MatterEx.ACL (matter_ex v0.3.0)

Pure-function ACL engine for Matter access control.

Evaluates whether a given subject/fabric has sufficient privilege for a requested operation on a target. No state — just pattern matching.

Summary

Types

acl_entry()

auth_mode()

context()

privilege()

Functions

check(context, acl_entries, required_privilege, target)

Check whether the given context has sufficient privilege for the target.

required_privilege(atom)

Return the minimum privilege required for an IM operation.

write_privilege(arg1)

Return the privilege required to write a specific cluster's attributes. The Access Control cluster (0x001F) requires Administer privilege.

Types

acl_entry()

@type acl_entry() :: %{
  privilege: 1..5,
  auth_mode: 2 | 3,
  subjects: [non_neg_integer()] | nil,
  targets: [map()] | nil,
  fabric_index: non_neg_integer()
}

auth_mode()

@type auth_mode() :: :pase | :case | :group

context()

@type context() :: %{
  auth_mode: auth_mode(),
  subject: non_neg_integer(),
  fabric_index: non_neg_integer()
}

privilege()

@type privilege() :: :view | :proxy_view | :operate | :manage | :administer

Functions

check(context, acl_entries, required_privilege, target)

@spec check(
  context(),
  [acl_entry()],
  privilege(),
  {non_neg_integer(), non_neg_integer()}
) ::
  :allow | :deny

Check whether the given context has sufficient privilege for the target.

PASE sessions always get implicit admin access (bypass ACL). CASE sessions are checked against the ACL entries.

required_privilege(atom)

@spec required_privilege(atom()) :: privilege()

Return the minimum privilege required for an IM operation.

write_privilege(arg1)

@spec write_privilege(non_neg_integer()) :: privilege()

Return the privilege required to write a specific cluster's attributes. The Access Control cluster (0x001F) requires Administer privilege.