Interface Cluster

The Access Control Cluster exposes a data model view of a Node’s Access Control List (ACL), which codifies the rules used to manage and enforce Access Control for the Node’s endpoints and their associated cluster instances. Access to this Access Control Cluster itself requires a special Administer privilege level, such that only Nodes granted such privilege (hereafter termed "Administrators") can manage the Access Control Cluster.

The Access Control Cluster shall be present on the root node endpoint of each Node, and shall NOT be present on any other Endpoint of any Node.

See

MatterSpecification.v13.Core § 9.10

interface Cluster {
    attributes: Merge<{
        accessControlEntriesPerFabric: FixedAttribute<number, any>;
        acl: WritableFabricScopedAttribute<TypeFromFields<{
            authMode: FieldType<AccessControl.AccessControlEntryAuthMode>;
            fabricIndex: FieldType<FabricIndex>;
            privilege: FieldType<AccessControl.AccessControlEntryPrivilege>;
            subjects: FieldType<null | NodeId[]>;
            targets: FieldType<null | TypeFromFields<{
                cluster: ...;
                deviceType: ...;
                endpoint: ...;
            }>[]>;
        }>[], any>;
        extension: OptionalWritableFabricScopedAttribute<TypeFromFields<{
            data: FieldType<Uint8Array>;
            fabricIndex: FieldType<FabricIndex>;
        }>[], any>;
        subjectsPerAccessControlEntry: FixedAttribute<number, any>;
        targetsPerAccessControlEntry: FixedAttribute<number, any>;
    }, GlobalAttributes<{}>>;
    base: undefined;
    commands: {};
    events: {
        accessControlEntryChanged: Event<TypeFromFields<{
            adminNodeId: FieldType<null | NodeId>;
            adminPasscodeId: FieldType<null | number>;
            changeType: FieldType<AccessControl.ChangeType>;
            fabricIndex: FieldType<FabricIndex>;
            latestValue: FieldType<null | TypeFromFields<{
                authMode: FieldType<AccessControl.AccessControlEntryAuthMode>;
                fabricIndex: FieldType<FabricIndex>;
                privilege: FieldType<AccessControl.AccessControlEntryPrivilege>;
                subjects: FieldType<null | (...)[]>;
                targets: FieldType<null | (...)[]>;
            }>>;
        }>, any>;
        accessControlExtensionChanged: Event<TypeFromFields<{
            adminNodeId: FieldType<null | NodeId>;
            adminPasscodeId: FieldType<null | number>;
            changeType: FieldType<AccessControl.ChangeType>;
            fabricIndex: FieldType<FabricIndex>;
            latestValue: FieldType<null | TypeFromFields<{
                data: FieldType<Uint8Array>;
                fabricIndex: FieldType<FabricIndex>;
            }>>;
        }>, any>;
    };
    extensions: undefined;
    features: {};
    id: Branded<31, "ClusterId">;
    name: "AccessControl";
    revision: 1;
    supportedFeatures: {};
    unknown: false;
    alter<const AlterationsT>(alterations: AlterationsT): WithAlterations<Of<{
        attributes: {
            accessControlEntriesPerFabric: FixedAttribute<number, any>;
            acl: WritableFabricScopedAttribute<TypeFromFields<{
                authMode: FieldType<AccessControl.AccessControlEntryAuthMode>;
                fabricIndex: FieldType<FabricIndex>;
                privilege: FieldType<AccessControl.AccessControlEntryPrivilege>;
                subjects: FieldType<null | (...)[]>;
                targets: FieldType<null | (...)[]>;
            }>[], any>;
            extension: OptionalWritableFabricScopedAttribute<TypeFromFields<{
                data: FieldType<Uint8Array>;
                fabricIndex: FieldType<FabricIndex>;
            }>[], any>;
            subjectsPerAccessControlEntry: FixedAttribute<number, any>;
            targetsPerAccessControlEntry: FixedAttribute<number, any>;
        };
        events: {
            accessControlEntryChanged: Event<TypeFromFields<{
                adminNodeId: FieldType<null | NodeId>;
                adminPasscodeId: FieldType<null | number>;
                changeType: FieldType<AccessControl.ChangeType>;
                fabricIndex: FieldType<FabricIndex>;
                latestValue: FieldType<null | TypeFromFields<{
                    authMode: ...;
                    fabricIndex: ...;
                    privilege: ...;
                    subjects: ...;
                    targets: ...;
                }>>;
            }>, any>;
            accessControlExtensionChanged: Event<TypeFromFields<{
                adminNodeId: FieldType<null | NodeId>;
                adminPasscodeId: FieldType<null | number>;
                changeType: FieldType<AccessControl.ChangeType>;
                fabricIndex: FieldType<FabricIndex>;
                latestValue: FieldType<null | TypeFromFields<{
                    data: ...;
                    fabricIndex: ...;
                }>>;
            }>, any>;
        };
        id: 31;
        name: "AccessControl";
        revision: 1;
    }>, AlterationsT>;
    enable<const FlagsT>(flags: FlagsT): WithFlags<Of<{
        attributes: {
            accessControlEntriesPerFabric: FixedAttribute<number, any>;
            acl: WritableFabricScopedAttribute<TypeFromFields<{
                authMode: FieldType<AccessControl.AccessControlEntryAuthMode>;
                fabricIndex: FieldType<FabricIndex>;
                privilege: FieldType<AccessControl.AccessControlEntryPrivilege>;
                subjects: FieldType<null | (...)[]>;
                targets: FieldType<null | (...)[]>;
            }>[], any>;
