Struct WorkspacePolicy 

pub struct WorkspacePolicy {
    pub workspace: String,
    pub owner: Option<String>,
    pub members: BTreeMap<String, Role>,
    pub joined: BTreeMap<String, u64>,
    pub grants: Vec<Grant>,
}

Everything that decides authority in one workspace.

The built-in roles’ grants are the code’s (roles::role_rules): a stored policy loads with them as defined now (Self::with_current_roles), so a workspace written before a role changed gets the role as it is. Grants given in the workspace stay as stored.

Fields

workspace: String

The workspace this policy governs. Written under room, the name a stored policy names it by: a policy travels to devices and hosts on other builds, and their reader knows no other. The key it is read under is [StoredWorkspacePolicy]’s.

owner: Option<String>

The owner, by person id. Structural: holds everything and cannot be removed, demoted or denied by a grant.

members: BTreeMap<String, Role>

Members other than the owner and the role preset each holds.

joined: BTreeMap<String, u64>

When the workspace admitted each member, Unix milliseconds, by person id. Recorded once, by whoever admitted them, and kept through role changes; a member admitted before workspaces recorded it has none. People who share a name are numbered in this order.

grants: Vec<Grant>

Every grant in the workspace, role presets included.

Implementations

impl WorkspacePolicy

pub fn new( workspace: impl Into<String>, owner: impl Into<String>, ) -> WorkspacePolicy

A new workspace: its owner and every role’s preset grants.

pub fn has_others(&self, person: &str) -> bool

Whether anyone besides person belongs to the workspace, its owner or a member: what the workspace holds is shared with them whether or not they are here right now.

pub fn unowned( workspace: impl Into<String>, presets_by: &Subject, ) -> WorkspacePolicy

A workspace with no owner yet and the role presets in place.

pub fn with_current_roles(self) -> WorkspacePolicy

The policy with each built-in role’s grants as the code defines them now (roles::current_role_grants). Whatever reads a stored policy calls it, so stored copies of a role never decide.

pub fn rehome(&mut self, workspace: impl Into<String>)

Move the policy to another workspace id: every grant on this workspace’s nodes now names workspace. Grants on other workspaces are untouched.

pub fn node(&self) -> TreePath

pub fn is_owner(&self, person: &str) -> bool

pub fn role_of(&self, person: &str) -> Option<Role>

The role a person holds: Owner for the owner, None for a non-member.

pub fn joined_at(&self, person: &str) -> Option<u64>

When the workspace admitted person, Unix milliseconds: as recorded, or for an owner the workspace has no time for, 0, as they hold it since it began. None for a non-member or a member admitted unrecorded.

pub fn is_blocked(&self, person: &str) -> bool

Whether person is blocked: their own grants deny every kind on the whole workspace. A blocked member stays on record (history keeps naming them) but holds nothing; the owner is never blocked.

pub fn active_role(&self, person: &str) -> Option<Role>

The role person acts with: their role, unless they are blocked.

pub fn block(&self, person: &str, granted_by: Subject) -> Grant

pub fn is_banned(&self, person: &str) -> bool

Whether person is banned: the workspace holds their block:<person> grant. A banned person is not admitted again until unban.

pub fn restricted_until(&self, person: &str, cx: &Context<'_>) -> Option<u64>

Until when person is restricted, if a restriction of theirs is live in cx.

pub fn is_member(&self, person: &str) -> bool

pub fn subjects_of(&self, person: &str) -> Vec<Subject>

The subjects a person is known by here: themselves and their role.

pub fn party(&self, person: &str) -> Party<'_>

pub fn person_on_device<'a>( &'a self, person: &str, foreign: bool, foreign_bound: &'a [Grant], ) -> Authority<'a>

person’s authority from one of their devices: their own, and from a device that is not theirs (foreign), held to foreign_bound and to the workspace’s grants for such devices too.

pub fn party_of(&self, subject: Subject) -> Party<'_>

The workspace’s grants naming a delegation subject (an agent, an app, a task), for bounding a person’s authority.

pub fn app_authors(&self, app: &str, cx: &Context<'_>) -> bool

Whether application app is an author in the workspace: its grants let it change its own records there (roles::app_authorship).

pub fn grants_of<'a>( &'a self, subject: &'a Subject, ) -> impl Iterator<Item = &'a Grant> + 'a

The grants naming subject.

pub fn check_action( &self, actor: &Authority<'_>, action: &str, cx: &Context<'_>, approved: bool, ) -> Result<(), Refusal>

Whether the actor may perform a governance action. approved says the host witnessed the person’s approval when the answer is Ask.

Errors

Refusal::NotPermitted or Refusal::NeedsApproval.

pub fn spend(&mut self, spent: &[GrantId]) -> bool

Drop the Once grants among spent: an action ran on them. Any other grant named stays. Returns whether anything was dropped.

pub fn check_invite( &self, actor_person: &str, actor: &Authority<'_>, role: Role, cx: &Context<'_>, approved: bool, ) -> Result<(), Refusal>

Whether actor_person (acting through actor) may invite someone with role. An invite never carries more than the inviter’s role.

pub fn check( &self, actor_person: &str, actor: &Authority<'_>, change: &Change, cx: &Context<'_>, approved: bool, ) -> Result<(), Refusal>

Whether actor_person (acting through actor) may make change, without making it: what a door asks before it commits the change by its own means.

Errors

As Self::apply.

pub fn apply( &mut self, actor_person: &str, actor: &Authority<'_>, change: Change, cx: &Context<'_>, approved: bool, ) -> Result<(), Refusal>

Applies a governance change made by actor_person through actor.

Leaving needs no grant: whoever removes themselves from a workspace does it by being who they are, and a ban or a restriction stops it no more than the remove action would (check_reach).

Errors

When the action is not granted, or the change breaks a structural rule: the owner stays, roles and grants never exceed the actor’s own.

pub fn check_within( actor: &Authority<'_>, grant: &Grant, cx: &Context<'_>, ) -> Result<(), Refusal>

Whether grant gives no more than actor holds on its node, for each kind it covers. A Deny never exceeds.

Errors

Refusal::AboveActorGrant for the first kind it exceeds.

Trait Implementations

impl Clone for WorkspacePolicy

fn clone(&self) -> WorkspacePolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for WorkspacePolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for WorkspacePolicy

fn deserialize<__D>( __deserializer: __D, ) -> Result<WorkspacePolicy, <__D as Deserializer<'de>>::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl From<StoredWorkspacePolicy> for WorkspacePolicy

fn from(stored: StoredWorkspacePolicy) -> WorkspacePolicy

Converts to this type from the input type.

impl PartialEq for WorkspacePolicy

fn eq(&self, other: &WorkspacePolicy) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for WorkspacePolicy

fn serialize<__S>( &self, __serializer: __S, ) -> Result<<__S as Serializer>::Ok, <__S as Serializer>::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for WorkspacePolicy

impl StructuralPartialEq for WorkspacePolicy