openalice-fga

Deny-by-default check(), cycle-safe visited-set, depth-cap at 32, fail-closed on unknown roles/actions, parameterized sqlx queries (no injection), cross-tenant isolation proven by test; but no input-length validation on namespace/id strings (unbounded TEXT) and no audit logging of check decisions.

25 tests (24 unit + 1 doc-test) covering all 4 rewrite variants, cycle safety, deny-by-default, full 4×6 role×action cross-product truth table proving equivalence to openalice-tenants can(), tier↔role_rank, cross-tenant isolation, widget inheritance, unknown role/action fail-closed, store CRUD + idempotency; no integration tests against real Postgres PgTupleStore.

README documents model, check() guarantees, quick-start with code, embed adapter, and test count; lib.rs and check.rs have thorough algorithm-level rustdoc; manifest present and valid; but 23 definitions lack docstrings per inspector, no CHANGELOG, no @feature annotations, no architecture decision records.

Single clean migration with composite 6-column PK enforcing tuple uniqueness, idx_rt_object_relation covers the hot read path, ON CONFLICT DO NOTHING for idempotent writes, IS NOT DISTINCT FROM for NULL-safe deletes; no RLS (isolation is application-level tuples, acceptable for a library), no FK constraints (string refs by design), no created_at/updated_at timestamps, no GDPR delete-by-subject helper.

Depth cap and cycle guard prevent runaway recursion; ON CONFLICT idempotency on writes; but no query timeouts on PgTupleStore, no retry/backoff on transient DB errors, no connection-pool bounds or health validation — library delegates all resilience to the caller with zero guardrails.

Zero metrics, zero tracing spans, zero structured logs, no health endpoint — the crate is completely opaque at runtime; a check() failure or slow fan-out is invisible to operators.