Struct AclKnowledgeStore 

pub struct AclKnowledgeStore { /* private fields */ }

An ACL-aware knowledge store: wraps any inner KnowledgeBase and records document ACLs at ingest so retrieval can be filtered per requester.

Construction does not itself implement KnowledgeBase for reading, because reads must be bound to a requester. Instead:

• ingest_handle returns an Arc<dyn KnowledgeBase> that records ACLs as it ingests (used by the ingestion pipeline);
• reader mints an ACL-filtering Arc<dyn KnowledgeBase> bound to a specific AccessContext (used by the runtime + knowledge_search tool for a turn).

Implementations

impl AclKnowledgeStore

pub fn new(inner: Arc<dyn KnowledgeBase>) -> Self

Wrap an inner knowledge base. The store starts with an empty ACL table; every document ingested through ingest_handle that carries a DocAcl in its metadata is recorded.

pub fn ingest_handle(&self) -> Arc<dyn KnowledgeBase>

An ingest-side handle: a KnowledgeBase whose ingest records the document’s ACL (if any) in the shared side table, then forwards to the inner backend. Its query is the unfiltered inner query (callers that read for a specific requester use reader instead).

pub fn reader(&self, ctx: AccessContext) -> Arc<dyn KnowledgeBase>

A read-side handle bound to ctx: a KnowledgeBase whose query over-fetches from the inner backend and drops every result the requester is not entitled to before truncating to the requested limit.

pub fn record_acl( &self, document_id: impl Into<String>, acl: DocAcl, ) -> Result<()>

Record document_id → acl directly (without ingesting a document) — for callers that store documents through some other path but still want the ACL enforced at read.

Errors

Returns an error if the ACL table lock is poisoned.

Trait Implementations

impl Clone for AclKnowledgeStore

fn clone(&self) -> AclKnowledgeStore

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.