Module data_tagging 

Builtin DataTagging plugin (OMG DDS-Security 1.2 §12).

Implements the zerodds_security::DataTaggingPlugin SPI as a production builtin. Tags are application-level labels (classification markers, sensitivity, etc.) that are managed per endpoint GUID, propagated over SEDP via PID_PROPERTY_LIST, and checked for a match on the subscriber side.

Wire path

Tags are embedded as WireProperty entries with the namespace prefix dds.sec.data_tags. into the existing WirePropertyList — i.e. we reuse the PID_PROPERTY_LIST parameter already propagated in SPDP/SEDP, instead of introducing a new PID. This matches the Cyclone/RTI behavior, which also carries tags via PID_PROPERTY_LIST (Cyclone DDS Security §8 doc).

Match predicate

The default predicate is a subset match:

• subscriber without tags → accepts any publisher (wildcard).
• subscriber with tags → every tag (name+value) must appear exactly in the publisher tag set.
• an unknown tag name on the subscriber side that does not exist at the publisher → reject.

Spec-conform and simple enough for NGVA/FACE pilot setups; complex predicates (range/regex) are covered via a custom DataTaggingPlugin.

Example

use zerodds_security::data_tagging::{DataTag, DataTaggingPlugin};
use zerodds_security_runtime::data_tagging::BuiltinDataTaggingPlugin;

let mut plugin = BuiltinDataTaggingPlugin::new();
let pub_guid = [0xAA; 16];
plugin.set_tags(
    pub_guid,
    vec![DataTag { name: "classification".into(), value: "secret".into() }],
);

let sub_tags = vec![DataTag { name: "classification".into(), value: "secret".into() }];
assert!(BuiltinDataTaggingPlugin::tags_match(&plugin.get_tags(pub_guid), &sub_tags));

zerodds-lint: allow no_dyn_in_safe (plugin trait object via Box<dyn DataTaggingPlugin>.)

Structs

BuiltinDataTaggingPlugin

Builtin DataTagging plugin for spec §12.

Constants

TAG_PROPERTY_PREFIX

Property namespace for tag wire encoding. Each tag appears as a WireProperty with name = TAG_PROPERTY_PREFIX + tag.name, value = tag.value. Other properties (auth-class, suite-list, …) stay untouched.