pub type MutationAuthorizer = Arc<dyn Fn(&MutationAuthorizationContext) -> bool + Send + Sync>;Expand description
Fast, nonblocking, side-effect-free mutation authorization callback.
Timing: invoked after DCC prechecks, request admission, service decoding, and per-element validation, and before any database mutation, COV/event fan-out, or audit-log write. A denial performs no audit-log write (that would itself be a mutation); it is recorded in the saturating per-service counters and bounded tracing diagnostics only.
Under MutationPolicy::Permissive, default-allow: None preserves existing
behavior, deliberately unlike
AuditNotification/LifeSafetyOperation’s fail-closed absence. Returning false
or panicking denies with SERVICES / SERVICE_REQUEST_DENIED before mutation.
DCC prechecks and request admission precede this callback.
WPM invokes policy per decoded, validated element in wire order, immediately before its write. Denial or a malformed suffix leaves the authorized prefix committed. Other covered services decode their complete service request and invoke policy once, including multi-element list/subscription requests. Callbacks can run concurrently and WPM holds the database write lock: do not block, reenter the server, or perform side effects from a callback.
A WPM element that an object saves before serving (a Notification Forwarder’s or Notification Class’s list, an Access Rights object’s rules, Enable or Accompaniment, an Audit Log’s Log_Enable or Buffer_Size) is decided earlier, under a database read guard, before the server stages its save to run off the write lock (#1321). It is still decided once, after that element’s own validation and in wire order among such elements, so ahead of earlier elements no object saves first, and the handler applies the decision when it reaches the element. So the callback can be asked about such an element that the request never reaches, because an earlier element fails for another reason. Decision counters and audit records cover only the elements the handler reaches.
An inbound WriteGroup reaches the callback once per Channel it would write,
after the change list is decoded and matched to the Channels and before each
write, with no database guard held. The context has no invoke ID and an
unconfirmed service. Returning false, or panicking, skips that Channel
silently, with no Audit record; the other Channels are decided on their own.
Aliased Type§
pub struct MutationAuthorizer { /* private fields */ }