PermissionSync

PermissionSync is an architecture-first service for synchronizing a user's desired permissions with a selected target. The active constraints are recorded in the ADR index.

The Rust workspace currently contains target-neutral Core domain contracts, deterministic runtime target routing, a concrete Generic REST Permission Provider, selected-target synchronization orchestration, and an internal permissionsync-auth boundary for technical-caller JWT verification and scope target selection, plus framework-neutral inbound HTTP request processing with authentication/authorization integration. Actual HTTP server/listener/routing, runtime configuration/composition, health/readiness, concrete Target Adapters, supported-Keycloak deployment contract tests, and OCI/runtime integration remain future work; the internal auth-crate tests are not a deployment claim.

Development

The exact Rust toolchain is defined in rust-toolchain.toml. Install rustup and run this from the repository root to install the selected compiler and required components:

rustup toolchain install

Rustup selects that toolchain automatically for Cargo commands run in this repository. Build, check, and test the workspace with:

cargo build --workspace --all-features --locked
cargo check --workspace --all-targets --all-features --locked
cargo test --workspace --all-features --locked

The dependency-policy check requires the exact, Renovate-managed CARGO_DENY_VERSION in the Rust validation workflow:

cargo install --locked --version <CARGO_DENY_VERSION> cargo-deny

Run the complete local validation suite before opening an implementation PR:

prek run --all-files --refresh
cargo fmt --all -- --check
cargo deny --locked check
cargo check --workspace --all-targets --all-features --locked
cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
cargo test --workspace --all-features --locked
RUSTDOCFLAGS="-D warnings" cargo doc --workspace --all-features --no-deps --locked
git diff --check

Direct Cargo dependencies must be necessary for the current change, use exact versions such as =1.2.3, and update the committed Cargo.lock in the same change. deny.toml enforces advisory, license, source, wildcard, and duplicate version policy.

Tests must be deterministic and isolated. They must not rely on public Internet access, production services, timing races, arbitrary sleeps, unseeded randomness, execution order, retained state, fixed ports, or developer-specific configuration. Never retry a failed test; fix the defect or race instead. See AGENTS.md for the full testing policy.