blob: a9ce09dde1e12ad0b93ca48854f7c440ae57a695 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
|
#pragma once
#include "Api.h"
#include "ObjectManager.h"
#include "Types.h"
#include <set>
#include <string>
#include <vector>
/**
* @file HandlerManager.h
* @brief Declares handle allocation and release for authorized object access.
*/
namespace nt
{
class IdentityManager;
class LifecycleManager;
class NamespaceReferenceManager;
class PermissionsManager;
/** @brief Opens and closes authorized handles to registry objects. */
class HandlerManager
{
public:
/**
* @brief Constructs a HandlerManager with shared runtime dependencies.
*
* All managers are injected so that state (registry entries, lifecycle
* counters, permission policy) persists across calls rather than being
* rebuilt per open/close.
*/
HandlerManager(ObjectManager& objects,
PermissionsManager& permissions,
IdentityManager& identities,
LifecycleManager& lifecycles,
NamespaceReferenceManager& references);
/**
* @brief Represents authorized access to an object in the registry.
*
* The access mask is evaluated once during Open and cached here for the
* lifetime of the handle. Subsequent operations check `granted_access`
* rather than re-evaluating the security descriptor on every call. This
* resolves the performance question in PermissionsManager about when to
* check permissions.
*
* Because storage is append-only, a WRITE claim does not mean mutating an
* existing tuple in-place. It means the session is authorized to commit a
* new snapshot version of the relation. Two sessions holding WRITE handles
* on the same relation always produce independent snapshots — there is no
* data-level conflict.
*
* @todo Populate `granted_access` inside HandlerManager::Open from
* PermissionsManager::Firewall / Access. See docs/reactos-ob-comparison.md §4.
*/
struct handle {
/** Object referenced by this handle. */
ObjectManager::registry* object = nullptr;
/** Connection metadata associated with the authorized access. */
void* connection_context = nullptr;
/**
* Access claims granted to this handle at open time.
* Cached here so that per-operation checks read from the handle
* rather than re-evaluating the security descriptor.
* @todo Populate in HandlerManager::Open.
*/
std::set<AUTH_CLAIM> granted_access;
};
/**
* @brief Releases a handle allocation.
* @param handle Handle to release.
*/
void DeallocateHandle(struct handle* handle);
/**
* @brief Opens an object by path for a connection.
* @param object_path Logical object path.
* @param connection_context Connection metadata for the caller.
* @return A valid handle pointer on success, or nullptr on failure.
*/
struct handle* Open(std::vector<std::string> object_path, void* connection_context);
/**
* @brief Closes a previously opened handle.
* @param handle Handle to close.
* @return True when the handle was closed successfully.
*/
bool Close(struct handle* handle);
private:
ObjectManager& objects_;
PermissionsManager& permissions_;
IdentityManager& identities_;
LifecycleManager& lifecycles_;
NamespaceReferenceManager& references_;
};
}
|
