Struct WriteGuards 

pub struct WriteGuards {
    pub captcha_modules: Vec<String>,
    pub signature_modules: Vec<String>,
    pub payments_signature_modules: Vec<String>,
    pub hmac_signature_modules: Vec<(String, &'static str)>,
    pub signed_link_modules: Vec<String>,
    pub has_public_writes: bool,
    pub has_admin_routes: bool,
}

What the composed modules demand of the runtime, module by module.

Fields

captcha_modules: Vec<String>

Modules with a RoutePolicy::HumanForm-guarded write (or the conservative fallback: public_writes and no declared policy at all).

signature_modules: Vec<String>

Modules with a RoutePolicy::Signature-guarded write (webhooks), however they verify them.

payments_signature_modules: Vec<String>

The signature modules that prove their deliveries through Payments::verify_webhook — the default SignatureVerification.

hmac_signature_modules: Vec<(String, &'static str)>

The signature modules proving their deliveries with a webhook_signature scheme (issue #533), paired with the ModuleConfig suffix of the key holding each secret; Self::hmac_signature_secrets composes the full keys.

signed_link_modules: Vec<String>

Modules whose public writes are proved by an artifact this service issued (RoutePolicy::SignedLink, issue #143).

has_public_writes: bool

Whether the composition exposes any public write at all (issue #437): a declared guarded action of any kind — a captcha form, a webhook, a signed link — or the module-level public_writes flag for modules that predate surfaces. Broader than the three lists above by design: a webhook is an unauthenticated endpoint too, and the rate-limiter leg of production_readiness cares that something is writable, not by which proof. A RoutePolicy::ApiKey write demands no RateLimiter here: per-key limiting happens only where a handler calls check_rate_limit with ApiKeyPrincipal::rate_limit_key and a limiter is wired.

has_admin_routes: bool

Whether any declared action is the admin plane (issue #437): an Audience::Admin action, or any path under /admin. An admin route’s bearer token is guessed rather than submitted, so it needs a budget even when the venture has no public writes — which is why this is its own answer and not a byproduct of Self::has_public_writes.

Implementations

impl WriteGuards

pub fn collect(modules: &[Arc<dyn Module>]) -> Self

Reads each module’s declared surface. A module whose surface has no policy-guarded write but still sets public_writes counts as needing a CAPTCHA — the undeclared-public-writer fallback keeps out-of-tree and surface-less modules (the auth crates predate ADR 0010 surfaces) under the same gate instead of silently exempting them.

pub fn from_surface(module: &str, surface: &Surface) -> Self

The guards a declared surface demands (issue #131). A sidecar’s merged surface is not a Module this process can ask public_writes or signature_verification of, so whatever the document declares is exactly what it needs, and its signature routes verify through Payments, the default (issue #533). Same per-action reading as Self::collect through the one Action::demands_captcha predicate and the one declares_admin_routes predicate — a sidecar’s admin plane needs the limiter floor as much as an in-process module’s.

pub fn needs_signer(&self) -> bool

Whether any module proves a public write with an artifact this service issued, and so needs a usable Signer (issue #143).

pub fn needs_captcha(&self) -> bool

Whether any module needs the Captcha port.

pub fn needs_payments(&self) -> bool

Whether any module proves a public write with Payments::verify_webhook. Since issue #533 this is no longer “some module receives signed webhooks”: a module may declare SignatureVerification::Hmac and verify with the core webhook_signature scheme instead, and this answers false for it — its production requirement is its secret key, not a port (see webhook_secret_readiness). The STRIPE_WEBHOOK_SECRET doctor rule is keyed on this, correctly.

pub fn hmac_signature_secrets(&self) -> Vec<(String, String)>

The HMAC-verified signature modules and the full config key each reads its secret from, composed through ModuleConfig’s {MODULE}_{SUFFIX} rule — the one place the prefix logic lives (issue #533).

pub fn needs_rate_limiter(&self) -> bool

Whether any route in the composition needs a limiter sitting in front of it (issue #437): a public write or an admin route. The admin plane is enough on its own — a bearer token is guessed, not submitted, so a venture that publishes nothing still needs the budget before its /admin/* routes.

Trait Implementations

impl Clone for WriteGuards

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for WriteGuards

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for WriteGuards

fn default() -> Self

Returns the “default value” for a type.

impl Eq for WriteGuards

impl PartialEq for WriteGuards

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for WriteGuards