            extension: OptionalWritableFabricScopedAttribute<TypeFromFields<{
                data: FieldType<Uint8Array>;
                fabricIndex: FieldType<FabricIndex>;
            }>[], any>;
            subjectsPerAccessControlEntry: FixedAttribute<number, any>;
            targetsPerAccessControlEntry: FixedAttribute<number, any>;
        };
        events: {
            accessControlEntryChanged: Event<TypeFromFields<{
                adminNodeId: FieldType<null | NodeId>;
                adminPasscodeId: FieldType<null | number>;
                changeType: FieldType<AccessControl.ChangeType>;
                fabricIndex: FieldType<FabricIndex>;
                latestValue: FieldType<null | TypeFromFields<{
                    authMode: ...;
                    fabricIndex: ...;
                    privilege: ...;
                    subjects: ...;
                    targets: ...;
                }>>;
            }>, any>;
            accessControlExtensionChanged: Event<TypeFromFields<{
                adminNodeId: FieldType<null | NodeId>;
                adminPasscodeId: FieldType<null | number>;
                changeType: FieldType<AccessControl.ChangeType>;
                fabricIndex: FieldType<FabricIndex>;
                latestValue: FieldType<null | TypeFromFields<{
                    data: ...;
                    fabricIndex: ...;
                }>>;
            }>, any>;
        };
        id: 31;
        name: "AccessControl";
        revision: 1;
    }>, FlagsT>;
    set<const ValuesT>(values: ValuesT): WithValues<Of<{
        attributes: {
            accessControlEntriesPerFabric: FixedAttribute<number, any>;
            acl: WritableFabricScopedAttribute<TypeFromFields<{
                authMode: FieldType<AccessControl.AccessControlEntryAuthMode>;
                fabricIndex: FieldType<FabricIndex>;
                privilege: FieldType<AccessControl.AccessControlEntryPrivilege>;
                subjects: FieldType<null | (...)[]>;
                targets: FieldType<null | (...)[]>;
            }>[], any>;
            extension: OptionalWritableFabricScopedAttribute<TypeFromFields<{
                data: FieldType<Uint8Array>;
                fabricIndex: FieldType<FabricIndex>;
            }>[], any>;
            subjectsPerAccessControlEntry: FixedAttribute<number, any>;
            targetsPerAccessControlEntry: FixedAttribute<number, any>;
        };
        events: {
            accessControlEntryChanged: Event<TypeFromFields<{
                adminNodeId: FieldType<null | NodeId>;
                adminPasscodeId: FieldType<null | number>;
                changeType: FieldType<AccessControl.ChangeType>;
                fabricIndex: FieldType<FabricIndex>;
                latestValue: FieldType<null | TypeFromFields<{
                    authMode: ...;
                    fabricIndex: ...;
                    privilege: ...;
                    subjects: ...;
                    targets: ...;
                }>>;
            }>, any>;
            accessControlExtensionChanged: Event<TypeFromFields<{
                adminNodeId: FieldType<null | NodeId>;
                adminPasscodeId: FieldType<null | number>;
                changeType: FieldType<AccessControl.ChangeType>;
                fabricIndex: FieldType<FabricIndex>;
                latestValue: FieldType<null | TypeFromFields<{
                    data: ...;
                    fabricIndex: ...;
                }>>;
            }>, any>;
        };
        id: 31;
        name: "AccessControl";
        revision: 1;
    }>, ValuesT>;
    with<const SelectionT>(...selection: SelectionT): Of<Of<{
        attributes: {
            accessControlEntriesPerFabric: FixedAttribute<number, any>;
            acl: WritableFabricScopedAttribute<TypeFromFields<{
                authMode: FieldType<AccessControl.AccessControlEntryAuthMode>;
                fabricIndex: FieldType<FabricIndex>;
                privilege: FieldType<AccessControl.AccessControlEntryPrivilege>;
                subjects: FieldType<null | (...)[]>;
                targets: FieldType<null | (...)[]>;
            }>[], any>;
            extension: OptionalWritableFabricScopedAttribute<TypeFromFields<{
                data: FieldType<Uint8Array>;
                fabricIndex: FieldType<FabricIndex>;
            }>[], any>;
            subjectsPerAccessControlEntry: FixedAttribute<number, any>;
            targetsPerAccessControlEntry: FixedAttribute<number, any>;
        };
        events: {
            accessControlEntryChanged: Event<TypeFromFields<{
                adminNodeId: FieldType<null | NodeId>;
                adminPasscodeId: FieldType<null | number>;
                changeType: FieldType<AccessControl.ChangeType>;
                fabricIndex: FieldType<FabricIndex>;
                latestValue: FieldType<null | TypeFromFields<{
                    authMode: ...;
                    fabricIndex: ...;
                    privilege: ...;
                    subjects: ...;
                    targets: ...;
                }>>;
            }>, any>;
            accessControlExtensionChanged: Event<TypeFromFields<{
                adminNodeId: FieldType<null | NodeId>;
                adminPasscodeId: FieldType<null | number>;
                changeType: FieldType<AccessControl.ChangeType>;
                fabricIndex: FieldType<FabricIndex>;
                latestValue: FieldType<null | TypeFromFields<{
                    data: ...;
                    fabricIndex: ...;
                }>>;
            }>, any>;
        };
        id: 31;
        name: "AccessControl";
        revision: 1;
    }>, SelectionT>;
}

