Struct NamespaceGuard 

pub struct NamespaceGuard { /* private fields */ }

Adapter-boundary guard shared by API, stream, and worker transports.

Implementations

impl NamespaceGuard

pub const fn new(resolver: NamespaceResolver) -> Self

Build a guard from the shared namespace resolver.

pub fn shared_engine() -> Self

The guard of an auth-off, shared-engine server with no static namespace restriction: every caller is the operator and every namespace resolves. It is what a stock single-tenant server commissions with, and what the transport tests and the failover examples bind to a liminal listener — named, so a listener that admits everything says so in its own construction rather than by having no admission at all.

pub const fn resolver(&self) -> &NamespaceResolver

Borrow the resolver backing this guard.

pub async fn scope( &self, caller: &CallerIdentity, operation: &NamespaceOperation<'_>, ) -> Result<ScopedEngine, ServerError>

Authorize and scope an operation before any engine method can be called.

Workflow-targeted operations verify durable ownership, which reads the target workflow’s recorded history through the resolver’s ownership source.

Errors

Returns ServerError::Namespace (namespace_denied) when the caller has no grant for the requested namespace or a subscription selects another namespace. Returns a not_found wire error when the requested namespace is granted but a targeted workflow is not visible in it — foreign-owned and nonexistent workflows are deliberately indistinguishable so the guard never leaks cross-tenant existence.

pub fn authorize_namespace( &self, caller: &CallerIdentity, namespace: &str, ) -> Result<String, ServerError>

Authorize a caller for a single namespace by name, returning the resolved namespace if the grant allows it.

This is the SAME grant check the access hop runs (NamespaceResolver::resolve): the operator (all-namespaces) is authorized for any name, an enumerated caller only for a granted one, and single-tenant mode only for the configured namespace. It carries no workflow/schedule target, so it never reaches durable ownership — the control-plane create path (POST /namespaces) authorizes namespace existence, not a per-resource probe.

Errors

Returns ServerError::Namespace (namespace_denied) when the caller has no grant for namespace, so an unauthorized caller can never create (or learn the existence of) a namespace it cannot access.

pub fn scope_worker_namespaces( &self, caller: &CallerIdentity, namespaces: &[String], ) -> Result<Vec<String>, ServerError>

Authorize every namespace in a worker registration’s set, returning the resolved namespaces in stable wire order with duplicates removed.

A worker serves a SET of namespaces (NODE affinity model). Each one is an independent correctness boundary, so the worker is authorized for it exactly as a single-namespace operation would be: the whole registration is denied if the caller lacks a grant for any namespace in the set. The set must be non-empty.

Errors

Returns ServerError::Namespace (namespace_denied) when the set is empty or the caller has no grant for some namespace in it.

Trait Implementations

impl Clone for NamespaceGuard

fn clone(&self) -> NamespaceGuard

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.