Module permissions 

The toolkit’s permission gate.

Two questions, each answered by the one model that owns it:

• May this person (or their agent) perform this action? Decided by tilo-action-policy over the workspace’s grants: a Standing names the person, the workspace’s policy and any delegation bounding them, and PermissionScope::Action names a node below the workspace and the action’s kind.
• May this app’s code reach this path, device or host? Decided by the sandbox capabilities of [collab_types::caps] (PermissionScope::Sandbox).

The host installs both via PermissionContext::new; nothing here decides anything itself.

Modules

capability

Widgets gated by a permission scope.

policy

Who may invoke which action.

Structs

ActionDecider

Answers PermissionContext::permits_action for many actions of one app: one authority for all of them, and the node of the resource last asked about kept for the next action on it.

Actor

The thing asking to reach a sandboxed resource: every Principal it can prove it is, and its signing key if it has one.

CapOverride

One sandbox capability.

KindSet

The kinds a grant covers. Serialised as the list of kinds.

LivePermissions

A participant’s permissions as they stand now, following every change the host makes while the app runs: a role changed by the record’s owner, a grant revoked, a capability granted. Read-only: only the host changes them.

PermissionContext

The authority and sandbox a frame’s permission checks are decided against. Held by App, consulted by app::dispatch_gated_event before a gated widget ever sees an event.

SharedPermissions

The permissions a host shares with what it hosts (an app, its components, a worker) and changes while they run: a role changed by the record’s owner, a grant revoked, a workspace’s participation. Every change goes through Self::set, which moves shared_revision on, so whatever derives something from shared permissions (which controls may run) derives it again only after a change, not on every frame.

Standing

Who is acting in a workspace and everything their authority depends on.

TreePath

A node, or a pattern of nodes, in the published tree.

UserId

A person’s stable id, as apps and presence spell it.

WeakPermissions

SharedPermissions held without keeping them shared.

Enums

Access

How far a sandbox capability reaches into its resource.

ActionKind

What an action is able to do, derived by the framework from the action’s code and never declared by an app.

Answer

The answer a grant gives. Ordered Deny < Ask < Allow, so the stricter of two answers is their minimum.

AppKind

Which system app a presence key or a permission scope refers to.

CapDecision

The outcome of a sandbox check.

Denial

A refused permission check, with the reason people and agents read.

Effect

Whether a capability grants or restricts.

Expiry

When a capability dies — the expiry of (subject, resource, verbs, expiry).

PermissionScope

What a widget or a launch asks permission for.

Principal

A named principal — the string-keyed half of the subject space.

ResourceRef

A sandboxed resource an app might reach.

Role

A role preset. A member of a workspace holds one; the workspace keeps the grants each role carries (see crate::roles).

Scope

What a sandbox capability ranges over.

Subject

Who a capability is about: one signing identity or a named Principal.

Constants

LOCAL_USER

The id the local, unrestricted user acts as under PermissionContext::permissive.

LOCAL_WORKSPACE

The workspace PermissionContext::permissive and PermissionContext::member decide in, when no host names one.

Functions

action_node

The node below the workspace of action action_id on resource resource_id (of kind resource_kind) published by app_id.

admit_in_window

The shared admission (tilo_action_policy::admit) as a window takes it for its own person, the decision a broker takes for a caller: an ask is theirs to confirm in the window when they act themselves (direct), and nobody else’s here. confirmed is their confirmation, or the broker having admitted it.

decide_capability

May actor reach resource with access? A live matching grant whose access implies the request allows, unless a live matching restriction caps it below the request. now in Unix seconds; None skips expiry.

outside_changed

An outside authority permissions follow changed, on any thread: the host’s view of an app’s action authority, or a policy clock (PermissionContext::with_policy_time_sampler) that could not be read and can be again. Moves shared_revision on and wakes every loop that asked ([wake_on_outside_change]), so what it derived from permissions is derived again.

shared_revision

Moves on with every change of any SharedPermissions on this thread, and with every change of an outside authority they follow.