Struct MembershipGate 

pub struct MembershipGate { /* private fields */ }

The membership gate: the product mapping, the provider seam, the authority seam and the bounded decision index (ACCESS-006 R1, R2, R6).

Implementations

impl MembershipGate

pub fn new( config: &MembershipConfig, provider: Arc<dyn MembershipProvider>, ) -> Result<Self, ServerError>

Builds the gate from the validated product mapping over provider. No authority is installed: until one is, every protected act refuses MembershipRefusal::AuthorityMissing.

Errors

ServerError::ConfigValidation naming the first invalid member: a contract other than CONTRACT_VERSION, an empty or control-bearing kind, log identity or mapping member, equal workspace and channel kinds, a zero bound, no protected channel, a channel or resource mapped twice, a conversation naming an unlisted channel, or a connect_workspace the mapping does not list.

pub fn install_authority( &self, authority: Arc<dyn MembershipAuthority>, ) -> Result<(), Arc<dyn MembershipAuthority>>

Installs the ACCESS-005 grant authority once.

Errors

Returns the authority back when one is already installed, so one owner cannot be swapped for another under live bindings.

pub fn install_stream_authority(&self) -> Result<Arc<StreamState>, ServerError>

Installs the production stream authority before protected admission.

Errors

Refuses an existing authority of another owner; it is never swapped live.

pub const fn served_log(&self) -> &GrantLog

The grant log this gate asks from.

pub fn protects(&self, channel: &str) -> bool

Whether channel is membership-protected.

pub fn mapped(&self, channel: &str) -> Option<&MappedChannel>

The protected channel’s placement, as the mapping states it.

pub fn channel_for_conversation(&self, conversation: u64) -> Option<&str>

The protected channel a participant conversation is placed under, as the mapping states it; None is unmapped, never guessed.

pub fn counts(&self) -> MembershipCounts

Every count, as of now.

pub fn retained(&self) -> Result<usize, MembershipRefusal>

How many decisions the index retains.

Errors

MembershipRefusal::IndexPoisoned.

pub fn check( &self, pid: u64, holder: Option<&MembershipSubject>, channel: &str, action: MembershipAction, ) -> Result<Decided, MembershipRefusal>

Decides action on channel for connection pid’s verified holder: Decided::NotProtected for a channel the mapping does not list; otherwise the current decision, from the index when it holds one at the authority’s generation, asked of the provider once when it does not. The lock is never held across the ask.

Errors

The exact MembershipRefusal: no verified holder, the authority’s state, the index bound, the provider’s refusal or failure, or an answer that is not the one asked.

pub fn check_release( &self, pid: u64, holder: Option<&MembershipSubject>, channel: &str, action: MembershipAction, ) -> Result<Decided, MembershipRefusal>

Self::check at a final data-release seam (ACCESS-006 R3), counted as a release check.

Errors

As for Self::check.

pub fn admit_connect( &self, holder: &MembershipSubject, ) -> Result<Option<u64>, MembershipRefusal>

Scoped guest admission at Connect (ACCESS-006 R1): when the mapping names a connect_workspace, the holder must hold a current grant somewhere in it. Admission opens no channel; every act after it is decided on its own. Ok(None) when no admission is configured.

Errors

The authority’s state, the provider’s failure, a substituted or stale answer, or Lys’s refusal by name (membership_no_current_grant).

pub fn release_connection(&self, pid: u64)

Releases every binding connection pid held (ACCESS-006 R6); a binding no connection holds leaves the index. A poisoned index is logged and left: it already refuses every check.

impl MembershipGate

pub fn resource_page( &self, holder: Option<&MembershipSubject>, workspace: &str, action: MembershipAction, after: Option<&PageCursor>, ) -> Result<ChannelPage, MembershipRefusal>

One page of the protected channels holder may action within workspace (ACCESS-006 R4): both bounds the operator’s, every row checked against the question, the continuation bound to it.

Errors

The exact MembershipRefusal: no verified holder, an unmapped workspace, the authority’s state, a foreign or stale continuation, the provider’s failure or refusal, or a page that is not the one asked (over bound, foreign or duplicate row, inconsistent counts).

pub fn recipient_page( &self, channel: &str, action: MembershipAction, after: Option<&PageCursor>, ) -> Result<RecipientPage, MembershipRefusal>

One page of the subjects who may action on the protected channel (ACCESS-006 R4), checked as Self::resource_page is.

Errors

As for Self::resource_page, with MembershipRefusal::ChannelNotMapped for an unmapped channel.

Trait Implementations

impl Debug for MembershipGate

fn fmt(&self, formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl MembershipListener for MembershipGate

fn changed( &self, change: &MembershipChange, ) -> Result<AppliedChange, MembershipRefusal>

Re-decides the retained bindings change reaches.

fn resumed( &self, generation: u64, revision: u64, ) -> Result<ResumeReport, MembershipRefusal>

Re-decides every retained binding once at revision and adopts generation when all agree.