pub struct Effective { /* private fields */ }Expand description
The grants that hold right now: an Acl with every lapsed deadline
already dropped (D66).
Produced only by Acl::at, which is what makes the deadline
impossible to skip — there is no way to reach allows holding a
table nobody has dated. Every field of every method below behaves
exactly as it did before D66 for a grant with no deadline, which is
still most of them.
Implementations§
Source§impl Effective
impl Effective
Sourcepub fn holds_anything(&self, user: &str) -> bool
pub fn holds_anything(&self, user: &str) -> bool
Whether user holds any live grant at all.
Asked of ANON before an unauthenticated request is evaluated
under that name, so a node whose table never mentions it keeps
refusing strangers at the gate rather than walking the whole
request to reach the same answer. It is a question about the
table and not an authorization: what the caller may actually
reach is still Effective::allows, repository by repository.
Sourcepub fn allows(&self, user: &str, scope: &Scope, level: Level) -> bool
pub fn allows(&self, user: &str, scope: &Scope, level: Level) -> bool
Whether user holds at least level over scope.
Sourcepub fn allows_repo(&self, user: &str, repo: &str, level: Level) -> bool
pub fn allows_repo(&self, user: &str, repo: &str, level: Level) -> bool
Whether user holds at least level over repository repo,
given in either spelling (owner/repo or owner/repo.git).
Sourcepub fn has_owner(&self, repo: &str) -> bool
pub fn has_owner(&self, repo: &str) -> bool
Whether anybody at all holds Level::Own over repo (D42).
This is the switch between the two landing rules, not an authorization check: a repository with no owner keeps the approval-weight gate, and one with an owner asks for owner assent instead. It is deliberately a question about the repository rather than about a user, because the gate has to choose which rule applies before it knows whether the actor satisfies it.
Sourcepub fn owners(&self, repo: &str) -> Vec<String>
pub fn owners(&self, repo: &str) -> Vec<String>
Every subject holding Level::Own over repo, sorted.
Self::has_owner answers the question the gate asks — which
of the two landing rules applies — and deliberately answers it
without naming anybody, because the gate does not need a name.
A review page does: “an owner’s assent lands this” is a rule, and
“alice or bob can land this” is an answer. Sorted so the
sentence a page renders is the same on two nodes holding the same
grants.
This is a description of the ACL, never a decision about a
landing. The one function that admits a landing is
Platform::authorization_for, and nothing here may become a
second opinion beside it.
Sourcepub fn cache_key(&self, user: &str) -> String
pub fn cache_key(&self, user: &str) -> String
A key identifying everything a filtered response depends on: the reader and the grants they hold, rendered canonically.
Two requests with the same key produce the same filtered payload, which is what makes the browser page cacheable per reader. Editing the ACL file changes the key, so a hot reload invalidates the cached page without anything having to notice the reload happened.
The username is part of the key rather than the grants alone,
because filter_response also keeps reviews the reader is
assigned to. Two readers holding identical grants can therefore
see different pages, and a key covering only the grants would
serve one of them the other’s assignments.