Struct ActionContract 

pub struct ActionContract {
    pub availability: Availability,
    pub kind: ActionKind,
    pub field: Option<String>,
    pub risk: RiskLevel,
    pub confirmation: ConfirmationPolicy,
    pub retry: RetryPolicy,
    pub reversible: bool,
    pub execution: ExecutionMode,
    pub result: ResultSpec,
    pub tags: Vec<String>,
}

Complete operational contract copied into every inert descriptor.

Fields

availability: Availability

kind: ActionKind

What the action is able to do: read, change only the document, or reach outside it. Grants are given by kind, so every door decides by this and the action’s place in the published tree.

field: Option<String>

The one field of its resource the action writes, when it writes only one: the action sits below that field in the tree, so a grant on the field (commenting is writing comments) reaches it.

risk: RiskLevel

confirmation: ConfirmationPolicy

retry: RetryPolicy

reversible: bool

execution: ExecutionMode

result: ResultSpec

tags: Vec<String>

Implementations

impl ActionContract

pub fn need(&self) -> ActionNeed

What an invocation needs when its value does not say otherwise.

pub fn view() -> ActionContract

Safe defaults for a presentation-only operation.

pub fn for_operation(operation: OperationKind) -> ActionContract

The defaults for an operation of operation’s kind: a view reads, a document operation changes only the document, an effect reaches outside it.

pub fn is_programmatic(&self) -> bool

Whether the action is offered only to programmatic callers. See PROGRAMMATIC_TAG.

pub fn reads_document(&self) -> bool

Whether the action reads the open document’s first page. See DOCUMENT_READ_TAG.

pub fn carries_untrusted_content(&self) -> bool

Whether the action’s result carries content from outside the user’s own data. See UNTRUSTED_CONTENT_TAG.

pub fn confirmation_depends_on_arguments(&self) -> bool

Whether confirmation depends on the invocation’s arguments. See ARGUMENT_RISK_TAG.

pub fn advertised_confirmation(&self) -> ConfirmationPolicy

The confirmation a caller that cannot classify arguments must assume: the declared policy, or ConfirmationPolicy::Confirm for an action whose risk depends on its arguments. A trust boundary that only sees this inert contract (the session broker) gates on it; the publishing host, which can classify, asks ActionSpec::confirmation_for_json.

pub fn confirmation_for_argument( &self, argument: Option<&str>, ) -> ConfirmationPolicy

The confirmation an invocation with argument (the wire argument: typed JSON behind ARGUMENTS_JSON_PREFIX) needs, decided without the publishing app’s code: the declared policy; for a generic field edit, the edit itself read by tilo_action_policy::edits::field_edit_asks; for any other action whose risk depends on its arguments, Self::advertised_confirmation.

pub fn validate_declaration(&self) -> Vec<String>

Validate the contract as inert protocol data. This is intentionally usable at both publication ends: a well-behaved app checks before it sends, and the broker repeats the check at its trust boundary.

impl ActionContract

pub fn requirements(&self) -> Vec<ContextRequirement>

The context preconditions declared on this contract, in order.

pub fn is_participant_view(&self) -> bool

Whether this View contract changes only the invoking participant’s view (PARTICIPANT_VIEW_TAG).

Trait Implementations

impl Clone for ActionContract

fn clone(&self) -> ActionContract

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ActionContract

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for ActionContract

fn default() -> ActionContract

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for ActionContract

fn deserialize<__D>( __deserializer: __D, ) -> Result<ActionContract, <__D as Deserializer<'de>>::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for ActionContract

fn eq(&self, other: &ActionContract) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for ActionContract

fn serialize<__S>( &self, __serializer: __S, ) -> Result<<__S as Serializer>::Ok, <__S as Serializer>::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for ActionContract

impl StructuralPartialEq for ActionContract