انتقل إلى المحتوى الرئيسي

Interface: AccessDenial

Defined in: packages/messaging/src/ports.ts:60

What the access.deny audit record is built from: identifiers only, never a body and never a header value other than ids (chapter 28, section 8).

Properties​

actor​

readonly actor: { kind: "tenant"; roles: string[]; scopePath: string; subjectId: string; tenant: string; } | { kind: "platform"; roles: string[]; scopePath: "/"; subjectId: "00000000-0000-0000-0000-000000000000"; tenant: "platform"; } | undefined

Defined in: packages/messaging/src/ports.ts:78

The envelope's actor, when the envelope decoded: as the sender claimed it, never verified. On actor_token_invalid and actor_unverified the refusal is precisely that the claim could not be trusted, so whoever sent the message chose this value.

adapter​

readonly adapter: Adapter

Defined in: packages/messaging/src/ports.ts:64

Which path the message came by, so the record says where the refusal happened.

at​

readonly at: Date

Defined in: packages/messaging/src/ports.ts:84

When the receiver refused.

caller​

readonly caller: Participant | undefined

Defined in: packages/messaging/src/ports.ts:72

The caller, when known: always on the in-process path, never on the broker path.

correlationId​

readonly correlationId: string | undefined

Defined in: packages/messaging/src/ports.ts:82

The correlation id, when it decoded.

key​

readonly key: "request.platform.identity.principal.resolve.v1" | "request.platform.identity.me.get.v1" | "request.*.identity.subject.create.v1" | "request.*.identity.subject.get.v1" | "request.platform.identity.bootstrap.apply.v1" | "request.*.identity.person.create.v1" | "request.*.identity.person.get.v1" | "request.*.identity.person.invite.v1" | "request.*.identity.grant.create.v1" | "request.*.identity.grant.revoke.v1" | "request.*.identity.grant.list.v1" | "event.*.identity.grant.revoked.v1" | "event.*.*.audit.recorded.v1" | "event.platform.gateway.audit.recorded.v1" | "event.platform.gateway-admin.audit.recorded.v1" | "event.platform.bootstrap.audit.recorded.v1" | "request.*.governance.accreditation.apply.v1" | "request.*.governance.accreditation.admit.v1" | "request.*.governance.accreditation.publish.v1" | "request.*.governance.accreditation.get.v1" | "request.*.governance.accreditation.list.v1" | "request.platform.governance.anchor.converge.v1" | "event.*.governance.accreditation.admitted.v1" | "event.*.governance.accreditation.publication-approved.v1" | "request.*.trust.entity-statement.list.v1" | "request.*.trust.entity-statement.preview.v1" | "event.*.trust.entity-statement.published.v1" | "request.*.issuance.identifier.create.v1" | "request.*.issuance.identifier.get.v1" | "request.*.issuance.identifier.list.v1" | "request.*.issuance.identifier.preview.v1" | "request.*.issuance.identifier.publish.v1" | "request.*.issuance.identifier.update.v1" | "request.platform.provisioning.agent.converge.v1" | "request.platform.issuance.registry.probe.v1" | "request.platform.issuance.identifier.converge.v1" | "request.platform.trust.key-store.probe.v1" | "request.platform.issuance.identifier.resolve.v1" | "request.platform.identity.root-sign-in.get.v1" | "event.*.issuance.identifier.requested.v1" | "event.*.provisioning.placement.changed.v1" | "event.*.issuance.identifier.published.v1" | undefined

Defined in: packages/messaging/src/ports.ts:68

The registry key, when the subject resolved to one.

messageId​

readonly messageId: string | undefined

Defined in: packages/messaging/src/ports.ts:80

The envelope's ids, when it decoded.

module​

readonly module: string

Defined in: packages/messaging/src/ports.ts:70

The module that refused.

reason​

readonly reason: DenyReason

Defined in: packages/messaging/src/ports.ts:62

Which check refused; it becomes the audit record's reason code.

subject​

readonly subject: string

Defined in: packages/messaging/src/ports.ts:66

The concrete subject the message arrived on.