Class AccessControlServer

This is the default server implementation of AccessControlBehavior.

Hierarchy (view full)

Constructors

constructor

Properties

[reference] agent cluster context endpoint env events features internal session state cluster defaults dependencies? early Events ExtensionInterface id Interface name schema? State supervisor supports

Accessors

aclManager aclUpdateDelayed

Methods

[asyncDispose] accessLevelsFor asAdmin assertAttributeEnabled callback extensionEntryAccessCheck extensionEntryValidator initialize reactTo requireAttributeEnabled toString alter enable for set with

Constructors

constructor

Properties

[reference]

[reference]: Datasource<StateType>

agent

agent: Agent

cluster

cluster: never

The implemented cluster.

context

context: ActionContext

endpoint

endpoint: Endpoint<Empty>

env

env: Environment

Readonlyevents

events: EventEmitter & Omit<Events, never> & {
    accessControlEntriesPerFabric$Changing: ClusterEvents.AttributeObservable<FixedAttribute<number, any>>;
    acl$Changing: ClusterEvents.AttributeObservable<WritableFabricScopedAttribute<TypeFromFields<{
        authMode: FieldType<AccessControl.AccessControlEntryAuthMode>;
        fabricIndex: FieldType<FabricIndex>;
        privilege: FieldType<AccessControl.AccessControlEntryPrivilege>;
        subjects: FieldType<null | NodeId[]>;
        targets: FieldType<null | TypeFromFields<(...)>[]>;
    }>[], any>>;
    subjectsPerAccessControlEntry$Changing: ClusterEvents.AttributeObservable<FixedAttribute<number, any>>;
    targetsPerAccessControlEntry$Changing: ClusterEvents.AttributeObservable<FixedAttribute<number, any>>;
} & {
    extension$Changing: undefined | ClusterEvents.AttributeObservable<OptionalWritableFabricScopedAttribute<TypeFromFields<{
        data: FieldType<Uint8Array>;
        fabricIndex: FieldType<FabricIndex>;
    }>[], any>>;
} & {
    accessControlEntriesPerFabric$Changed: ClusterEvents.AttributeObservable<FixedAttribute<number, any>>;
    acl$Changed: ClusterEvents.AttributeObservable<WritableFabricScopedAttribute<TypeFromFields<{
        authMode: FieldType<AccessControl.AccessControlEntryAuthMode>;
        fabricIndex: FieldType<FabricIndex>;
        privilege: FieldType<AccessControl.AccessControlEntryPrivilege>;
        subjects: FieldType<null | NodeId[]>;
        targets: FieldType<null | TypeFromFields<(...)>[]>;
    }>[], any>>;
    subjectsPerAccessControlEntry$Changed: ClusterEvents.AttributeObservable<FixedAttribute<number, any>>;
    targetsPerAccessControlEntry$Changed: ClusterEvents.AttributeObservable<FixedAttribute<number, any>>;
} & {
    extension$Changed: undefined | ClusterEvents.AttributeObservable<OptionalWritableFabricScopedAttribute<TypeFromFields<{
        data: FieldType<Uint8Array>;
        fabricIndex: FieldType<FabricIndex>;
    }>[], any>>;
} & {
    accessControlEntryChanged: ClusterEvents.EventObservable<Event<TypeFromFields<{
        adminNodeId: FieldType<null | NodeId>;
        adminPasscodeId: FieldType<null | number>;
        changeType: FieldType<AccessControl.ChangeType>;
        fabricIndex: FieldType<FabricIndex>;
        latestValue: FieldType<null | TypeFromFields<{
            authMode: FieldType<(...)>;
            fabricIndex: FieldType<(...)>;
            privilege: FieldType<(...)>;
            subjects: FieldType<(...)>;
            targets: FieldType<(...)>;
        }>>;
    }>, any>>;
    accessControlExtensionChanged: ClusterEvents.EventObservable<Event<TypeFromFields<{
        adminNodeId: FieldType<null | NodeId>;
        adminPasscodeId: FieldType<null | number>;
        changeType: FieldType<AccessControl.ChangeType>;
        fabricIndex: FieldType<FabricIndex>;
        latestValue: FieldType<null | TypeFromFields<{
            data: FieldType<(...)>;
            fabricIndex: FieldType<(...)>;
        }>>;
    }>, any>>;
} & {}

Access the behavior's events.

