pub fn validate_component_write(
change: &ComponentChange<'_>,
registry: &ComponentRegistry,
) -> Result<(), ComponentPermissionError>Expand description
Validate whether the change’s actor is allowed to perform the proposed
ComponentChange.
Three-layer check:
- Immutability: a component in an immutable range rejects every
delete, and every write once it has a value. An absent
immutable component accepts its first write under its policy: a
scalar
Updateor collectionInserts. A map-elementUpdatecould only rewrite a key the same delta inserted, so it is refused. - Hardcoded: the component registry and the super admin list are super admin only, except that a DM participant may change application-range registry entries.
- Registry lookup: All other components must have an entry in the component registry. No entry = denied (deny by default).