pub struct RevocationAuthority { /* private fields */ }Expand description
One grant log’s revocation consumer, decision cache and admission fence (ACCESS-005 R1-R4, R6, R7).
Implementations§
Source§impl RevocationAuthority
impl RevocationAuthority
Sourcepub fn new(
policy: RevocationPolicy,
bindings: Arc<dyn GrantBindingSource>,
decisions: Arc<dyn GrantDecisionSource>,
) -> Self
pub fn new( policy: RevocationPolicy, bindings: Arc<dyn GrantBindingSource>, decisions: Arc<dyn GrantDecisionSource>, ) -> Self
A consumer for policy’s log, NotReady until its stream’s baseline
and Ready arrive, with the producer and decision seams given.
Sourcepub fn unpublished(policy: RevocationPolicy) -> Self
pub fn unpublished(policy: RevocationPolicy) -> Self
The authority with the seams Lys publishes today: neither, so every admission is refused by name.
Sourcepub fn stage(
&self,
credential: &[u8],
holder: &[u8],
) -> Result<StagedAdmission, RevocationRefusal>
pub fn stage( &self, credential: &[u8], holder: &[u8], ) -> Result<StagedAdmission, RevocationRefusal>
Verifies credential’s binding for holder and acquires any decision
the cache lacks, outside the guard. Nothing is admitted yet.
§Errors
The refusal by name: the binding is missing or does not match, the stream is not ready, the log was reset, or the required revision or a needed decision is unavailable.
Sourcepub fn commit(
&self,
pid: u64,
staged: StagedAdmission,
) -> Result<ConnectionGrants, RevocationRefusal>
pub fn commit( &self, pid: u64, staged: StagedAdmission, ) -> Result<ConnectionGrants, RevocationRefusal>
The fence (ACCESS-005 R3): readiness, log identity, the required
revision and the admitting right, checked and bound into the reverse
index in one ordered transition with change application. A revocation
applied between Self::stage and this call wins.
§Errors
The refusal by name; nothing is bound on any refusal.
Sourcepub fn admit(
&self,
pid: u64,
credential: &[u8],
holder: &[u8],
) -> Result<ConnectionGrants, RevocationRefusal>
pub fn admit( &self, pid: u64, credential: &[u8], holder: &[u8], ) -> Result<ConnectionGrants, RevocationRefusal>
Sourcepub fn apply(&self, event: &GrantFeedEvent) -> ApplyOutcome
pub fn apply(&self, event: &GrantFeedEvent) -> ApplyOutcome
Applies one stream event in order (ACCESS-005 R2, R4). Announcements are logged after the guard is released.
Sourcepub fn release(&self, pid: u64) -> bool
pub fn release(&self, pid: u64) -> bool
Releases connection pid from the reverse index, once, from the
connection runtime’s removal funnel (ACCESS-005 R6). Returns whether a
binding was released; a second call releases nothing.
Sourcepub fn record_close_publication_refused(&self, pid: u64)
pub fn record_close_publication_refused(&self, pid: u64)
Records that the close control for pid could not be published. The
denied state already gates the connection; its own wake delivers the
close.
Sourcepub fn record_close_write(&self, pid: u64, write: CloseWrite)
pub fn record_close_write(&self, pid: u64, write: CloseWrite)
Records how connection pid’s reason-bearing close write ended.
Attempted is not delivered.
Sourcepub fn prune_unreferenced(&self)
pub fn prune_unreferenced(&self)
Drops every decision no binding and no in-flight ask needs. A later need is a miss, answered by a cold ask, never an implicit allow.
Sourcepub fn diagnostics(&self) -> Result<RevocationDiagnostics, AuthorityPoisoned>
pub fn diagnostics(&self) -> Result<RevocationDiagnostics, AuthorityPoisoned>
A bounded snapshot for diagnostics (ACCESS-005 R7).
§Errors
AuthorityPoisoned when a holder of the authority’s lock panicked:
the state is untrusted and no snapshot of it is answered.