Enum Expiry 

pub enum Expiry {
    Never,
    AtUnix(u64),
    EndOfSession,
    AfterUse,
}

When a capability dies — the expiry of (subject, resource, verbs, expiry).

The whole lifetime vocabulary: the portal’s “Just once” / “Until I log out” / “Always” map to Expiry::AfterUse, EndOfSession and Never respectively, not a parallel enum.

Variants

Never

Lives until explicitly revoked, and survives a restart.

AtUnix(u64)

Dies at this wall-clock instant (seconds since epoch); survives a restart if not yet past.

EndOfSession

Dies when the granting session ends. Never written to disk.

AfterUse

Dies as soon as the requesting prompt completes. Never written to disk.

Implementations

impl Expiry

pub fn is_live_at(self, now: Option<u64>) -> bool

Is a capability with this expiry still live at now?

now: None skips time evaluation — used by the wire validator, which shares no clock with an op’s author. EndOfSession/AfterUse are live here; their deaths are events (not persisting, dropping after use), not instants.

pub fn persists_across_restart(self) -> bool

Should a capability with this expiry be written to disk?

The single answer to “does Always survive a restart?” — session- and use-scoped capabilities are excluded so persisting them can’t silently turn a one-shot grant into a permanent one.

pub fn outlives(self, other: Expiry) -> bool

Does a capability with this expiry outlive one with other?

Order: Never > AtUnix(later) > AtUnix(earlier) > EndOfSession > AfterUse. An explicit deadline outranks the session because it survives a restart.

pub fn longest(a: Expiry, b: Expiry) -> Expiry

The longer-lived of two expiries — the single definition of “strongest scope wins”, used both merging a re-grant and reporting an existing grant’s strength. Two answers here would eventually disagree, reading as a permanent grant silently becoming a session one.

Trait Implementations

impl Clone for Expiry

fn clone(&self) -> Expiry

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Expiry

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for Expiry

fn default() -> Expiry

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for Expiry

fn deserialize<__D>( __deserializer: __D, ) -> Result<Expiry, <__D as Deserializer<'de>>::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Model for Expiry

const CHECKS: bool

Whether this type or any value inside it has a #[model(check)] invariant; Self::check has nothing to do otherwise.

type Paths<__R> = Path<__R, Expiry>

The typed paths into a value of this type, rooted in the record R: a struct of field paths for a record, the Path itself for a value edited whole or through its own operations.

fn paths_at<__R>(path: Path<__R, Expiry>) -> Path<__R, Expiry>

The paths of the value at path.

fn to_json(&self) -> Value

The value as JSON: what [EditOp::Set] carries and history shows.

fn from_json(value: &Value) -> Result<Expiry, ModelError>

A value from its Self::to_json form.

fn load( doc: &AutoCommit, value: &Value<'_>, id: &ExId, ) -> Result<Expiry, ModelError>

Read from the value a parent found in its slot.

fn missing() -> Result<Expiry, ModelError>

The value of an absent slot. Types with a natural empty value return it, so a field added to a schema reads older documents without migration.

fn store(&self, doc: &mut AutoCommit, slot: Slot<'_>) -> Result<(), ModelError>

Write self into slot, changing only what differs from what the slot already holds.

fn value_schema() -> Value

The JSON Schema of this value’s JSON form (Self::to_json), as the published field edit describes what a path takes; the default accepts any value.

fn field_type(types: &mut TypeSet) -> FieldType

This value’s type in the language-neutral vocabulary a surface publishes (FieldType), declaring the records and enums it names in types. The default describes no type: any value.

fn check(&self) -> Result<(), Refusal>

Run every #[model(check)] invariant of this value and the values inside it.

fn collect_text(&self, out: &mut Vec<String>)

Append the human-readable text this value carries, for search indexing.

const SHAPE: Shape = crate::Shape::Value

How the value is laid out in the document; see Shape. Types written whole keep the default.

const OPS: bool = false

Whether this type or a value inside it has a vocabulary of its own (Operations, rich text’s): a record routes those edits’ gestures, landing places and schemas only into such fields, and never instantiates the routing for the others.