Hierarchy (view full)

Properties

attributes base commands events extensions features id name revision supportedFeatures unknown

Methods

alter enable set with

Properties

attributes

attributes: Merge<{
    accessControlEntriesPerFabric: FixedAttribute<number, any>;
    acl: WritableFabricScopedAttribute<TypeFromFields<{
        authMode: FieldType<AccessControl.AccessControlEntryAuthMode>;
        fabricIndex: FieldType<FabricIndex>;
        privilege: FieldType<AccessControl.AccessControlEntryPrivilege>;
        subjects: FieldType<null | NodeId[]>;
        targets: FieldType<null | TypeFromFields<{
            cluster: ...;
            deviceType: ...;
            endpoint: ...;
        }>[]>;
    }>[], any>;
    extension: OptionalWritableFabricScopedAttribute<TypeFromFields<{
        data: FieldType<Uint8Array>;
        fabricIndex: FieldType<FabricIndex>;
    }>[], any>;
    subjectsPerAccessControlEntry: FixedAttribute<number, any>;
    targetsPerAccessControlEntry: FixedAttribute<number, any>;
}, GlobalAttributes<{}>>

Type declaration

  • ReadonlyaccessControlEntriesPerFabric: FixedAttribute<number, any>

    This attribute shall provide the minimum number of ACL Entries per fabric that are supported by this server.

    Since reducing this value over time may invalidate ACL entries already written, this value shall NOT decrease across time as software updates occur that could impact this value. If this is a concern for a given implementation, it is recommended to only use the minimum value required and avoid reporting a higher value than the required minimum.

