pub enum MutationPolicy {
Permissive,
DenyAll,
}Expand description
Local authorization mode for the services represented by MutationTarget:
ten confirmed services and inbound WriteGroup.
SC mTLS channel/peer authentication is not service authorization. Identities include claimed link/routed addresses separately from the sealed direct-SC leaf/incarnation snapshot available to an installed authorizer. DCC, admission, decoding and WPM element validation retain their existing precedence.
An inbound WriteGroup is decided once per Channel write it would make
(MutationTarget::WriteGroup): DenyAll denies each one, and an
authorizer may allow some Channels and not others (#1319). A denied write is
skipped silently, since nothing answers an unconfirmed request, and counted.
Variants§
Permissive
Preserve default-allow behavior: an absent authorizer allows; an installed authorizer must allow each decision.
DenyAll
Deny every covered decision, even with an allow-all authorizer installed. The authorizer is not called. Denials use SERVICES / SERVICE_REQUEST_DENIED.