Struct PermissionContext 

pub struct PermissionContext { /* private fields */ }

The authority and sandbox a frame’s permission checks are decided against. Held by App, consulted by app::dispatch_gated_event before a gated widget ever sees an event.

Implementations

impl PermissionContext

pub fn new( actor: Actor, sandbox: Vec<CapOverride>, standing: Standing, ) -> PermissionContext

Decide with standing in the room and sandbox for the app’s code, reached as actor.

pub fn permissive() -> PermissionContext

The unrestricted local user: the owner of LOCAL_ROOM holding one explicit sandbox capability over the whole filesystem.

Not a bypass flag — ownership is the room’s structural rule and the sandbox reach is a real CapOverride, both evaluated like any other. Right for a solo install, --shots, and any session the compositor has not handed a narrower one. Wrong for anything acting on a remote peer’s behalf.

pub fn member(person: impl Into<String>, role: Role) -> PermissionContext

person holding role in LOCAL_ROOM (owning it for Role::Owner), with no sandbox reach.

pub fn member_of( room: &str, person: impl Into<String>, role: Role, ) -> PermissionContext

person holding role in room (owning it for Role::Owner), with no sandbox reach.

pub fn from_standing(room: &str, standing: Standing) -> PermissionContext

The permissions of a whole standing a host built (an installer bounded by a bot’s grants), decided exactly as that standing says.

pub fn stranger(person: impl Into<String>) -> PermissionContext

person, who is no member of LOCAL_ROOM: nothing is allowed.

pub fn granted( person: impl Into<String>, relative: &TreePath, kinds: KindSet, until: Option<u64>, ) -> PermissionContext

person, no member of LOCAL_ROOM, granted exactly kinds at relative (a path below the room), until Unix second until if given.

pub fn agent_granted( agent: &str, relative: &TreePath, kinds: KindSet, ) -> PermissionContext

The owner of LOCAL_ROOM acting through agent agent, which is granted exactly kinds at relative.

pub fn agent_granted_at( agent: &str, nodes: &[TreePath], kinds: KindSet, ) -> PermissionContext

The owner of LOCAL_ROOM acting through agent agent, which is granted exactly kinds at each of nodes (paths below the room): the scope an invitation gave it.

pub fn with_grant(self, grant: Grant) -> PermissionContext

The same context with one more grant in the room’s policy.

pub fn acting_as( self, subject: Subject, grants: Vec<Grant>, ) -> PermissionContext

The same person acting through a delegation of subject carrying grants.

pub fn read_only(&self) -> PermissionContext

The same person, reading only: what a retired document or a past version offers whoever holds it.

pub fn with_policy_time_sampler( self, sampler: Arc<dyn Fn() -> Result<u64, String> + Send + Sync>, ) -> PermissionContext

Retain the actual host’s fallible policy-time sampler (Unix seconds). This supplies time only, not authority. Every decision resamples; failure denies without consulting the wall clock or a numeric pin. Clones retain this same sampler.

pub fn with_once_spender( self, spend: Arc<dyn Fn(&[GrantId]) -> Result<(), String> + Send + Sync>, ) -> PermissionContext

Let an admission here rely on a Once grant, handing what it spent to spend, the host’s revocation of it, as part of admitting the action.

pub fn spend_once(&mut self, spent: &[GrantId]) -> Result<(), String>

Spend the Once grants an admission relied on (Self::invocation_verdict): the host revokes them, and this context never relies on them again.

Errors

When the host could not revoke them: the admission must not proceed.

pub fn at_unix_time(self, now: u64) -> PermissionContext

Pin a context’s decision time. An installed host sampler always takes precedence, including when it fails.

pub fn with_standing(self, standing: Standing) -> PermissionContext

The same context with the room’s policy replaced, for a host that learned of a change.

pub fn at_current_time(&self) -> Result<PermissionContext, String>

Refresh an execution check, preserving the actual host’s retained clock.

Errors

Refuses an unavailable clock or a failed retained host policy sampler.

pub fn granting(self, cap: CapOverride) -> PermissionContext

The same context reaching one more sandboxed resource.

pub fn user(&self) -> &UserId

The acting person’s id.

pub fn actor(&self) -> &Actor

pub fn role(&self) -> Option<Role>

The role the person holds in the room, if any.

pub fn standing(&self) -> &Standing

The standing actions are decided against.

pub fn capabilities(&self) -> &[CapOverride]

The sandbox capabilities in force.

pub fn answer(&self, node: &TreePath, kind: ActionKind) -> Answer

The answer for an action of kind at node below the room.

pub fn check(&self, scope: &PermissionScope) -> bool

Whether the scope is permitted: an action that is allowed or asks first, a sandboxed resource the app reaches. Fail-closed.

pub fn check_with_denied_feedback( &self, scope: &PermissionScope, ) -> Option<Denial>

PermissionContext::check with the reason. None means permitted.

pub fn action_answer( &self, app_id: &str, resource_kind: &str, resource_id: &str, action: &ActionSpec, ) -> Answer

The answer for performing action on resource (of kind resource_kind), published by the app app_id.

pub fn invocation_verdict( &self, app_id: &str, resource: &Resource, action: &ActionSpec, json: Option<&Map<String, Value>>, argument: Option<&str>, ) -> (Answer, Vec<GrantId>)

The answer for admitting one invocation of action on resource with these arguments, and the Once grants admitting it spends: the door that runs it hands them to Self::spend_once first.

pub fn permits_invocation( &self, app_id: &str, resource: &Resource, action: &ActionSpec, json: Option<&Map<String, Value>>, argument: Option<&str>, ) -> bool

May the actor take this one invocation of action on resource, carrying json (or the prompted argument)? Allowed; or asking first when the person acts themselves, their own gesture being the answer. Someone acting for them does not get past an ask here.

pub fn invocation_answer( &self, app_id: &str, resource: &Resource, action: &ActionSpec, json: Option<&Map<String, Value>>, argument: Option<&str>, ) -> Answer

The answer for invoking action on resource with these arguments. An Ask runs only once the person confirmed it in the host.

pub fn permits_action( &self, app_id: &str, resource_kind: &str, resource_id: &str, action: &ActionSpec, ) -> bool

May the actor perform action on resource (of kind resource_kind), published by app_id? Allowed, or asking first.

pub fn permitted_resource( &self, app_id: &str, resource: Resource, ) -> Option<Resource>

resource, published by the app app_id, as the actor may reach it: the actions it may perform (allowed or asking first), and the nested resources that keep any. Denied is absent, never merely marked. None when nothing is left.

pub fn action_decider<'a>(&'a self, app_id: &'a str) -> ActionDecider<'a>

Answers whether each of many actions of app_id is permitted, as Self::permits_action does.

Trait Implementations

impl Clone for PermissionContext

fn clone(&self) -> PermissionContext

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for PermissionContext

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl PartialEq for PermissionContext

fn eq(&self, other: &PermissionContext) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Eq for PermissionContext

impl StructuralPartialEq for PermissionContext