    See

    MatterSpecification.v13.Core § 9.10.5.7

  • Readonlyacl: WritableFabricScopedAttribute<TypeFromFields<{
        authMode: FieldType<AccessControl.AccessControlEntryAuthMode>;
        fabricIndex: FieldType<FabricIndex>;
        privilege: FieldType<AccessControl.AccessControlEntryPrivilege>;
        subjects: FieldType<null | NodeId[]>;
        targets: FieldType<null | TypeFromFields<{
            cluster: ...;
            deviceType: ...;
            endpoint: ...;
        }>[]>;
    }>[], any>

    An attempt to add an Access Control Entry when no more entries are available shall result in a RESOURCE_EXHAUSTED error being reported and the ACL attribute shall NOT have the entry added to it. See access control limits.

    See the AccessControlEntriesPerFabric attribute for the actual value of the number of entries per fabric supported by the server.

    Each Access Control Entry codifies a single grant of privilege on this Node, and is used by the Access Control Privilege Granting algorithm to determine if a subject has privilege to interact with targets on the Node.

    See

    MatterSpecification.v13.Core § 9.10.5.3

  • Readonlyextension: OptionalWritableFabricScopedAttribute<TypeFromFields<{
        data: FieldType<Uint8Array>;
        fabricIndex: FieldType<FabricIndex>;
    }>[], any>

    If present, the Access Control Extensions may be used by Administrators to store arbitrary data related to fabric’s Access Control Entries.

    The Access Control Extension list shall support a single extension entry per supported fabric.

    See

    MatterSpecification.v13.Core § 9.10.5.4

  • ReadonlysubjectsPerAccessControlEntry: FixedAttribute<number, any>

    This attribute shall provide the minimum number of Subjects per entry that are supported by this server.

    Since reducing this value over time may invalidate ACL entries already written, this value shall NOT decrease across time as software updates occur that could impact this value. If this is a concern for a given implementation, it is recommended to only use the minimum value required and avoid reporting a higher value than the required minimum.

    See

    MatterSpecification.v13.Core § 9.10.5.5

  • ReadonlytargetsPerAccessControlEntry: FixedAttribute<number, any>

    This attribute shall provide the minimum number of Targets per entry that are supported by this server.

    Since reducing this value over time may invalidate ACL entries already written, this value shall NOT decrease across time as software updates occur that could impact this value. If this is a concern for a given implementation, it is recommended to only use the minimum value required and avoid reporting a higher value than the required minimum.

    See

    MatterSpecification.v13.Core § 9.10.5.6

base

base: undefined

commands

commands: {}

events

events: {
    accessControlEntryChanged: Event<TypeFromFields<{
        adminNodeId: FieldType<null | NodeId>;
        adminPasscodeId: FieldType<null | number>;
        changeType: FieldType<AccessControl.ChangeType>;
        fabricIndex: FieldType<FabricIndex>;
        latestValue: FieldType<null | TypeFromFields<{
            authMode: FieldType<AccessControl.AccessControlEntryAuthMode>;
            fabricIndex: FieldType<FabricIndex>;
            privilege: FieldType<AccessControl.AccessControlEntryPrivilege>;
            subjects: FieldType<null | (...)[]>;
            targets: FieldType<null | (...)[]>;
        }>>;
    }>, any>;
    accessControlExtensionChanged: Event<TypeFromFields<{
        adminNodeId: FieldType<null | NodeId>;
        adminPasscodeId: FieldType<null | number>;
        changeType: FieldType<AccessControl.ChangeType>;
        fabricIndex: FieldType<FabricIndex>;
        latestValue: FieldType<null | TypeFromFields<{
            data: FieldType<Uint8Array>;
            fabricIndex: FieldType<FabricIndex>;
        }>>;
    }>, any>;
}

Type declaration

extensions

extensions: undefined

features

features: {}

id

id: Branded<31, "ClusterId">

name

name

revision

revision

supportedFeatures

supportedFeatures: {}

unknown

unknown

Methods

alter

enable

set

with

Settings

Member Visibility

On This Page

Properties
Methods