pub enum MutationPolicy {
Permissive,
DenyAll,
}Expand description
Local authorization mode for the services represented by MutationTarget:
ten confirmed services and inbound WriteGroup.
SC mTLS channel/peer authentication is not service authorization. Identities
include claimed link/routed addresses separately from the direct-SC
principal an installed
ServerPolicy sees.
DCC, admission, decoding and WPM element validation retain their existing precedence.
An inbound WriteGroup is decided once per Channel write it would make
(MutationTarget::WriteGroup): DenyAll denies each one, and a policy
may allow some Channels and not others (#1319). A denied write is
skipped silently, since nothing answers an unconfirmed request, and counted.
Variants§
Permissive
Preserve default-allow behavior: without a policy every decision is allowed; an installed policy must allow each one.
DenyAll
Deny every covered decision, even with an allow-all policy installed. The policy is not asked. Denials use SERVICES / SERVICE_REQUEST_DENIED.