission types.

Trait	Description
`Semigroup`	Associative binary operation.
`Monoid`	Semigroup with identity element.
`MeetSemilattice`	Greatest lower bound (intersection).
`JoinSemilattice`	Least upper bound (union).
`Lattice`	Both meet and join semilattice.
`MonoidAction`	Monoidal action on another type.

`acls_rs::calculation`

Permission computation utilities.

Type	Description
`HasPermissions`	Trait for types that carry permissions.
`PermissionEffect`	Result of a permission check with rationale.
`PermissionEffectBuilder`	Builder for `PermissionEffect`.
`PermissionPreview`	Preview what permissions would result from a change.

`acls_rs::prelude`

Re-exports all commonly used types from the modules above. Use use acls_rs::prelude::*; in application code.

hbac-rs

Host-Based Access Control for FreeIPA environments. Built on acls-rs.

HbacRule Three-dimensional access rule. new(name), new_deny(name), enable(), disable(), set_user_category_all(), set_host_category_all(), set_service_category_all(), add_user(s), add_user_group(s), add_host(s), add_host_group(s), add_service(s), add_service_group(s), estimated_size(). All add_* methods accept impl Into<String> and return Result<(), CategoryError>. Fields: name: Arc<str>, enabled, users, targethosts, services, rule_type.

HbacRuleType Enum: Allow, Deny.

Type	Description
`HbacRule`	Three-dimensional access rule. `new(name)`, `new_deny(name)`, `enable()`, `disable()`, `set_user_category_all()`, `set_host_category_all()`, `set_service_category_all()`, `add_user(s)`, `add_user_group(s)`, `add_host(s)`, `add_host_group(s)`, `add_service(s)`, `add_service_group(s)`, `estimated_size()`. All `add_*` methods accept `impl Into<String>` and return `Result<(), CategoryError>`. Fields: `name: Arc<str>`, `enabled`, `users`, `targethosts`, `services`, `rule_type`.
`HbacRuleType`	Enum: `Allow`, `Deny`.

`hbac_rs::category`

Type	Description
`HbacCategory`	Enum: `All` or `Specific { names: Box<[Arc<str>]>, groups: Box<[Arc<str>]> }`. `new_specific()`, `all()`, `from_names_and_groups(names, groups)`, `add_name(s)`, `add_group(s)`, `is_all()`, `estimated_heap_size()`.
`CategoryError`	Error when adding entities to a `Category::All`. Variant: `CannotModifyAll`.

`hbac_rs::request`

Type	Description
`HbacRequest`	Access request. `new(subject, host, service)`, `builder()`. Fields: `user`, `targethost`, `targethost_groups`, `service`, `service_groups`.
`HbacRequestBuilder`	Builder: `user()`, `targethost()`, `targethost_group()`, `service()`, `service_group()`, `build() -> Result<HbacRequest, BuilderError>`.
`BuilderError`	Error for missing required fields. Variant: `MissingField(&str)`.

`hbac_rs::policy`

Type	Description
`HbacPolicy`	Thread-safe policy (`Mutex`-backed). Type alias for `HbacPolicyCore<Mutex<RulePipeline>>`.
`HbacPolicyLocal`	Single-threaded policy (`RefCell`-backed). Type alias for `HbacPolicyCore<RefCell<RulePipeline>>`.
`HbacPolicyCore<L>`	Generic policy. `new()`, `add_rule()`, `add_temporal_rule()`, `remove_rule()`, `enable_rule()`, `disable_rule()`, `load_rules()`, `rules()`, `stats()`, `evaluate()`, `evaluate_detailed()`, `evaluate_at()`, `evaluate_detailed_at()`, `check_access()`, `evaluate_and_apply()`, `evaluate_and_apply_at()`. With `jit` feature: `enable_jit()`, `jit_compile_hot()`, `jit_stats()`.
`HbacEvaluationResult`	Result of evaluation. `is_allowed()`, `is_denied()`. Fields: `allowed`, `matched_rules`, `not_matched_rules`.
`PipelineLock`	Trait for thread-safety abstraction.

