add iam system

add iam store

feat: add crypto crate

introduce decrypt_data and encrypt_data functions

Signed-off-by: bestgopher <84328409@qq.com>

iam/src/lib.rs

@@ -0,0 +1,58 @@
+use auth::{Credentials, UserIdentity};
+use ecstore::store::ECStore;
+use log::debug;
+use manager::IamCache;
+use policy::{Args, Policy};
+use std::sync::{Arc, OnceLock};
+use store::object::ObjectStore;
+use time::OffsetDateTime;
+
+mod cache;
+mod format;
+mod handler;
+
+pub mod arn;
+pub mod auth;
+pub mod error;
+pub mod manager;
+pub mod policy;
+pub mod service_type;
+pub mod store;
+pub mod utils;
+
+pub use error::{Error, Result};
+
+static IAM_SYS: OnceLock<Arc<IamCache<ObjectStore>>> = OnceLock::new();
+
+pub async fn init_iam_sys(ecstore: Arc<ECStore>) -> crate::Result<()> {
+    debug!("init iam system");
+    let s = IamCache::new(ObjectStore::new(ecstore)).await;
+    IAM_SYS.get_or_init(move || s);
+    Ok(())
+}
+
+#[inline]
+pub fn get() -> crate::Result<Arc<IamCache<ObjectStore>>> {
+    IAM_SYS.get().map(|x| Arc::clone(x)).ok_or(Error::IamSysNotInitialized)
+}
+
+pub async fn is_allowed<'a>(args: Args<'a>) -> crate::Result<bool> {
+    Ok(get()?.is_allowed(args).await)
+}
+
+pub async fn get_service_account(ak: &str) -> crate::Result<(Credentials, Option<Policy>)> {
+    let (mut sa, policy) = get()?.get_service_account(ak).await?;
+
+    sa.credentials.secret_key.clear();
+    sa.credentials.access_key.clear();
+
+    Ok((sa.credentials, policy))
+}
+
+pub async fn add_service_account(cred: Credentials) -> crate::Result<OffsetDateTime> {
+    get()?.add_service_account(cred).await
+}
+
+pub async fn check_key(ak: &str) -> crate::Result<Option<UserIdentity>> {
+    get()?.check_key(ak).await
+}