Struct Authz 

pub struct Authz {
    pub allowed_consumers: Vec<String>,
    pub denied_consumers: Vec<String>,
    pub allowed_groups: Vec<String>,
    pub denied_groups: Vec<String>,
    pub required_scopes: Vec<String>,
    pub required_claims: BTreeMap<String, String>,
    pub ip_acl: Option<IpAcl>,
    pub geoip: Option<GeoipRules>,
    pub dry_run: bool,
}

Route-level authorization rules (DW-020, feature analysis 4.7).

Rule semantics (frozen here; evaluation lives in the authz module):

• denied_consumers / denied_groups beat allowed_* at the SAME level: within one Authz, a deny always wins a tie.
• allowed_consumers, when non-empty, is a closed set: the authenticated consumer must be listed. Empty = any authenticated consumer passes the consumer rule.
• allowed_groups, when non-empty, requires the consumer to be a member of at least one listed group. Group membership comes from the CONFIG consumer’s groups field; store-only consumers (DWARA_STATE_DB deployments whose consumer has no config entry) have no groups and therefore never satisfy an allowed_groups rule (documented limitation until the state store carries groups).
• required_scopes: every listed scope must appear in the JWT scope claim. The claim may be a space-separated string ("read write", the OAuth convention) or a JSON array of strings (["read", "write"], joined to its space-separated form when the identity’s claims are captured in authn); non-JWT identities (API key / Basic) carry no claims and never satisfy scope rules.
• required_claims: exact string equality on the stringified claim value; a claim absent from the token fails the match. Only string- and number-valued claims are captured on the identity (see authn), so a claim that is a JSON true/false, null, object, or nested structure can NEVER satisfy a required_claims entry — there is no stringified form to compare. Comparisons are CASE-SENSITIVE throughout: consumer names, groups, scopes, and claim values must match byte-for-byte.
• ip_acl: evaluated against the EFFECTIVE client IP — the X-Forwarded-For-resolved client when the direct peer is inside gateway.trusted_proxies (DW-009 chain), otherwise the direct peer. See IpAcl.

Authentication implication: an Authz carrying ANY identity rule (consumer/group/scope/claim) rejects anonymous requests with 401; an ip_acl-only Authz is the one authorization shape that can ADMIT anonymous traffic (from an IP the ACL allows). A denial of an AUTHENTICATED request is 403 (forbidden), never 401.

Fields

allowed_consumers: Vec<String>

Consumers allowed to call the route (empty = any authenticated).

denied_consumers: Vec<String>

Consumers explicitly rejected, even when otherwise allowed.

allowed_groups: Vec<String>

Groups allowed to call the route (empty = no group constraint).

denied_groups: Vec<String>

Groups explicitly rejected, even when otherwise allowed.

required_scopes: Vec<String>

JWT scopes (from the scope claim) every request must carry.

required_claims: BTreeMap<String, String>

Claims (name -> exact stringified value) every request must carry. A listed claim absent from the token’s claims fails.

ip_acl: Option<IpAcl>

IP allow/deny gate on the effective client IP.

geoip: Option<GeoipRules>

GeoIP gate on the effective client IP (DW-050): country/ASN allow and deny lists resolved through gateway.geoip’s database. An address the database does not resolve (private ranges, not-in-DB, no database loaded) is UNKNOWN and matches NEITHER list: deny-lists keep passing unknowns, allow-lists keep rejecting them. Requires a gateway.geoip block — validation rejects the predicate without one. See GeoipRules.

dry_run: bool

Monitor mode (DW-041): evaluate this block’s rules, LOG and count every would-be denial (the dwara_policy_dry_run_total{phase= "authz"} counter plus a dwara::policy warn event), but let the request PROCEED as if allowed. The flag is per ATTACHMENT and mutes only this block’s OWN denials: a LIVE deny at any other level of the chain still enforces (dry run never makes enforcement more permissive — the resolver walks past a dry deny and stops only at a live one). Route auth_required is an authentication-phase check, not an authorization rule, and is never muted by this flag.

Trait Implementations

impl Clone for Authz

fn clone(&self) -> Authz

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Authz

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Authz

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for Authz

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl PartialEq for Authz

fn eq(&self, other: &Authz) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for Authz

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for Authz