See Policy Evaluation.

`hbac_rs::resource`

Type	Description
`HbacResource`	(host, service) as an acls-rs Resource. `new(host, service)`, `builder()`, `can_access(&subject)`, `missing_permissions(&subject)`, `required_permission()`, `grant_access(&mut subject)`, `deny_access(&mut subject)`.
`HbacResourceBuilder`	Builder: `host()`, `service()`, `host_group()`, `service_group()`, `build()`.

`hbac_rs::temporal`

Type	Description
`TemporalHbacRule`	Time-windowed HBAC rule. `new(rule, from, until)`, `valid_for_duration(rule, ms)`, `valid_from(rule, ts)`, `valid_until(rule, ts)`, `is_valid_at(ts)`, `is_currently_valid()`, `current_rule()`, `rule_at(ts)`. Fields: `rule`, `valid_from`, `valid_until`.

See Temporal HBAC Rules.

`hbac_rs::compiled`

Type	Description
`HbacCompiledEvaluator`	Pre-compiled HBAC evaluator with AHashSet-based lookups. `build(rules)`, `evaluate(request) -> bool`. Separates deny and allow rules at build time. Detects universal allow for fast-path evaluation.

`hbac_rs::composition`

Type	Description
`ComposedPolicy`	HBAC+RBAC composition. `new(hbac, rbac, mode)`, `evaluate()`, `check_access()`, `hbac_policy()`, `hbac_policy_mut()`, `rbac_policy()`, `rbac_policy_mut()`.
`CompositionMode`	Enum: `And`, `Or`, `HbacFirst`, `RbacFirst`.

See Policy Composition.

`hbac_rs::cache`

Caching pipeline for production deployments.

Type	Description
`RulePipeline`	Source-filter-cache-evaluate pipeline. `builder()`, `load()`, `refresh()`, `incremental_update()`, `evaluate()`, `evaluate_with_tracking()`, `rule_count()`, `stats()`, `last_update_timestamp()`.
`RulePipelineBuilder`	Builder: `with_source()`, `with_filter()`, `with_cache()`, `build()`.
`RuleSource`	Trait: `fetch_all()`, `fetch_updated_since()`, `is_available()`.
`RuleSourceError`	Error enum: `ConnectionFailed`, `AuthenticationFailed`, `ParseError`, `Unavailable`, `Other`.
`MemorySource`	In-memory source. `new(rules)`, `add_rule()`.
`CompositeSource`	Multi-source with fallback. `new()`, `with_source()`, `add_source()`.
`RuleFilter`	Trait: `should_cache()`, `filter()`, `filter_cloned()`.
`HostFilter`	Host-specific filter. `for_host(name)`, `with_group()`, `with_groups()`.
`ApplicabilityFilter`	Scope filter. `global_only()`, `all_enabled()`.
`AcceptAllFilter`	No-op filter.
`AndFilter`	Logical AND of filters. `new()`, `with()`.
`OrFilter`	Logical OR of filters. `new()`, `with()`.
`RuleCache`	Trait: `store()`, `get()`, `get_all()`, `get_many()`, `contains()`, `len()`, `is_empty()`, `clear()`, `stats()`.
`IndexedCache`	In-memory indexed cache. `new()`, `find_by_user()`, `find_by_host()`, `find_by_user_and_host()`.
`DiskCache`	Persistent cache (requires `serde`). `new(path)`, `flush()`.
`CacheStats`	Cache metrics. `hit_rate()`. Fields: `rule_count`, `memory_bytes`, `hit_count`, `miss_count`.
`RuleIndex`	Trait: `index()`, `find_by_user()`, `find_by_host()`, `find_by_service()`, `clear()`.
`UserIndex`	Index by user. `new()`.
`HostIndex`	Index by host. `new()`.
`CompositeIndex`	Multi-dimensional index. `new()`, `find_by_user_and_host()`.
`BloomFilterCache`	Probabilistic filter. `build(rules)`, `might_match(...)`.
`DecisionNode`	Compiled decision tree. `build(rules)`, `evaluate(request)`.

