Module permissions

Expand description

The toolkit’s permission gate.

Two questions, each answered by the one model that owns it:

May this person (or their agent) perform this action? Decided by tilo-action-policy over the room’s grants: a Standing names the person, the room’s policy and any delegation bounding them, and PermissionScope::Action names a node below the room and the action’s kind.
May this app’s code reach this path, device or host? Decided by the sandbox capabilities of [collab_types::caps] (PermissionScope::Sandbox).

The host installs both via PermissionContext::new; nothing here decides anything itself.

Modules§

ActionDecider: Answers PermissionContext::permits_action for many actions of one app: one authority for all of them, and the node of the resource last asked about kept for the next action on it.
Actor: The thing asking to reach a sandboxed resource: every Principal it can prove it is, and its signing key if it has one.
CapOverride: One sandbox capability.
KindSet: The kinds a grant covers. Serialised as the list of kinds.
LivePermissions: A participant’s permissions as they stand now, following every change the host makes while the app runs: a role changed by the record’s owner, a grant revoked, a capability granted. Read-only: only the host changes them.
PermissionContext: The authority and sandbox a frame’s permission checks are decided against. Held by App, consulted by app::dispatch_gated_event before a gated widget ever sees an event.
Standing: Who is acting in a room and everything their authority depends on.
TreePath: A node, or a pattern of nodes, in the published tree.
UserId: A person’s stable id, as apps and presence spell it.

Access: How far a sandbox capability reaches into its resource.
ActionKind: What an action is able to do, derived by the framework from the action’s code and never declared by an app.
Answer: The answer a grant gives. Ordered Deny < Ask < Allow, so the stricter of two answers is their minimum.
AppKind: Which system app a presence key or a permission scope refers to.
CapDecision: The outcome of a sandbox check.
Denial: A refused permission check, with the reason people and agents read.
Effect: Whether a capability grants or restricts.
Expiry: When a capability dies — the expiry of (subject, resource, verbs, expiry).
PermissionScope: What a widget or a launch asks permission for.
Principal: A named principal — the string-keyed half of the subject space.
ResourceRef: A sandboxed resource an app might reach.
Role: A role preset. A member of a room holds one; the room keeps the grants each role carries (see crate::roles).
Scope: What a sandbox capability ranges over.
Subject: Who a capability is about: one signing identity or a named Principal.

LOCAL_ROOM: The room PermissionContext::permissive and PermissionContext::member decide in, when no host names one.
LOCAL_USER: The id the local, unrestricted user acts as under PermissionContext::permissive.

action_node: The node below the room of action action_id on resource resource_id (of kind resource_kind) published by app_id.
decide_capability: May actor reach resource with access? A live matching grant whose access implies the request allows, unless a live matching restriction caps it below the request. now in Unix seconds; None skips expiry.