Add authorization and hosting policy hooks

grit-lib-server/src/error.rs

@@ -53,6 +53,20 @@ pub enum Error {
         /// Policy-provided reason.
         reason: String,
     },
+    /// A repository authorization provider denied access.
+    #[error("authorization denied for {actor} on {tenant}/{repository} {permission}: {reason}")]
+    AuthorizationDenied {
+        /// Tenant whose repository was accessed.
+        tenant: String,
+        /// Repository that was accessed.
+        repository: String,
+        /// Actor that requested access.
+        actor: String,
+        /// Permission that was denied.
+        permission: &'static str,
+        /// Provider-supplied reason.
+        reason: String,
+    },
     /// A requested object was not found.
     #[error("object not found: {0}")]
     ObjectNotFound(String),

grit-lib-server/src/lib.rs

@@ -14,6 +14,7 @@ pub mod layered;
 pub mod memory;
 #[cfg(feature = "nats")]
 pub mod nats_invalidation;
+pub mod policy;
 pub mod protocol;
 #[cfg(feature = "redis")]
 pub mod redis_cache;
@@ -36,6 +37,11 @@ pub mod prelude {
     pub use crate::layered::LayeredCache;
     #[cfg(feature = "nats")]
     pub use crate::nats_invalidation::{NatsInvalidationPublisher, NatsInvalidationSubscriber};
+    pub use crate::policy::{
+        AuditEvent, AuditOutcome, AuditSink, AuthorizationContext, AuthorizationProvider,
+        NoAuthorization, NoopAuditSink, PolicyActor, PolicyDecision, PolicyRefUpdate,
+        RefUpdatePolicyContext, RepositoryPermission, RepositoryPolicy,
+    };
     pub use crate::protocol::receive_pack::{
         AllowAllPushPolicy, ProtectedRefPolicy, PushCommandKind, PushCommandStatus, PushPlan,
         PushPolicy, PushPolicyContext, QuarantinedObject, ReceivePackCapability,