Authorization.h header

#include <ew/core/Authorization.h>

Namespace ew::core

ObjectPolicy struct

struct ew::core::ObjectPolicy

What the gate needs to know about the object being acted on.

The object's POLICY-RELEVANT FACTS rather than the object itself, so libs/core can answer without depending on the content types, and so a caller cannot accidentally ask about one object while passing another's state. A default-constructed value describes an object with no restrictions at all, which is what most objects are.

Members

bool ew::core::policy::ObjectPolicy::aiExcluded = false

Whether the object is withheld from AI features (ContentObject::aiExcluded).

bool ew::core::policy::ObjectPolicy::locked = false

Whether the object is locked against changes.

std::set<QString> ew::core::policy::ObjectPolicy::visibleAudiences

The audiences the object is visible to. EMPTY MEANS VISIBLE TO EVERYONE – an object with no audience restriction is unrestricted, not hidden. Getting this backwards would hide the entire project from every reader.

Enumerations

enum class Action { Read, Write }

What is being attempted.

Two, because the product's existing checks distinguish exactly two: a lock refuses writes while leaving reads alone, and audience visibility hides content from readers. A finer verb set would be inventing policy nobody enforces.

enum class Decision { Allow, DenyLocked, DenyAiExcluded, DenyNotInAudience }

Why a request was refused, or that it was allowed.

A reason rather than a bare bool because the caller must be able to say something true to the user, and because the three refusals are not interchangeable: "locked" invites unlocking, "excluded from AI" is a deliberate privacy choice, and an audience refusal is a preview of what someone else would see.

Functions

std::optional< Action > ew::core::policy::actionFromToken(QStringView token)

Parses an action from its token; std::nullopt if unrecognized.

Decision ew::core::policy::authorize(const Principal &principal, Action action, const ObjectPolicy &policy)

Decides whether principal may perform action on an object described by policy.

THE ONE GATE. Every read and write is meant to pass through here, so that the product has one answer to "may this actor touch this thing?" instead of the scattered checks it grew.

It deliberately encodes NO NEW POLICY. Its rules are exactly the three the product already enforced in 139 separate places before this existed – object locks, AI exclusion, and audience visibility. That is what makes "zero behaviour change" a specification rather than a hope: this function is correct precisely when it agrees with what those places already did.

A LocalUser is allowed everything except a locked write, which is why the gate is a true no-op for the ordinary desktop session and costs nothing to route through.

std::optional< Decision > ew::core::policy::decisionFromToken(QStringView token)

Parses a decision from its token; std::nullopt if unrecognized.

bool ew::core::policy::isAllowed(Decision decision)

Whether decision permits the request.

QString ew::core::policy::refusalMessage(Decision decision, const QString &objectName)

The user-facing sentence for decision about an object called objectName. Empty when the decision allows – there is nothing to say about a request that succeeded.

Not tr()'d here: libs/core carries no UI. Callers that show this to a person translate at their own layer, as they already do for every other core-produced string.

QString ew::core::policy::toToken(Action action)

Returns the stable serialization token for action ("read" / "write").

QString ew::core::policy::toToken(Decision decision)

Returns the stable serialization token for decision.