Struct CommunityRoles 

pub struct CommunityRoles {
    pub roles: Vec<Role>,
    pub grants: Vec<MemberGrant>,
}

The role graph a client AGGREGATES from the fetched per-entity events (RoleMetadata + per-member Grant). Not an on-wire document — the enforcement engine queries this.

Fields

roles: Vec<Role>

grants: Vec<MemberGrant>

Implementations

impl CommunityRoles

pub fn role(&self, role_id: &str) -> Option<&Role>

Look up a role definition by id.

pub fn roles_of<'a>( &'a self, member_hex: &'a str, ) -> impl Iterator<Item = &'a Role> + 'a

The roles granted to member_hex (resolved through the grant list).

pub fn effective_permissions(&self, member_hex: &str) -> Permissions

Effective permissions for a member = union of their granted roles’ bits.

pub fn has_permission(&self, member_hex: &str, bits: u64) -> bool

True iff the member’s effective permissions include every bit in bits.

pub fn highest_position(&self, member_hex: &str) -> Option<u32>

Highest authority (lowest position index) among the member’s roles; None if they hold no role. The owner (implicit position 0) is handled by the caller.

pub fn is_privileged(&self, member_hex: &str) -> bool

True iff the member holds at least one role (i.e. is privileged below the owner).

pub fn is_admin(&self, member_hex: &str) -> bool

True iff the member holds a role with management permissions — an “admin” (vs. a member who holds only a non-management/social role). Drives the member-list crown.

pub fn is_authorized( &self, actor_hex: &str, owner_hex: Option<&str>, permission: u64, ) -> bool

Is actor_hex authorized for an action requiring permission? The owner (the proven owner npub, if known) is supreme and always authorized; otherwise the actor must hold a role granting permission. This is the grant-set check the inner-author-proof gates on: a demoted member is no longer in the grant set, so their actions stop being honored.

pub fn can_manage_position( &self, actor_hex: &str, owner_hex: Option<&str>, target_position: u32, ) -> bool

escalation defense — may actor_hex manage something sitting at target_position (grant/revoke/edit/reorder a role)? The actor must strictly outrank it (their highest authority is a lower position number) AND hold MANAGE_ROLES. The owner is supreme (implicit position 0, above every role) and always may. Equal cannot act on equal: an admin can never grant/revoke a peer admin at the same position — only someone strictly above can. This is what stops an admin granting the Admin role (pos == pos, refused) while still letting them manage any role beneath them.

pub fn can_manage_member( &self, actor_hex: &str, owner_hex: Option<&str>, target_hex: &str, ) -> bool

May actor_hex act on MEMBER target_hex for a role change (add/remove a role)? Resolves the target’s highest authority and applies the MANAGE_ROLES position rule. The owner is never a valid target (supreme, unremovable — the sole hardcoded exception).

pub fn outranks( &self, actor_hex: &str, owner_hex: Option<&str>, target_position: u32, ) -> bool

The pure position test (no permission bit): does actor_hex strictly outrank target_position? The owner (implicit position 0) outranks everything; a roleless actor outranks nothing. This is the position half of every authority check — callers AND it with the specific permission the action needs (BAN, MANAGE_MESSAGES, MANAGE_ROLES, …).

pub fn can_act_on_position( &self, actor_hex: &str, owner_hex: Option<&str>, target_position: u32, permission: u64, ) -> bool

Generalized authority test: may actor_hex perform an action requiring permission against a target at target_position? Owner is supreme; otherwise the actor must hold permission AND strictly outrank the target. (can_manage_position is this with MANAGE_ROLES; bans pass BAN, moderation-hides pass MANAGE_MESSAGES.)

pub fn can_act_on_member( &self, actor_hex: &str, owner_hex: Option<&str>, target_hex: &str, permission: u64, ) -> bool

Generalized member-targeting authority test (ban / kick / hide / role-change). The owner is never a valid target; a roleless member sits below everyone. The actor needs permission plus a strict outrank of the target’s highest role.

pub fn channel_roles(&self, channel_hex: &str) -> Vec<&Role>

The roles conferring read access to channel_hex, in display order (highest authority first).

A Private Channel with none is readable by nobody but the owner and whoever already holds the key — degenerate rather than “open”, so clients shouldn’t create it, but one arriving that way from elsewhere still reads correctly and its key holders keep reading it.

pub fn channel_role_ids(&self, channel_hex: &str) -> Vec<String>

[channel_roles], by id.

pub fn is_entitled( &self, owner_hex: Option<&str>, member_hex: &str, channel_hex: &str, with: &[String], without: &[String], ) -> bool

Is member_hex entitled to channel_hex’s key? The owner always is (position 0, supreme and unremovable).

with/without overlay a Grant that was JUST published, so a caller can settle key custody against the change it just made rather than against a fold that lags its own publish.

pub fn effective_permissions_in( &self, member_hex: &str, channel_hex: &str, ) -> Permissions

Effective permissions for an action TARGETING one channel: server-scope roles plus roles scoped to that channel.

⚠️ Offer-side only. The fold stays scope-agnostic in every implementation (CORD-04 §3, and [effective_permissions] is what judges inbound authority) — this narrows only what THIS client offers its own user, never what it honors from others. Tightening the honor path would retroactively invalidate actions shipped clients already folded.

pub fn is_authorized_in( &self, actor_hex: &str, owner_hex: Option<&str>, channel_hex: &str, permission: u64, ) -> bool

is_authorized, judged against one channel per effective_permissions_in. Offer-side only.

Trait Implementations

impl Clone for CommunityRoles

fn clone(&self) -> CommunityRoles

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CommunityRoles

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for CommunityRoles

fn default() -> CommunityRoles

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for CommunityRoles

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for CommunityRoles

impl PartialEq for CommunityRoles

fn eq(&self, other: &CommunityRoles) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for CommunityRoles

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for CommunityRoles