Module authorization 

Authorization helpers: validate user access to HSM groups and their members.

Every service-layer function that takes a node, group, or session label from the caller runs one of these checks before touching the backend. The standard pattern is:

1. Resolve the caller’s request to a Vec<String> of xnames or group labels (often via crate::service::node_ops).
2. Call validate_user_group_members_access (xnames) or validate_user_group_vec_access (group labels).
3. Proceed to the actual backend mutation.

Admin tokens carrying the PA_ADMIN role short-circuit every check to Ok(()) without touching the backend, mirroring the “admin sees everything” expectation. Listing endpoints still validate so the response can’t disclose more than the caller could have asked for directly.

The short-circuit is centralised in the pub(crate) is_admin helper so that a future change — e.g. adding audit logging for admin bypasses, or gating on JWKS verification before skipping group-scope checks — only needs to touch one place.

Statics

PA_ADMIN

Keycloak role name that grants full admin access. The canonical definition lives in manta_shared::common::jwt_ops::PA_ADMIN; this re-export keeps service::authorization::PA_ADMIN callers compiling after the relocation. Keycloak role name that grants full admin access. Owned here so every workspace crate that decodes JWTs can read it without pulling manta-server as a dependency.

Functions

require_admin

Return Ok(()) when the caller carries the admin role (pa_admin); Err(Error::BadRequest(...)) otherwise.

validate_ansible_limit_membership_access

Validate every xname in a comma-separated ansible_limit-style string against the caller’s accessible groups.

validate_group_members_access

Like validate_user_group_members_access but with the caller-accessible group list supplied explicitly.

validate_group_vec_access

Pure check that every label in group_target_vec appears in group_available_vec.

validate_user_group_access

Validate that group_name is in the set this token can access.

validate_user_group_members_access

Validate that every xname in group_members_target_vec is a member of at least one group the token can access.

validate_user_group_vec_access

Validate that every label in group_vec is in the set the token can access.