const NULLABLE: bool = false

Whether null is a value of the type: an absent Option. A field edit setting any other type to null is refused.

const SCALAR: bool = false

Whether store writes one scalar, with nothing inside it that a concurrent writer could add to. A record made just now leaves out such a field holding its missing value: an absent key reads as it. An object (text, a map, a list) is always made with its record, so two writers fill the same one.

const TABLE: &'static ModelTable = _

The type’s functions as data, which a record holding it reaches it through ([crate::table]): by default its own functions, erased.

fn edit( doc: &mut AutoCommit, slot: Slot<'_>, path: &[Segment], op: &EditOp, cx: &mut ActionCx, ) -> Result<(), ModelError>

Apply the field edit op at path, below the value in slot, touching only what it changes, then run the invariants of the values it touched. The default edits a value only as a whole.

fn diff<R>(&self, after: &Self, path: &[Segment], out: &mut Vec<Edit<R>>)

The field edits that turn self into after, at path below the record: what a surface that edited a local copy submits. The default sets the value whole when it changed; containers and records edit only what differs, item by item and field by field. A value that would store as it is (Self::stores_as) is compared in memory, without turning either side into JSON.

fn nested_collections(&self) -> Vec<ItemCollection>

The item collections inside this value, when it is an item of a collection itself (a slide’s elements); #[derive(Model)] lists a record’s, the default has none.

fn read_whole(&mut self, doc: &AutoCommit) -> Result<(), ModelError>

Read everything this value holds, for a field marked #[model(whole)]: a value read lazily (rich text reads its paragraphs as views ask for them) reads all of it, so every reader of the record — a verb, search, read_content — sees all of it. The default has nothing more to read.

fn label(&self) -> Option<String>

What names this value for people (#[model(label)]): history, search, agents and item resources use it.

fn op_coalesces( path: &[Segment], previous: &Value, next: &Value, ) -> Option<bool>

Whether two edits in the own vocabulary of the value at path below this type are one gesture (Operations); None when nothing there has one.

fn op_continuable(path: &[Segment], op: &Value) -> Option<bool>

Whether a gesture may go on after the edit op at path.

fn op_describe(path: &[Segment], op: &Value) -> Option<OpDescription>

What the edit op at path below this type did, in the history entry’s terms (Operations::describe).

fn op_lands(&self, path: &[Segment], op: &Value) -> Option<Place>

Where the actor of the edit op at path below this value is after it applied.

fn op_schemas(prefix: &str, out: &mut Vec<(String, Value)>)

The schemas of the own vocabularies of the values below this type, by path pattern from prefix (* for every item).

fn get_at(&self, path: &[Segment]) -> Option<&(dyn Any + 'static)>

where Self: 'static,

The value at path below this one, if it is there. A value with nothing inside it is found only at the empty path.

fn stores_as(&self, before: &Self) -> bool

Whether writing self over a slot that holds before, as a store left it, would change nothing: an in-memory comparison, so an action that changed one item of a long collection does not visit the others. Must only answer true when store would write no operation; the default answers false (unknown).

fn store_changed( &self, before: &Self, doc: &mut AutoCommit, slot: Slot<'_>, dirty: &Delta, ) -> Result<(), ModelError>

Write self into slot, which holds before: exactly the operations store would write, found by comparing with before where store would read the document.

fn refresh( &mut self, doc: &AutoCommit, value: &Value<'_>, id: &ExId, delta: &Delta, ) -> Result<(), ModelError>

Bring a value read earlier up to date after the changes in delta, re-reading only what they touched. value and id are what the parent’s slot holds now — the same object as when self was read, or the parent would have read it anew. The default reads the value again, which is right for scalars and short values.

impl PartialEq for Expiry

fn eq(&self, other: &Expiry) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for Expiry

fn serialize<__S>( &self, __serializer: __S, ) -> Result<<__S as Serializer>::Ok, <__S as Serializer>::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Copy for Expiry

impl Eq for Expiry

impl Settable for Expiry

impl StructuralPartialEq for Expiry