mayView method

Future<bool> mayView(String model, Object? viewer, Object? record, { bool personal = false, bool declaredViewPolicy = false, })

Whether viewer may have record's page at all. A refusal is answered as a record that does not exist -- 404, never 403 -- so a page cannot be used to learn that a record is there.

A registered <model>.view policy decides. Without one, a model's records are public, because a model that did not opt out of pages has said so -- except where:

• the record is personal, a row that is its own privacy subject: a person's record is nobody's to publish by default; or
• a view policy is declaredViewPolicy somewhere this process cannot load it, as a policy written against the generated client is to the server. Reading that as "no policy" would publish every record the policy exists to refuse.

A policy that throws, or that cannot be asked with this viewer and record, refuses.

Implementation

Future<bool> mayView(
  String model,
  Object? viewer,
  Object? record, {
  bool personal = false,
  bool declaredViewPolicy = false,
}) async {
  final String action = '$model.view';
  if (_registered(action)) return _ask(action, viewer, record);
  return !personal && !declaredViewPolicy;
}