Struct AudienceGrants 

pub struct AudienceGrants { /* private fields */ }

The parsed, validated grant map: “who can access this audience”, keyed by audience name, one relation per axis (read/mint – AbAC plan’s group_read_grants / group_mint_grants, kept as one static map here since the DB store (DbAudienceGrantsSource) is checked as a separate source, not merged into this one).

A bare-array value is read-only shorthand: an omitted "mint" list is therefore always empty, never defaulted from "read" – a read grant confers no mint authority, by construction.

public is stored the same way as any other audience – via a {"public": ["*"]} entry here, or, in production, the seeded ('public', 'read', '*') DB row (schema v9). It has no built-in grant on either axis; nothing here or in AudienceReadPolicy::resolve treats it specially.

Implementations

impl AudienceGrants

pub fn empty() -> AudienceGrants

No grants at all – every audience, public included, is unreadable and unmintable by anyone non-admin. Used as the disabled-auth / no-explicit-policy default.

pub fn parse(raw: &str) -> Result<AudienceGrants, Error>

Parses a grant-map JSON document directly – the documented published format for a static grant map, kept as a test-only entry point now that no production caller builds a policy from raw JSON (mint_key builds one from Self::from_rows against a live query instead).

Validates both axes of the map, not just its JSON shape – same reason every other knob in this crate fails startup on a typo rather than shipping inert: every key must satisfy is_valid_audience ({"group:everyone": [...]}, the value operators are migrating from, can never match a stamped audience once the charset excludes :), and every selector on either axis must be *, user:<non-empty>, or group:<non-empty> (an unprefixed or mis-prefixed selector matches no identity axis and would otherwise be a silently-inert entry).

pub fn from_rows( rows: impl IntoIterator<Item = (String, GrantAxis, String)>, ) -> Result<AudienceGrants, Error>

Builds an AudienceGrants from (audience, axis, selector) triples – the DB-store analogue of Self::parse. Runs the same is_valid_audience/valid_selector checks parse runs, so a row that slipped past audience_grants’s own CHECK constraints (e.g. via a direct psql session) still can’t reach a policy decision: this is the one place both the JSON path and the DB path fail closed on a malformed row.

pub fn merge(&self, other: &AudienceGrants) -> AudienceGrants

Unions each audience’s read/mint selector lists across self and other: a selector present in either map grants exactly the same access as being present in both. No dedup – selector_matches is called with .any(), so a selector present in both sources costs one redundant comparison, never a wrong answer.

A public utility for combining two AudienceGrants maps, exercised by this crate’s own integration tests (rust/auth/tests/policy_tests.rs); resolve/resolve_audience do not call it – they check the static map and the DB store snapshot as two separate sources instead, specifically to avoid a per-request deep clone (see the comment in AudienceReadPolicy::resolve).

Trait Implementations

impl Clone for AudienceGrants

fn clone(&self) -> AudienceGrants

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AudienceGrants

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for AudienceGrants

fn default() -> AudienceGrants

Returns the “default value” for a type.