Struct AccessView 

pub struct AccessView { /* private fields */ }

An immutable per-request snapshot of one principal’s access.

Holds the config Arc taken at request start so a single request evaluates against one consistent config, plus a handle to the shared attribute cache for label/role lookups by identity.

Implementations

impl AccessView

pub fn enforced(&self) -> bool

True when this view actually enforces anything.

pub fn subject(&self) -> Option<&str>

pub fn groups(&self) -> &BTreeSet<String>

pub fn is_admin(&self) -> bool

pub fn decide( &self, action: &str, resource: &AccessResource<'_>, ) -> AccessDecision

Full check against explicit resource attributes.

pub fn allows(&self, action: &str) -> bool

Check an action with no resource (e.g. gating.decide).

pub fn may_perform_anywhere(&self, action: &str) -> bool

Coarse capability check: could this principal perform action against at least one resource? Used to intersect capability advertisements (mobkit/capabilities) so the console doesn’t surface affordances the caller can never use; per-resource enforcement still applies per call.

pub fn allows_agent(&self, action: &str, identity: &str) -> bool

Check an action against an agent identity, resolving cached attributes (role/labels) when available.

pub fn decide_agent(&self, action: &str, identity: &str) -> AccessDecision

Full decision for an action against an agent identity, resolving cached attributes (role/labels) when available. The argument may also be a runtime agent/member id; the cache resolves it back to the identity it belongs to.

Agents carry their spawn lineage as a spawned_by label (recorded by the agent-tool spawn path). A spawned member inherits its spawning parent’s permissions: rules that match the parent — or any ancestor — also match the member, with deny-overrides preserved across the chain.

pub fn can_view_agent(&self, identity: &str) -> bool

Convenience: can this principal see the given agent at all?

pub fn knows_agent(&self, identity: &str) -> bool

True when the agent’s resource attributes (role/labels) are present in the shared attribute cache, keyed by identity or projected agent_id.

A cache-MISS means decide_agent falls back to a bare-identity resource with role: None, labels: None, so a label/role-scoped deny rule fails the rule closed and DOES NOT match — i.e. the agent is not actually hidden. Long-lived SSE streams use this to detect a member spawned after the one-time subscribe prime and re-prime the cache before deciding, so the deny resolves against real attributes instead of failing open.

pub fn can_administer(&self) -> bool

Can this principal read and edit the access configuration?

Admins always can. While enforcement is enabled, subjects granted access.admin by rule also can. While the feature is disabled and no admins are configured yet, any caller can — this is the bootstrap path that lets a fresh deployment configure itself from the console before flipping enforcement on (enabling requires naming admins).

Trait Implementations

impl Clone for AccessView

fn clone(&self) -> AccessView

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AccessView

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.