Module policy 

Authorization seam: MintPolicy, ReadPolicy, and their audience-based implementations Authorization seam: MintPolicy, ReadPolicy, and the audience-based implementations that resolve them from a caller’s AuthContext and a static grant map keyed by audience name.

No enforcement lands with this module itself. This module fixes the shape of authorization – every caller of these traits must deny on Err, and ReadPolicy cannot express “grant everything” at all – while the resolved ReadableAudiences/ReadScope is consumed downstream by OwnershipRewrite (the row-level filter) and the call-level guard’s UDTF/UDF guards. See rust/analytics/src/lakehouse/read_scope.rs.

An audience is an opaque label, not a principal encoding. is_valid_audience and PUBLIC_AUDIENCE define what a name is; AudienceGrants defines who may read or mint into it. No code here derives an audience from a caller’s identity – see AudienceGrants for the reasoning.

Structs

AudienceGrants

The parsed, validated grant map: “who can access this audience”, keyed by audience name, one relation per axis (read/mint – AbAC plan’s group_read_grants / group_mint_grants, kept as one static map here since the DB store (DbAudienceGrantsSource) is checked as a separate source, not merged into this one).

AudienceMintPolicy

The shipped MintPolicy. Every caller, admin included, may mint only an audience in their mint set – grants[a].mint, never grants[a].read (a read grant confers no mint authority, unchanged from AudienceReadPolicy’s split); being able to read public via its seeded read grant does not imply being able to mint into it – that requires its own grant naming public in a "mint" list (in production, the seeded ('public', 'mint', '*') row, schema v9).

AudienceReadPolicy

The shipped ReadPolicy: a lookup over an AudienceGrants map – and, when a DbAudienceGrantsSource is attached via with_store, a second lookup over that store’s snapshot – with no identity derivation anywhere. Resolves the readable set:

ReadableAudiences

A policy’s resolved set of audiences a caller may read.

Enums

GrantAxis

The Rust side of audience_grants.axis – which selector list a DB row contributes to, mirroring the JSON grant map’s "read"/"mint" keys.

Constants

PUBLIC_AUDIENCE

The conventional shared audience. Not a built-in read grant – every-principal readability comes from the seeded ('public', 'read', '*') row (schema v9), an ordinary grant like any other, removable the same way.

Traits

MintPolicy

Resolves the audience a newly minted key may be stamped with.

ReadPolicy

Resolves the set of audiences an authenticated caller may read.

Functions

caller_selectors

The grant selectors caller matches: a leading "*" (every caller matches it), then "user:<email>" when caller.email is Some, then one "group:<g>" per entry in caller.memberships. pub – shared by three consumers: flight_sql_service_impl.rs’s CallerContext::grant_selectors, analytics-web-srv’s my_audiences handler, and the audience-grant write policy’s per-pair hold check (which must strip the leading "*" before binding the result – a * grant is not something a caller individually holds).

default_audience_from_env

Resolves {prefix}_DEFAULT_AUDIENCE (falling back to MICROMEGAS_DEFAULT_AUDIENCE) – the deployment default audience, defaulting to PUBLIC_AUDIENCE when unset. Resolved once at startup (web_server.rs) so a typo fails fast rather than surfacing as a per-request 400. Empty or otherwise invalid ⇒ Err: with one knob there is no “unset” state left for an empty string to mean, so a blank value is a misconfiguration, not an opt-out.

is_valid_audience

true if aud is a valid audience name: [A-Za-z0-9_-]{1,255}, checked in bytes – the ASCII-only charset makes byte length and char length agree for every value that can pass, so this doubles as the length check the ingestion_api_keys.audience VARCHAR(255) column enforces on the SQL side.

valid_selector

A principal selector on either axis of an AudienceGrants entry: * (any authenticated principal), user:<email> (matches AuthContext.email), or group:<g> (matches any entry in AuthContext.memberships – the caller’s resolved, transitive local-group closure). Validated at parse time; resolve/resolve_audience never see an unrecognized shape.