biscuit-auth / biscuit-rust

Rust implementation of the Biscuit authorization token
https://www.biscuitsec.org
209 stars 29 forks source link

authorizer: always display authorizer facts and rules #195

Closed divarvel closed 9 months ago

divarvel commented 11 months ago

impl Display for Authorizer only used the datalog world for displaying facts. When calling .to_string() on an authorizer before .authorize(), authorizer facts and rules were not displayed (authorizer facts and rules are added to the datalog world only in .authorize()).

After authorization, authorizer facts and rules are both in the world and the block, so deduplication is needed.

See #193 and #194

Note: the output of .to_string() is still not a faithful representation of the snapshot contents, since the authorizer block can have a block-wide scope annotation, which is not displayed. Maybe displaying a snapshot as a single datalog snippet does not even make sense (after all, we are already using comments to annotate stuff). We could display blocks faithfully (not using the datalog world), and then display generated facts in a separate way (we would still have to deduplicate facts to only display generated facts and not facts coming directly from blocks.