Class AuthoredSendGovernor

Namespace

MailFathom.Application.Mail.Delivery.Governance

Assembly

MailFathom.Application.dll

Decides what one caller may talk this deployment into sending, and records what it did send.

public sealed class AuthoredSendGovernor

Inheritance

object

AuthoredSendGovernor

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

OutgoingMailGovernor answers what this deployment may send at all, whoever is asking, and it is asked by the outbox so that nothing reaches a record ungoverned. This answers the other question — what a caller acting on text a stranger wrote may be talked into — and it is therefore asked where a caller exists, which the outbox is deliberately not: work no caller requested has no principal, no grant, and no client to bound.

It is asked by the use cases rather than by the tools, which is what makes it unbypassable on this surface for the reason the outbox's own checks are: a second protocol added later reaches the same use case and meets the same three refusals without re-implementing any of them, and a tool that forgot to ask would be a tool that could not send.

The deployment's recipient policy is asked first, because it is decided in memory and refuses outright. It is re-evaluated here rather than trusted from the outbox beneath — not because the outbox might not ask, but because a caller refused for naming somebody this installation never writes to should learn that before its message is written down, and because a bound with one implementation is a bound with one place to get wrong.

The caller's own ceilings are asked last, after the contact book has answered, and that ordering is the ledger's rather than a preference. Asking it is what charges it: a ceiling read here and charged after the record was written would be a ceiling two concurrent sends from one caller both passed, which is the loop this bound exists to stop. So nothing may refuse a send after the ledger has admitted it, and the read of the book — the one step here that awaits anything — happens in front of it. The cost is one indexed lookup on a send the ceiling then refuses, which is the cheaper half of the trade.

The book is asked even where the posture admits an unvouched recipient, and that is a read this deployment pays for on every send. What it buys is the one thing the admitting posture would otherwise have no record of: that a message went to somebody this installation has never corresponded with. A count of them reaches the audit; nothing reaches the caller.

Constructors

AuthoredSendGovernor(OutgoingRecipientPolicy, AuthoredSendSettings, RecipientVouching, AuthoredSendUsageLedger, IAuthoredSendAuditor, AccessAuthorization, TimeProvider)

Decides what one caller may talk this deployment into sending, and records what it did send.

Methods

RecordAsync(AuthoredSendPermit, AuthoredSendAct, OutgoingEmailRecord, CancellationToken)

Records that the send was asked for, once its record is durable.

RequirePermittedAsync(IReadOnlyList<AuthoredEmailRecipient>, OutgoingEmailRequest, CancellationToken)

Requires that this caller may be talked into the message it composed.