RtDataAccessEvaluator
Namespace: Meshmakers.Octo.Runtime.Contracts.DataPermissions
Pure classification of a subject's access to a CK type under a policy table (AB#4972).
Semantics: a type is protected as soon as any considered rule targets it (directly or via a
base type the caller includes in selfAndBaseCkTypeIds); grants are additive; a
full-scope grant beats an owned-only grant; no matching grant on a protected type is denied.
System contexts always classify as RtDataAccessLevel.Open.
public static class RtDataAccessEvaluator
Inheritance Object → RtDataAccessEvaluator
Methods
Classify(RtDataPolicyTable, IReadOnlyCollection<String>, RtDataAction, RtSecurityContext, Boolean)
Classifies access of the given security context to a CK type for one action.
public static RtDataAccessLevel Classify(RtDataPolicyTable table, IReadOnlyCollection<string> selfAndBaseCkTypeIds, RtDataAction action, RtSecurityContext securityContext, bool includeAuditOnlyPolicies)
Parameters
table RtDataPolicyTable
The tenant's policy table
selfAndBaseCkTypeIds IReadOnlyCollection<String>
The full CK type id of the queried type plus all its base type ids (derived types inherit
policies targeting a base/collection-root type)
action RtDataAction
The action to classify
securityContext RtSecurityContext
The caller
includeAuditOnlyPolicies Boolean
False = enforcement view (AuditOnly policies are ignored, their types stay open);
true = audit view (AuditOnly policies count as protecting — used to log would-be violations)