See Caching System, Caching Architecture.

`hbac_rs::prelude`

Re-exports commonly used types: HbacRule, HbacRuleType, HbacPolicy, HbacPolicyLocal, HbacRequest, HbacRequestBuilder, HbacResource, HbacResourceBuilder, HbacCategory, HbacEvaluationResult, ComposedPolicy, CompositionMode, TemporalHbacRule, plus acls-rs types (Subject, Resource, AtomicPermission, Timestamp, current_timestamp_millis).

Cache types are not in the prelude. Import them from hbac_rs::cache::*.

abac-rs

Attribute-Based Access Control with multi-type attributes and pluggable matchers. Built on acls-rs.

`abac_rs::rule`

Type	Description
`AbacRule`	Attribute-based access rule. `new(name)`, `new_deny(name)`, `enable()`, `disable()`, `add_condition(key, value)`, `estimated_size()`. Fields: `name: Arc<str>`, `enabled`, `conditions`, `rule_type`.
`AbacRuleType`	Enum: `Allow`, `Deny`.

`abac_rs::attribute`

Type	Description
`AttributeValue`	Multi-type attribute value. Enum variants: `String(String)`, `Integer(i64)`, `Float(f64)`, `IpAddr(IpAddr)`, `IpCidr(IpCidr)`, `Custom(Box<dyn Any + Send + Sync>)`.
`AttributeMatcher`	Trait for custom matching logic. `matches(&self, value: &AttributeValue) -> bool`.

`abac_rs::request`

Type	Description
`AbacRequest`	Evaluation request with attributes. `new()`, `set_attribute(key, value)`, `get_attribute(key)`. Field: `attributes: HashMap<String, AttributeValue>`.

`abac_rs::policy`

Type	Description
`AbacPolicy`	Thread-safe policy (`Mutex`-backed). Type alias for `AbacPolicyCore<Mutex<RulePipeline>>`.
`AbacPolicyLocal`	Single-threaded policy (`RefCell`-backed). Type alias for `AbacPolicyCore<RefCell<RulePipeline>>`.
`AbacPolicyCore<L>`	Generic policy. `new()`, `add_rule()`, `add_temporal_rule()`, `remove_rule()`, `enable_rule()`, `disable_rule()`, `load_rules()`, `rules()`, `stats()`, `evaluate()`, `evaluate_detailed()`, `evaluate_at()`, `evaluate_detailed_at()`, `register_matcher(key, matcher)`.
`AbacEvaluationResult`	Result of evaluation. `is_allowed()`, `is_denied()`. Fields: `allowed`, `matched_rules`, `not_matched_rules`.

See Policy Evaluation.

`abac_rs::compiled`

Type	Description
`AbacCompiledEvaluator`	Pre-compiled evaluator with extracted attributes. `build(rules)`, `evaluate(request)`.

`abac_rs::temporal`

Type	Description
`TemporalAbacRule`	Time-windowed ABAC rule. `new(rule, valid_from, valid_until)`, `is_valid_at(ts)`.

`abac_rs::cache`

Type	Description
`RulePipeline`	Evaluation pipeline with deny index and compiled evaluator. `evaluate(request)`, `rebuild_indexes()`.
`DenyIndex`	Bitmap-based deny rule index (3.2x less memory than HBAC). `build(rules)`, `check_deny(request)`.
`BloomFilterCache`	Probabilistic filter for attributes. `build(rules)`, `might_match(...)`.

See ABAC User Guide.

`abac_rs::prelude`

Re-exports commonly used types: AbacRule, AbacRuleType, AbacPolicy, AbacPolicyLocal, AbacRequest, AbacEvaluationResult, AttributeValue, AttributeMatcher, TemporalAbacRule, plus acls-rs types (Subject, Timestamp, current_timestamp_millis).

abac-wasm

WebAssembly bindings for the ABAC engine. Provides a JSON-based API for managing and evaluating ABAC policies in browser and Node.js environments. All errors are returned as structured objects with {type, message} fields.

