didbot_policy_records/
lib.rs

1//! The operator's `bot.did.policy` and `bot.did.policyBinding` records, and
2//! everything from reading one to a [`didbot_policy::PolicyTree`] built from
3//! them.
4//!
5//! [`records`] reads each record strictly. [`lookups`] gathers the records
6//! a write's policies read before it is judged, and [`named`] answers which
7//! accounts a written record names. [`set`] reads a whole
8//! observation of both collections into declarations, checks what the
9//! records alone can show, and computes the digest `bot.did.stats`
10//! publishes. [`engine`] names the engines this build compiles a document
11//! with. [`bindings`] says whom each policy is bound to, and [`subject`]
12//! builds the subjects a policy judges, from the diff a write carries.
13//! `didbot-pds` builds the enforced set from these, and
14//! `didbot-policy-check` hands the same code to a browser, so this crate
15//! builds for `wasm32-unknown-unknown`.
16//!
17//! # From declarations to a tree
18//!
19//! [`record::ParsedPolicy`] is what a statement becomes on its way to
20//! `didbot-policy`. [`compile`] turns one into a registered declaration,
21//! resolving `language` against the evaluators this build carries and
22//! giving a predicate it cannot compile the scoped, fail-closed treatment.
23//! [`merge::build`] assembles the [`builtin`] policies and whatever
24//! declarations it is handed into one tree, with [`last_good`] deciding
25//! what to enforce when a newer revision will not compile and [`across`]
26//! holding that store for the length of a run.
27//!
28//! # A partial view is the normal condition, not an error
29//!
30//! `plan/policy.md`: policies are not a set, they are independent records,
31//! and polling only ever samples a random point of that set. The view this
32//! crate is handed can be empty, can be missing records nothing has yet
33//! seen, and can still be enforcing a record the operator has since
34//! deleted -- none of that corrupts anything else's verdict, because
35//! deny-only policies never interact. What this crate is careful never to
36//! do is let a *failed* refresh discard anything: see [`last_good`].
37
38#![forbid(unsafe_code)]
39
40pub mod across;
41pub mod bindings;
42pub mod builtin;
43pub mod compile;
44pub mod engine;
45pub mod last_good;
46pub mod lookups;
47pub mod merge;
48pub mod named;
49pub mod record;
50pub mod records;
51pub mod set;
52pub mod subject;
53
54/// The core's own types, re-exported: every field of
55/// [`record::ParsedPolicy`] is one of these, so a caller that declares a
56/// policy reaches them through this crate rather than depending on
57/// `didbot-policy` for the names alone.
58pub use didbot_policy::{ActionSet, Applicability, KindSet, Revision, Scope, Staleness};
59
60pub use across::AcrossBuilds;
61pub use bindings::{BindingIndex, Boundary, Coverage};
62pub use builtin::{builtin_policies, builtin_records, BuiltinPolicy};
63pub use compile::{CompileReport, Language, PolicyWarning, ScopedDenial};
64pub use last_good::LastGoodPolicies;
65pub use lookups::Lookups;
66pub use merge::{build, LastGoodFallback, LoadReport};
67pub use named::{named_accounts, named_handles};
68pub use record::ParsedPolicy;
69pub use records::{
70    Accounts, Action, Document, Includes, Lookup, PolicyBinding, PolicyRecord, PolicyRef,
71};
72pub use set::{BuildFailure, Observed, PolicyRevision, RejectedBuild};
73pub use subject::{borrow, diff, OwnedChange};
didbot_policy_records/lib.rs

didbot_policy_records/
lib.rs
