Struct AuthorityContract 

pub struct AuthorityContract {
    pub name: String,
    pub profile: Option<String>,
    pub namespace: Option<String>,
    pub access_profile: RbacProfile,
    pub allow_all_secrets: bool,
    pub allowed_secrets: Vec<String>,
    pub required_secrets: Vec<String>,
    pub allowed_targets: Vec<String>,
    pub trust: AuthorityTrust,
    pub network: AuthorityNetworkPolicy,
}

A validated named authority contract.

Fields

name: String

profile: Option<String>

namespace: Option<String>

access_profile: RbacProfile

allow_all_secrets: bool

allowed_secrets: Vec<String>

required_secrets: Vec<String>

allowed_targets: Vec<String>

trust: AuthorityTrust

network: AuthorityNetworkPolicy

Implementations

impl AuthorityContract

pub fn resolved_exec_policy(&self) -> ResolvedAuthorityPolicy

Resolve the trust posture into a concrete exec policy.

pub fn requires_zero_secrets(&self) -> bool

Return whether this contract requires no secret names.

pub fn injects_zero_secrets(&self) -> bool

Return whether this contract’s secret policy permits no injection.

An omitted allowed_secrets field compiles to allow_all_secrets, so it is not the same as an explicit empty allowlist.

pub fn is_no_secret_diagnostic_contract(&self) -> bool

Return whether this contract has the conservative no-secret diagnostic shape used until the schema grows an explicit diagnostic marker.

pub fn allows_target(&self, command: &str) -> bool

Return whether this contract allows the given execution target.

Targets are matched exactly against the provided string and, when that string is a path, also against the basename. An empty target allowlist means “no target restriction yet”.

pub fn evaluate_target( &self, command: Option<&str>, ) -> AuthorityTargetEvaluation

Evaluate a target command against this contract’s allowlist.

The result is explicit and auditable: higher layers can tell whether a command was allowed by exact match, basename match, lack of restriction, or denied outright.

Trait Implementations

impl Clone for AuthorityContract

fn clone(&self) -> AuthorityContract

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuthorityContract

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for AuthorityContract

impl PartialEq for AuthorityContract

fn eq(&self, other: &AuthorityContract) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for AuthorityContract