Package com.kingsrook.qqq.backend.core.actions.permissions.fieldaccess
package com.kingsrook.qqq.backend.core.actions.permissions.fieldaccess
-
ClassDescriptionProtect audit table egress using the policy of the table whose data changed.Supplies instance keys and optional per-record, per-field shreddable keys.Key bytes and the public identifier stored in a token.One key source per instance.Classification-based protection for noninteractive output, independent of user tier.Shared, versioned audit/email value tokens.A channel-specific ceiling, combined with locks and the instance resolver.A resolver decision; the reason must never contain a field value.Value-free audit notification.Kinds of field access reported to the resolver.Single entry point for field policy, enforcement, masking and audit notifications.Per-invocation exact searches, completed only by the action that enforced them.Outcome of an exact-match search.Session-aware policy, reveal grants and value-free access notifications.One resolver per instance.Effective field access, ordered from least to most restrictive.Presentation rules for a restricted value.Masks values of fields whose exposure is MASKED: - email addresses keep their first character and their domain (j***@example.com) - numbers, and strings of digits (and separators), keep their last 4 digits (***1234) - other strings keep their first and last character (a***z), or are fully masked (***) when 4 or fewer characters long.