NodeSpecDoor

The app's binding of the Trove door host: the one door of this user and host, the spec database of the active identity, and the grants that a caller of the door may use (trove-parts §TPS-3, §TPD-4).


Inherits	QObject
Group	libnode

Declared in src/libs/libnode/node/NodeSpecDoor.hpp.

Detailed description

The node owns it, not the window, so a HUB with no window has a door too. It takes no `Node` (work-placement §WPI-11): `OpalDoorFeature` makes it and gives it a Host, so an app that is not a node has one too. The app tells the door when its startup moves (`refresh()`).

One door per user and host

The door serves the HUB identity of its host (trove-parts R8). Only an app whose node gives it the door role serves it (setDoorRole()): a HUB does, an agent and a remote never do. The first app to take the lock holds the door. A HUB that finds a standalone host holding it asks that host to hand over and takes the door when the host is gone. A HUB that finds another HUB holding it serves no door: heldElsewhereBy() names the holder, and the app's own state stays a door client's (§TPA-5).

One database per identity

There is one spec database per (sentient, device) pair (trove §DM-2). The door follows the identity: refresh() opens the database of the identity that is active now, and closes the stores, not the door, when no identity is active. A door host left serving across an identity switch answers from the previous sentient's corpus (§DM-2.2), so every event that moves the sentient or the node calls refresh().

The grants persist with the node

The caller of the door is a session, not a person, so nobody answers a consent prompt. The door host pre-flights each task's scopes against permissions() and refuses by name (§API-7). The grants are saved in the node's settings under kGrantsKey on every change, and apply at once: the door holds the same store the Permissions screen edits.

The scopes of defaultScopes() are granted by default. A default is seeded one time, and kSeededKey records it, so a person who revokes one keeps it revoked, and a scope that a later build adds is still granted.