Struct WriteAuthz 

pub struct WriteAuthz {
    pub role: String,
    pub scope: WriteScope,
    pub mask: NodeMask,
}

Authorization context carried by write_batch_authz / query_write_authz.

None at the call site = full authority (today’s zero-cost behavior). Some(WriteAuthz) = role-scoped: the decision table (plan §“authz decision table”) is evaluated per-op inside commit_logged_batch BEFORE any WAL record is built. A denial returns an error with no WAL frame written.

The mask is ALWAYS Omit-mode: role-token paths must never acknowledge hidden-node existence to callers.

Fields

role: String

scope: WriteScope

mask: NodeMask

Resolved by mask_for_role under the same write guard as the mutation. Always Omit-mode — never Stub.

Trait Implementations

impl Clone for WriteAuthz

fn clone(&self) -> WriteAuthz

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for WriteAuthz

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.