Struct WhoIs 

pub struct WhoIs {
    pub node: Node,
    pub user_profile: Option<UserProfile>,
    pub capabilities: Vec<(String, Vec<String>)>,
    pub cap_map: BTreeMap<String, Vec<String>>,
}

The result of a Runtime::whois lookup: the node that owns a tailnet source address, plus its user and capabilities.

Analogous to tsnet’s apitype.WhoIsResponse.

Fields

node: Node

The node that owns the queried source IP.

user_profile: Option<UserProfile>

The profile of the user that owns the node — Go apitype.WhoIsResponse.UserProfile.

Resolved by joining the node’s owning user id against the netmap’s UserProfiles table (accumulated by the PeerTracker across delta updates). None when control sent no profile for that user — a tagged node with no human owner, or a profile not yet delivered. Carries the whole profile rather than one flattened label so an embedder can authorise on UserProfile::groups, which is the one owner attribute a node cannot re-derive locally; user is still there for the display case.

capabilities: Vec<(String, Vec<String>)>

The node’s node-level capability map (Go Node.CapMap — node attributes like can-funnel), as (capability, args) pairs, populated from the domain Node’s cap_map, sorted by capability name. Distinct from cap_map, which is the flow-scoped peer-capability grants.

cap_map: BTreeMap<String, Vec<String>>

The flow-scoped peer-capability grants for the queried src -> dst flow — Go apitype.WhoIsResponse.CapMap (tailcfg.PeerCapMap). The grants control’s packet-filter application rules authorize for traffic from this node to the queried address, keyed by capability name with raw-JSON values. Empty when no grant matches the flow (or no scoped query was made). Distinct from the node-level capabilities.

Implementations

impl WhoIs

pub fn user(&self) -> Option<String>

The best human-facing label for the owning user: the profile’s login name when present, else its display name, else None (no profile, or a profile with neither).

This is the flattened view user_profile replaced; use the profile itself for anything but display.

pub fn user_groups(&self) -> &[String]

The groups control reported for the owning user — Go apitype.WhoIsResponse.UserProfile.Groups. SCIM groups (e.g. engineering@example.com) or tailnet-policy group names (e.g. group:eng).

The authorisation shortcut: whois.user_groups().iter().any(|g| g == "group:eng").

Empty both when there is no profile at all and when control reported no groups — which includes every control server that does not send the field. An empty list is therefore “control told this node nothing”, not a proof of non-membership: fail closed on it (deny), never treat it as a negative assertion.

Trait Implementations

impl Clone for WhoIs

fn clone(&self) -> WhoIs

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for WhoIs

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for WhoIs

impl PartialEq for WhoIs

fn eq(&self, other: &WhoIs) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for WhoIs