Struct PermissionManager 

pub struct PermissionManager {
    roles: Arc<RwLock<HashMap<String, Role>>>,
    permissions: Arc<RwLock<HashMap<String, Permission>>>,
    audit_log: Arc<RwLock<Vec<SecurityEvent>>>,
}

Permission manager for IPC operations

This is the main security enforcement structure for the IPC layer. It maintains role and permission definitions, validates access requests, and logs security events for auditing.

Permission Flow

IPC Message arrives
    |
    | validate_permission(operation, context)
    v
Check if operation requires permissions
    |
    | Yes -> Get required permissions
    v
Check user permissions (direct + role-based)
    |
    | Has all required permissions?
    v
Yes -> Log AccessGranted -> Allow operation
No  -> Log PermissionDenied -> Deny operation

Default Roles

The PermissionManager initializes with three default roles:

• user: Read-only access to files, configuration, and storage
• developer: Read/write access to files and storage, configuration read
• admin: Full access including system operations and configuration updates

Default Permissions

Standard permissions include:

• file.read, file.write
• config.read, config.update
• storage.read, storage.write
• system.external

Fields

roles: Arc<RwLock<HashMap<String, Role>>>

Role definitions with associated permissions

permissions: Arc<RwLock<HashMap<String, Permission>>>

Permission definitions with descriptions

audit_log: Arc<RwLock<Vec<SecurityEvent>>>

Security audit log (limited to last 1000 events)

Implementations

impl PermissionManager

pub fn new() -> Self

Create a new permission manager

pub async fn validate_permission( &self, operation: &str, context: &SecurityContext, ) -> Result<(), String>

Validate permission for an operation

This method checks if the given security context has sufficient permissions to perform the specified operation.

Parameters

• operation: The operation being attempted (e.g., “file:write”, “config:update”)
• context: The security context containing user information

Returns

• Ok(()) if the operation is allowed
• Err(String) with reason if denied

Example

let context = SecurityContext::ipc_default();
permission_manager.validate_permission("file:read", &context).await?;

async fn get_required_permissions(&self, operation: &str) -> Vec<String>

Get required permissions for an operation

This method defines which permissions are required for which operations. Operations not in the mapping require no special permissions by default.

Operation Permission Mapping

Operation	Required Permissions
file:write	file.write
file:delete	file.write
configuration:update	config.update
storage:set	storage.write
native:openExternal	system.external

async fn get_role_permissions(&self, role_name: &str) -> Vec<String>

Get permissions for a role

pub async fn log_security_event(&self, event: SecurityEvent)

Log security event

pub async fn get_audit_log(&self, limit: usize) -> Vec<SecurityEvent>

Get security audit log

Returns the most recent security events up to the specified limit.

pub async fn initialize_defaults(&self)

Initialize default roles and permissions

This method sets up the standard RBAC structure with three default roles and their associated permissions.

pub async fn add_role(&self, role: Role)

Add a custom role

pub async fn add_permission(&self, permission: Permission)

Add a custom permission

pub async fn clear_audit_log(&self)

Clear the audit log

pub async fn get_audit_log_stats(&self) -> (usize, Vec<(&'static str, usize)>)

Get audit log statistics