Keeps a public read to the records its reader may open, by the rule the record's page keeps: a record whose lock names permissions opens only for a reader holding one of them (AccessPermissions.match?/3), and never for a visitor who is not signed in. A list leaves out, in its own query, every record the reader may not open, so its pages and its count are of what the reader sees; asking for one of them by itself finds nothing, as an id nothing is stored at does.

prepare {OpenToActor, kind: :section}

THE READER is the actor of an authorized read: the visitor a page reads for, as the documentation's components pass it — nil for a visitor who is not signed in — and the JSON:API's caller.

Ash.Query.for_read(MishkaDocument.Section, :public_list, %{},
  actor: current_user,
  tenant: site_id
)

A read made with authorize?: false is the system's — the lock a page's head hands its gate, the document a page sits in — and is not filtered.

WHAT IS NOT PUBLISHED opens for no reader, whatever its lock: a version (:version) of a document that is not active, a clone record (:lineage) either of whose versions is of one, and a page (:section) of a version that is not published — alpha, beta, rc or stable — or of a document that is not active. A list leaves them out and one asked for alone is not found, as a document's own public reads leave out one that is not active.

WHAT A LIST IS KEPT TO is decided in the statement that reads it, by the lock each record opens with, so no read of another record is made to decide it and its pages and its count are of what the reader sees:

• a document (:workspace) — by its own lock;
• a version (:version) and a clone record (:lineage, by its new version) — by its document's;
• a page of a document (:section) — by the lock it opens with (MishkaDocument.Resources.Calculations.EffectivePermissions): its own, else the nearest page above it that names one, else its document's.

A lock that names nothing opens for anyone. Any other opens for a reader holding a name that AccessPermissions finds covering one of its entries, and the statement asks the same: the names the reader holds are handed to it as the literals that cover only themselves and the patterns of those with a *, and the entries a dashboard request does not count (admin:api:…) match none. An actor whose permissions are not loaded has them read once for the read, as the checker reads them.

The statement holds fragments because Ash has no function that tests the elements of an array against patterns, none that walks down a tree from the pages that name a lock, and no relationship from a document to the site's pages.

WHAT ITS PAGE KEEPS CLOSED is left out as well, in the same statement: a record whose address is answered by a page of the site (MishkaCmsCore.Runtime.Page) that the reader may not open is not listed, and one asked for alone is not found. A page counts while it is active and not archived, and answers the documentation's records by the kind its extra names under "record": "docs:document", a document's front page, or "docs:page", one page of a document.

• a document with an address of its own (path, MishkaDocument.Address) is answered at that address — its front page by the page at path that shows "docs:document", its other pages by the page at path/*section that shows "docs:page";
• a document with no address is answered by the pages of each kind that no document's address claims (/:lang/docs/:workspace, /:lang/docs/:workspace/*section), and is closed by them only when there is one and every one of them is closed;
• a document (:workspace), its versions (:version) and its clone records (:lineage, by its new version's document) are closed with its front page;
• a version's front page (:section, front_page) is closed with its document's front page, and any other page with the page its document's other pages are answered at.

A page that names no permission opens for anyone; any other opens for a reader holding a name that covers one of its entries, by the same match a record's lock is asked with. The statement is the same whether a page is locked or not, and nothing is read before it to decide. The JSON:API and GraphQL keep to the same rule as the site's pages.

Options

• :kind - Required. :workspace, :version, :lineage or :section.