feat: implement Postgres evaluator

Author: jimmarino

Cargo.lock

@@ -28,10 +28,13 @@ aws-credential-types = {workspace = true}
 aws-smithy-runtime-api = {workspace = true}
 regex = {workspace = true}
 url = "2.5"
+sqlx = {workspace = true}
+tokio = {workspace = true}
 
 [dev-dependencies]
 aws-sdk-s3 = { workspace = true }
 aws-config = { workspace = true }
 testcontainers = { workspace = true }
+testcontainers-modules = { workspace = true }
 tokio = { workspace = true }
 reqwest = { workspace = true }

crates/facet-common/Cargo.toml

@@ -28,8 +28,9 @@ impl MemoryAuthorizationEvaluator {
     }
 }
 
+#[async_trait::async_trait]
 impl AuthorizationEvaluator for MemoryAuthorizationEvaluator {
-    fn evaluate(
+    async fn evaluate(
         &self,
         participant_context: &ParticipantContext,
         operation: Operation,
@@ -55,8 +56,9 @@ impl AuthorizationEvaluator for MemoryAuthorizationEvaluator {
     }
 }
 
+#[async_trait::async_trait]
 impl RuleStore for MemoryAuthorizationEvaluator {
-    fn get_rules(&self, participant_context: &ParticipantContext) -> Result<Vec<Rule>, AuthorizationError> {
+    async fn get_rules(&self, participant_context: &ParticipantContext) -> Result<Vec<Rule>, AuthorizationError> {
         let rules = self.rules.read().map_err(|e| AuthorizationError::StoreError(format!("Failed to acquire lock: {}", e)))?;
 
         let Some(participant_rules) = rules.get(&participant_context.identifier) else {
@@ -71,7 +73,7 @@ impl RuleStore for MemoryAuthorizationEvaluator {
         Ok(all_rules)
     }
 
-    fn save_rule(&self, participant_context: &ParticipantContext, rule: Rule) -> Result<(), AuthorizationError> {
+    async fn save_rule(&self, participant_context: &ParticipantContext, rule: Rule) -> Result<(), AuthorizationError> {
         let mut rules = self.rules.write().map_err(|e| AuthorizationError::StoreError(format!("Failed to acquire lock: {}", e)))?;
 
         rules
@@ -84,7 +86,7 @@ impl RuleStore for MemoryAuthorizationEvaluator {
         Ok(())
     }
 
-    fn remove_rule(&self, participant_context: &ParticipantContext, rule: Rule) -> Result<(), AuthorizationError> {
+    async fn remove_rule(&self, participant_context: &ParticipantContext, rule: Rule) -> Result<(), AuthorizationError> {
         let mut rules = self.rules.write().map_err(|e| AuthorizationError::StoreError(format!("Failed to acquire lock: {}", e)))?;
 
         let Some(participant_rules) = rules.get_mut(&participant_context.identifier) else {

crates/facet-common/src/auth/mem.rs

@@ -14,12 +14,14 @@
 mod tests;
 
 mod mem;
+mod postgres;
 
 use crate::context::ParticipantContext;
 use regex::Regex;
 use thiserror::Error;
 
 pub use mem::MemoryAuthorizationEvaluator;
+pub use postgres::PostgresAuthorizationEvaluator;
 
 /// Represents an operation with specific attributes that describe its scope, action, and resource.
 ///
@@ -73,19 +75,21 @@ impl Rule {
 }
 
 /// Evaluates whether an operation is authorized for a participant based on the configured rules.
+#[async_trait::async_trait]
 pub trait AuthorizationEvaluator: Sync + Send {
-    fn evaluate(
+    async fn evaluate(
         &self,
         participant_context: &ParticipantContext,
         operation: Operation,
     ) -> Result<bool, AuthorizationError>;
 }
 
 /// Stores rules for a participant.
+#[async_trait::async_trait]
 pub trait RuleStore: Send + Sync {
-    fn get_rules(&self, participant_context: &ParticipantContext) -> Result<Vec<Rule>, AuthorizationError>;
-    fn save_rule(&self, participant_context: &ParticipantContext, rule: Rule) -> Result<(), AuthorizationError>;
-    fn remove_rule(&self, participant_context: &ParticipantContext, rule: Rule) -> Result<(), AuthorizationError>;
+    async fn get_rules(&self, participant_context: &ParticipantContext) -> Result<Vec<Rule>, AuthorizationError>;
+    async fn save_rule(&self, participant_context: &ParticipantContext, rule: Rule) -> Result<(), AuthorizationError>;
+    async fn remove_rule(&self, participant_context: &ParticipantContext, rule: Rule) -> Result<(), AuthorizationError>;
 }
 
 pub struct TrueAuthorizationEvaluator {}
@@ -96,8 +100,9 @@ impl TrueAuthorizationEvaluator {
     }
 }
 
+#[async_trait::async_trait]
 impl AuthorizationEvaluator for TrueAuthorizationEvaluator {
-    fn evaluate(&self, _: &ParticipantContext, _: Operation) -> Result<bool, AuthorizationError> {
+    async fn evaluate(&self, _: &ParticipantContext, _: Operation) -> Result<bool, AuthorizationError> {
         Ok(true)
     }
 }