feat: A shared permission::Error type (#301)

Author: Byron

git-sec/src/lib.rs

@@ -79,19 +79,19 @@ pub mod permission {
     use std::fmt::{Debug, Display};
 
     /// A marker trait to signal tags for permissions.
-    pub trait Tag: Debug {}
+    pub trait Tag: Debug + Clone {}
 
     /// A tag indicating that a permission is applying to the contents of a configuration file.
-    #[derive(Debug)]
+    #[derive(Debug, Clone)]
     pub struct Config;
     impl Tag for Config {}
 
     /// A tag indicating that a permission is applying to the resource itself.
-    #[derive(Debug)]
+    #[derive(Debug, Clone)]
     pub struct Resource;
     impl Tag for Resource {}
 
-    impl<P: Debug + Display> Access<Config, P> {
+    impl<P: Debug + Display + Clone> Access<Config, P> {
         /// Create a permission for values contained in git configuration files.
         ///
         /// This applies permissions to values contained inside of these files.
@@ -103,7 +103,7 @@ pub mod permission {
         }
     }
 
-    impl<P: Debug + Display> Access<Resource, P> {
+    impl<P: Debug + Display + Clone> Access<Resource, P> {
         /// Create a permission a file or directory itself.
         ///
         /// This applies permissions to a configuration file itself and whether it can be used at all, or to a directory
@@ -124,8 +124,10 @@ pub mod permission {
     #[derive(Debug, thiserror::Error)]
     #[error("Not allowed to handle resource {:?}: permission {}", .resource, .permission)]
     pub struct Error<R: Debug, P: Debug + Display> {
-        resource: R,
-        permission: P,
+        /// The resource which cannot be used.
+        pub resource: R,
+        /// The permission causing it to be disallowed.
+        pub permission: P,
     }
 }
 
@@ -141,6 +143,22 @@ pub enum Permission {
     Allow,
 }
 
+impl Permission {
+    /// Check this permissions and produce a reply to indicate if the `resource` can be used and in which way.
+    ///
+    /// Only if this permission is set to `Allow` will the resource be usable.
+    pub fn check<R: Debug>(&self, resource: R) -> Result<Option<R>, permission::Error<R, Self>> {
+        match self {
+            Permission::Allow => Ok(Some(resource)),
+            Permission::Deny => Ok(None),
+            Permission::Forbid => Err(permission::Error {
+                resource,
+                permission: self.clone(),
+            }),
+        }
+    }
+}
+
 impl Display for Permission {
     fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
         Display::fmt(
@@ -172,20 +190,20 @@ impl Display for ReadWrite {
 }
 
 /// A container to define tagged access permissions, rendering the permission read-only.
-#[derive(Debug)]
-pub struct Access<T: permission::Tag, P: Debug + Display> {
+#[derive(Debug, Clone)]
+pub struct Access<T: permission::Tag, P: Debug + Display + Clone> {
     /// The access permission itself.
     permission: P,
     _data: PhantomData<T>,
 }
 
-impl<T: permission::Tag, P: Debug + Display> Display for Access<T, P> {
+impl<T: permission::Tag, P: Debug + Display + Clone> Display for Access<T, P> {
     fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
         Display::fmt(&self.permission, f)
     }
 }
 
-impl<T: permission::Tag, P: Debug + Display> Deref for Access<T, P> {
+impl<T: permission::Tag, P: Debug + Display + Clone> Deref for Access<T, P> {
     type Target = P;
 
     fn deref(&self) -> &Self::Target {