Struct PermissionGate 

pub struct PermissionGate { /* private fields */ }

Application-layer access-control gate for Lore workspace paths.

Usage

let gate = PermissionGate::load(workspace_path).await?;
gate.check_read("/context/secret.md", "alice")?;     // Err if denied
gate.check_write("/entities/characters/bob.yaml", "alice")?; // Err if denied

Thread safety

PermissionGate is immutable after construction and safe to share across threads (immutable &self check methods).

Implementations

impl PermissionGate

pub fn load(workspace_root: &Path) -> Result<Self, NapError>

Load the permission gate from context/nap-gate.toml inside the workspace. If the file does not exist, returns a permissive gate (default: write access for all principals). Use PermissionGate::strict to enforce a closed-by-default gate when no config is present.

pub fn strict(workspace_root: &Path) -> Self

Create a strict gate that denies everything by default, even when no config file is present. Useful for agents or untrusted contexts.

pub fn permissive(workspace_root: &Path) -> Self

Create a fully permissive gate (any principal may read/write any path). Useful for local development or trusted automation.

pub fn from_permissions( workspace_root: &Path, permissions: &[Permission], default: AccessLevel, ) -> Self

Build a gate from an explicit list of Permission entries.

pub fn check_read(&self, path: &str, principal: &str) -> Result<(), NapError>

Check whether principal may read path.

pub fn check_write(&self, path: &str, principal: &str) -> Result<(), NapError>

Check whether principal may write path.

Trait Implementations

impl Debug for PermissionGate

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.