`AbacPolicyWasm`

Method	Description
`new()`	Create a new ABAC policy.
`addRuleFromJson(json)`	Add a rule from a JSON string.
`evaluateJson(requestJson)`	Evaluate a request; returns `{"allowed": bool}`.
`loadRulesFromJson(jsonArray)`	Load multiple rules from a JSON array.
`clearRules()`	Remove all rules from the policy.
`getCacheStats()`	Return cache statistics as JSON.
`getRuleCount()`	Return the number of loaded rules.
`getAllRulesJson()`	Return all rules as a JSON array.
`registerMatcher(dimension, matchFn)`	Register a custom JavaScript matcher function for a dimension. The callback receives `(ruleValue, requestValue, requestGroups)` and returns a boolean.

`AbacRuleBuilderWasm`

Fluent API for building ABAC rules without manual JSON construction.

Method	Description
`new(name)`	Create a builder with the given rule name.
`addDimension(dimension, valuesJson)`	Add a dimension with typed attribute values.
`addDimensionAll(dimension)`	Set a dimension to match all values (wildcard).
`setEnabled(enabled)`	Enable or disable the rule (disabled by default).
`setRuleType(type)`	Set `"Allow"` or `"Deny"`.
`buildJson()`	Return the rule as a JSON string for `addRuleFromJson()`.

Error types

All methods that return errors produce a JavaScript object:

Field	Values
`type`	`"PolicyError"`, `"JsonError"`, or `"ValidationError"`
`message`	Human-readable description

hbac-wasm

WebAssembly bindings for the HBAC engine. Provides a JSON-based API for FreeIPA-style host-based access control in browser and Node.js environments.

`HbacPolicyWasm`

Method	Description
`new()`	Create a new HBAC policy.
`addRuleFromJson(json)`	Add a rule from a JSON string.
`checkAccessJson(requestJson)`	Evaluate a request; returns boolean.
`evaluateDetailedJson(requestJson)`	Evaluate with detail; returns `{allowed, matched_rules, not_matched_rules}`.
`loadRulesFromJson(jsonArray)`	Load multiple rules from a JSON array.
`clearRules()`	Remove all rules from the policy.
`getRuleCount()`	Return the number of loaded rules.

`HbacRuleBuilderWasm`

Fluent API for building HBAC rules.

Method	Description
`new(name)`	Create a builder with the given rule name.
`userCategoryAll()`	Match all users.
`hostCategoryAll()`	Match all hosts.
`serviceCategoryAll()`	Match all services.
`addUsers(json)`	Add specific users from JSON array.
`addUserGroups(json)`	Add user groups from JSON array.
`addHosts(json)`	Add specific hosts from JSON array.
`addHostGroups(json)`	Add host groups from JSON array.
`addServices(json)`	Add specific services from JSON array.
`addServiceGroups(json)`	Add service groups from JSON array.
`setEnabled(enabled)`	Enable or disable the rule.
`setDeny()`	Set as a deny rule (allow by default).
`buildJson()`	Return the rule as a JSON string for `addRuleFromJson()`.

`HbacRequestWasm`

Method	Description
`new(user, targethost, service)`	Create a new request.
`addUserGroups(json)`	Add user groups from JSON array.
`addTargethostGroups(json)`	Add target host groups from JSON array.
`addServiceGroups(json)`	Add service groups from JSON array.
`toJson()`	Serialize to JSON string.
`fromJson(json)`	(static) Deserialize from JSON string.

Module	Description
`perf_testing::synthesis`	Rule generation with distribution presets and patterns.
`perf_testing::fixtures`	Fixture loading, saving, and validation (gzip-compressed JSON).
`perf_testing::runner`	Benchmark scenario execution and metrics collection.
`perf_testing::bac`	BAC abstraction layer (`BacPolicy` trait, `HbacPolicyAdapter`).
`perf_testing::cli`	`bac-perf` command implementations.

See Performance Testing Framework, CLI Reference.

Keyboard shortcuts

BAC Rules Documentation