Type declaration

  • ReadonlyaccessControlEntryChanged: ClusterEvents.EventObservable<Event<TypeFromFields<{
        adminNodeId: FieldType<null | NodeId>;
        adminPasscodeId: FieldType<null | number>;
        changeType: FieldType<AccessControl.ChangeType>;
        fabricIndex: FieldType<FabricIndex>;
        latestValue: FieldType<null | TypeFromFields<{
            authMode: FieldType<(...)>;
            fabricIndex: FieldType<(...)>;
            privilege: FieldType<(...)>;
            subjects: FieldType<(...)>;
            targets: FieldType<(...)>;
        }>>;
    }>, any>>

    The cluster shall send AccessControlEntryChanged events whenever its ACL attribute data is changed by an Administrator.

    • Each added entry shall generate an event with ChangeType Added.

    • Each changed entry shall generate an event with ChangeType Changed.

    • Each removed entry shall generate an event with ChangeType Removed.

    See

    MatterSpecification.v13.Core § 9.10.7.1

  • ReadonlyaccessControlExtensionChanged: ClusterEvents.EventObservable<Event<TypeFromFields<{
        adminNodeId: FieldType<null | NodeId>;
        adminPasscodeId: FieldType<null | number>;
        changeType: FieldType<AccessControl.ChangeType>;
        fabricIndex: FieldType<FabricIndex>;
        latestValue: FieldType<null | TypeFromFields<{
            data: FieldType<(...)>;
            fabricIndex: FieldType<(...)>;
        }>>;
    }>, any>>

    The cluster shall send AccessControlExtensionChanged events whenever its extension attribute data is changed by an Administrator.

    • Each added extension shall generate an event with ChangeType Added.

    • Each changed extension shall generate an event with ChangeType Changed.

    • Each removed extension shall generate an event with ChangeType Removed.

    See

    MatterSpecification.v13.Core § 9.10.7.2

features

features: TypeFromBitSchema<{}>

Supported features as a flag object.

internal

internal: Internal

session

session: SecureSession

Readonlystate

state: Omit<{}, never> & {
    acl: TypeFromFields<{
        authMode: FieldType<AccessControl.AccessControlEntryAuthMode>;
        fabricIndex: FieldType<FabricIndex>;
        privilege: FieldType<AccessControl.AccessControlEntryPrivilege>;
        subjects: FieldType<null | NodeId[]>;
        targets: FieldType<null | TypeFromFields<{
            cluster: FieldType<(...)>;
            deviceType: FieldType<(...)>;
            endpoint: FieldType<(...)>;
        }>[]>;
    }>[];
} & {
    extension?: TypeFromFields<{
        data: FieldType<Uint8Array>;
        fabricIndex: FieldType<FabricIndex>;
    }>[];
} & {
    accessControlEntriesPerFabric: number;
    subjectsPerAccessControlEntry: number;
    targetsPerAccessControlEntry: number;
} & {}

Access the behavior's state.

Type declaration

  • Readonlyacl: TypeFromFields<{
        authMode: FieldType<AccessControl.AccessControlEntryAuthMode>;
        fabricIndex: FieldType<FabricIndex>;
        privilege: FieldType<AccessControl.AccessControlEntryPrivilege>;
        subjects: FieldType<null | NodeId[]>;
        targets: FieldType<null | TypeFromFields<{
            cluster: FieldType<(...)>;
            deviceType: FieldType<(...)>;
            endpoint: FieldType<(...)>;
        }>[]>;
    }>[]

    An attempt to add an Access Control Entry when no more entries are available shall result in a RESOURCE_EXHAUSTED error being reported and the ACL attribute shall NOT have the entry added to it. See access control limits.

    See the AccessControlEntriesPerFabric attribute for the actual value of the number of entries per fabric supported by the server.

    Each Access Control Entry codifies a single grant of privilege on this Node, and is used by the Access Control Privilege Granting algorithm to determine if a subject has privilege to interact with targets on the Node.

    See

    MatterSpecification.v13.Core § 9.10.5.3

Type declaration

  • Optional Readonlyextension?: TypeFromFields<{
        data: FieldType<Uint8Array>;
        fabricIndex: FieldType<FabricIndex>;
    }>[]

    If present, the Access Control Extensions may be used by Administrators to store arbitrary data related to fabric’s Access Control Entries.

    The Access Control Extension list shall support a single extension entry per supported fabric.

    See

    MatterSpecification.v13.Core § 9.10.5.4

Type declaration

  • ReadonlyaccessControlEntriesPerFabric: number

    This attribute shall provide the minimum number of ACL Entries per fabric that are supported by this server.

