ilpanich / axiam-rust-sdk / 29515291393

94%

push

github

feat(macros): add #[require_access]/#[require_auth]/#[require_role] actix helpers (CONTRACT §11) (#15)

* docs(contract): sync CONTRACT.md §11 declarative authorization helpers

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01C5foj8NVCeS9qUW94kJ13g

* feat(macros): add #[require_access]/#[require_auth]/#[require_role] actix helpers (CONTRACT §11)

Implements the CONTRACT.md §11 declarative authorization helpers for the Rust
SDK, layered on top of the §10 AxiamUser extractor.

- New proc-macro crate `axiam-sdk-macros` (workspace member, version-locked),
  re-exported from `axiam-sdk` behind a new `macros` feature so users write
  `use axiam_sdk::require_access;`.
- `#[require_access(action, resource_param|resource_id|resolver, scope?)]`
  expands to a thin Actix wrapper over the programmatic `middleware::RequireAccess`
  guard: injects AxiamUser (401), reads web::Data<AxiamClient>, resolves the
  resource UUID (400 on failure), issues check_access with
  subject_id = user.user_id, and maps deny->403 / transport error->503 (fail
  closed). `#[require_auth]` injects the extractor only; `#[require_role]` does
  a local roles check (403).
- `AxiamClient::check_access_as` threads subject_id through the REST helper.
- Error bodies use the §10 { error, message } JSON shape; codes 401/403/400/503.
  No decision caching; no token in logs/errors.
- Tests: wiremock-backed actix integration matrix (allow/deny/unauth/bad-uuid/
  network + subject_id and scope asserted on the wire) and trybuild UI tests for
  macro misuse. rustdoc-clean under -D warnings in both crates.
- Example, README (§1-§11 conformance) and CHANGELOG updated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01C5foj8NVCeS9qUW94kJ13g

* ci(rust): publish axiam-sdk-macros with axiam-sdk via workspace publish

The SDK is now a two-crate workspace: axiam-sdk depends on the companion
proc-m... (continued)

187 of 197 new or added lines in 2 files covered. (94.92%)

2649 of 2869 relevant lines covered (92.33%)

6.83 hits per line