Struct Ctx 

pub struct Ctx<'a, S: StorageAdapter> {
    pub storage: &'a S,
    pub snapshot: &'a SchemaSnapshot,
    pub scope: &'a AclScope,
    pub options: &'a PermissionOptions,
    pub is_maintenance: bool,
}

Everything one request carries into every stage.

The snapshot is taken once and threaded down, so a batch cannot evaluate half its work under one schema and half under another.

Fields

storage: &'a S

snapshot: &'a SchemaSnapshot

scope: &'a AclScope

options: &'a PermissionOptions

is_maintenance: bool

Whether this request authenticated with the maintenance key rather than the master key.

AclScope::Unrestricted covers both, because they apply the same ACL treatment: none. But they are not the same authority, and at least one decision reads them differently. validateClientClassCreation exempts master and maintenance on a write (RestWrite.js:200-202) and only master on a read (RestQuery.js:486-489), so the read path needs to tell them apart and the scope cannot.

A separate flag rather than an AclScope variant, deliberately and narrowly: a variant would force a master-versus-maintenance judgment at all twenty-five Unrestricted sites, and only this one is known to differ. The general conflation is recorded in the deliberate differences in CHANGELOG.md; this closes the case that is known to be wrong rather than pretending to close the rest.

Implementations

impl<'a, S: StorageAdapter> Ctx<'a, S>

pub fn new( storage: &'a S, snapshot: &'a SchemaSnapshot, scope: &'a AclScope, options: &'a PermissionOptions, ) -> Self

pub fn maintenance(self, yes: bool) -> Self

Mark the request as maintenance-key authenticated.

Defaults to false so the forty-odd Ctx::new call sites, nearly all of them tests, keep their signature: a test that does not care about the distinction cannot get it wrong.