    Since reducing this value over time may invalidate ACL entries already written, this value shall NOT decrease across time as software updates occur that could impact this value. If this is a concern for a given implementation, it is recommended to only use the minimum value required and avoid reporting a higher value than the required minimum.

    See

    MatterSpecification.v13.Core § 9.10.5.7

  • ReadonlysubjectsPerAccessControlEntry: number

    This attribute shall provide the minimum number of Subjects per entry that are supported by this server.

    Since reducing this value over time may invalidate ACL entries already written, this value shall NOT decrease across time as software updates occur that could impact this value. If this is a concern for a given implementation, it is recommended to only use the minimum value required and avoid reporting a higher value than the required minimum.

    See

    MatterSpecification.v13.Core § 9.10.5.5

  • ReadonlytargetsPerAccessControlEntry: number

    This attribute shall provide the minimum number of Targets per entry that are supported by this server.

    Since reducing this value over time may invalidate ACL entries already written, this value shall NOT decrease across time as software updates occur that could impact this value. If this is a concern for a given implementation, it is recommended to only use the minimum value required and avoid reporting a higher value than the required minimum.

    See

    MatterSpecification.v13.Core § 9.10.5.6

Static Readonlycluster

cluster: AccessControl.Cluster

Base cluster state include all attribute values but may be extended by subclasses.

Static Readonlydefaults

defaults: ClusterState.Type<AccessControl.Cluster, typeof ClusterBehavior>

Static Optional Readonlydependencies

dependencies?: Iterable<Type, any, any>

Static Readonlyearly

early: boolean

Static ReadonlyEvents

Events: ClusterEvents.Type<AccessControl.Cluster, typeof ClusterBehavior>

Static ReadonlyExtensionInterface

ExtensionInterface: {}

Static Readonlyid

id

The behavior ID for ClusterBehaviors is the name of the cluster.

Static ReadonlyInterface

Interface: {
    components: never[];
}

Static Readonlyname

name: string

Static Optional Readonlyschema

schema?: Schema

Static ReadonlyState

State: (new () => ClusterState.Type<AccessControl.Cluster, typeof ClusterBehavior>)

Static Readonlysupervisor

supervisor: RootSupervisor

Staticsupports

supports: ((other: Type) => boolean)

Type declaration

    • (other): boolean

    • Does this behavior support functionality of a specific implementation?

      Parameters

      Returns boolean

Accessors

aclManager

aclUpdateDelayed

  • get aclUpdateDelayed(): boolean

  • If set to true, the ACL will not be updated immediately when it changes, but only when the aclUpdateDelayed property is set to false again. This is a hack to prevent the ACL from updating while we are in the middle of a write transaction and will be removed again once we somehow handle relevant sub transactions.

    Returns boolean

  • set aclUpdateDelayed(value): void

  • If set to true, the ACL will not be updated immediately when it changes, but only when the aclUpdateDelayed property is set to false again. This is a hack to prevent the ACL from updating while we are in the middle of a write transaction and will be removed again once we somehow handle relevant sub transactions.

    Parameters

    • value: boolean

    Returns void

Methods

[asyncDispose]

accessLevelsFor

asAdmin

assertAttributeEnabled

Protectedcallback

  • callback<A, R>(reactor, options?): ((...args: A) => undefined | R)

  • Create a generic callback function that has the same properties as a Reactor.

    Like a reactor, the callback's "this" will be bound to an active Behavior instance. Because of this: The reactor MUST be a real JS function - arrow functions will not work!

    Type Parameters

    • A extends any[]
    • R

    Parameters

    Returns ((...args: A) => undefined | R)

      • (...args): undefined | R

      • Parameters

        • Rest...args: A

        Returns undefined | R

ProtectedextensionEntryAccessCheck

ProtectedextensionEntryValidator

  • extensionEntryValidator(extension): void

  • This method allows to implement the validation of manufacturer specific ACL extensions when an extension entry is added or changed. The default implementation checks whether the extension is a valid TLV and possible to decode.

    In case of an Error throws StatusResponseError.

    Override this method in your own behavior to implement custom validation.

    Parameters

    Returns void

initialize

ProtectedreactTo

requireAttributeEnabled

toString

Staticalter

Staticenable

Staticfor

Staticset

Staticwith

Settings

Member Visibility

On This Page

Constructors
Properties
Accessors
Methods