A framework-agnostic role and permission based access control library for Rust. Implement the Principal trait on your auth type, build composable AccessPolicy rules, and wire the provided middleware into actix-web or tower/axum.
Laye handles the authorization layer without dictating how you authenticate. You implement the Principal trait on whatever auth struct your application already uses, giving laye access to roles, permissions, and authentication state. From there you compose policies using require_all (AND) and require_any (OR), and attach the middleware to any route. Unauthenticated requests get a 401; authenticated but unauthorized requests get a 403. The library ships with optional feature flags for actix-web and tower so you only pull in what you need.
use laye::Principal;
#[derive(Clone)]
struct MyUser {
roles: Vec<String>,
permissions: Vec<String>,
authenticated: bool,
}
impl Principal for MyUser {
fn roles(&self) -> &[String] { &self.roles }
fn permissions(&self) -> &[String] { &self.permissions }
fn is_authenticated(&self) -> bool { self.authenticated }
}
use laye::{AccessPolicy, AccessRule};
let policy = AccessPolicy::require_all()
.add_rule(AccessRule::Authenticated)
.add_policy(
AccessPolicy::require_any()
.add_rule(AccessRule::Role("admin".into()))
.add_rule(AccessRule::Role("editor".into())),
);
[dependencies]
laye = { version = "0.1", features = ["actix-web"] }
use laye::actix::PolicyMiddlewareFactory;
App::new()
.service(
web::resource("/admin")
.wrap(PolicyMiddlewareFactory::new(policy))
.route(web::get().to(handler)),
)
[dependencies]
laye = { version = "0.1", features = ["tower"] }
use laye::tower::AccessControlLayer;
let app = Router::new()
.route("/admin", get(handler))
.layer(AccessControlLayer::new(policy));
require_all for AND logic across rules and nested policiesrequire_any for OR logicPolicyMiddlewareFactoryAccessControlLayerlaye = "0.1" for the core with no framework overhead
A Rust toolkit of distributed systems primitives backed by Redis. Strict and lax counters, instance-aware counters with automatic dead-instance cleanup, distributed locks (Mutex and RwLock), and sliding-window rate limiting.
High-performance sliding-window rate limiting for Rust with independently built local, Redis, and hybrid providers.
Production-ready Rust/Actix Web REST API starter with RBAC auth, SeaORM/PostgreSQL, Kafka-based email, and Docker tooling.
Available for senior engineering roles, consulting, and architecture reviews.