/**
 * @license
 * Copyright 2022-2026 Matter.js Authors
 * SPDX-License-Identifier: Apache-2.0
 */
import { Resource } from "#models/Resource.js";
Resource.add(
  {
    tag: "cluster",
    name: "AccessControl",
    pics: "ACL",
    xref: "core\xA79.10",
    details: 'The Access Control Cluster exposes a data model view of a Node\u2019s Access Control List (ACL), which codifies the rules used to manage and enforce Access Control for the Node\u2019s endpoints and their associated cluster instances. Access to this Access Control Cluster itself requires a special Administer privilege level, such that only Nodes granted such privilege (hereafter termed "Administrators") can manage the Access Control Cluster.\nThe Access Control Cluster shall be present on the root node endpoint of each Node, and shall NOT be present on any other Endpoint of any Node.',
    children: [
      {
        tag: "attribute",
        name: "FeatureMap",
        xref: "core\xA79.10.4",
        children: [
          {
            tag: "field",
            name: "EXTS",
            xref: "core\xA79.10.4.1",
            details: "This feature indicates the device supports ACL Extension attribute."
          },
          {
            tag: "field",
            name: "MNGD",
            xref: "core\xA79.10.4.2",
            details: "This feature is for a device that is managed by a service associated with the device vendor and which imposes default access restrictions upon each new fabric added to it. This could arise, for example, if the device is managed by a service provider under contract to an end-user, in such a way that the manager of the device does not unconditionally grant universal access to all of a device\u2019s functionality, even for fabric administrators. For example, many Home Routers are managed by an Internet Service Provider (a service), and these services often have a policy that requires them to obtain user consent before certain administrative functions can be delegated to a third party (e.g., a fabric Administrator). These restrictions are expressed using an Access Restriction List (ARL).\nThe purpose of this feature on the Access Control cluster is to indicate to a fabric Administrator that access by it to specific attributes, commands and/or events for specific clusters is currently prohibited. Attempts to access these restricted data model elements shall result in an error of ACCESS_RESTRICTED.\nA device that implements this feature shall have a mechanism to honor the ReviewFabricRestrictions command, such as user interfaces or service interactions associated with a service provider or the device manufacturer, which allows the owner (or subscriber) to manage access restrictions for each fabric. The user interface design, which includes the way restrictions are organized and presented to the user, is not specified, but SHOULD be usable by non-expert end-users from common mobile devices, personal computers, or an on-device user interface.\nControllers and clients SHOULD incorporate generic handling of the ACCESS_RESTRICTED error code, when it appears in allowed contexts, in order to gracefully handle situations where this feature is encountered. Device vendors that adopt this feature SHOULD be judicious in its use given the risk of unexpected behavior in controllers and clients.\nFor certification testing, a device that implements this feature shall provide a way for all restrictions to be removed.\nThe ARL attribute provides the set of restrictions currently applied to this fabric.\nThe ReviewFabricRestrictions command provides a way for the fabric Administrator to request that the server triggers a review of the current fabric restrictions, by involving external entities such as end-users, or other services associated with the manager of the device hosting the server. This review process may involve communication between external services and the user, and may take an unpredictable amount of time to complete since an end-user may need to visit some resources, such as a mobile application or web site. A FabricRestrictionReviewUpdate event will be generated by the device within a predictable time period of the ReviewFabricRestrictionsResponse (see Section 9.10.8.1, \u201CReviewFabricRestrictions Command\u201D for specification of this time period), and this event can be correlated with the ReviewFabricRestrictionsResponse using a token provided in both. The device may provide instructions or a Redirect URL in the FabricRestrictionReviewUpdate event in order to help the user access the features required for managing per-fabric restrictions.\nSee Section 6.6.2, \u201CModel\u201D for a description of how access control is impacted by the ARL attribute.\n### Managed Device Feature Usage Restrictions\nUse of this feature shall be limited to the mandatory clusters of endpoints having a device type that explicitly permits its use in the Device Library Specification. As a reminder, the device types associated with an endpoint are listed in the Descriptor cluster of the endpoint.\nIn addition, use of this feature shall NOT restrict the following clusters on any endpoint:\n  1. the Descriptor Cluster (0x001D)\n  2. the Binding Cluster (0x001E)\n  3. the Network Commissioning Cluster (0x0031)\n  4. the Identify Cluster (0x0003)\n  5. the Groups Cluster (0x0004)\nIn addition, use of this feature shall NOT restrict the global attributes of any cluster.\nBecause ARLs cannot be used to restrict root node access or access to any clusters required for commissioning, administrators may determine the current restrictions of the ARL at any point, including during commissioning after joining the fabric."
          }
        ]
      },
      {
        tag: "attribute",
        name: "Acl",
        xref: "core\xA79.10.6.3",
        details: "An attempt to add an Access Control Entry when no more entries are available shall result in a RESOURCE_EXHAUSTED error being reported and the ACL attribute shall NOT have the entry added to it. See access control limits.\nSee the AccessControlEntriesPerFabric attribute for the actual value of the number of entries per fabric supported by the server.\nEach Access Control Entry codifies a single grant of privilege on this Node, and is used by the Access Control Privilege Granting algorithm to determine if a subject has privilege to interact with targets on the Node."
      },
      {
        tag: "attribute",
        name: "Extension",
        xref: "core\xA79.10.6.4",
        details: "If present, the Access Control Extensions may be used by Administrators to store arbitrary data related to fabric\u2019s Access Control Entries.\nThe Access Control Extension list shall support a single extension entry per supported fabric."
      },
      {
        tag: "attribute",
        name: "SubjectsPerAccessControlEntry",
        xref: "core\xA79.10.6.5",
        details: "This attribute shall provide the minimum number of Subjects per entry that are supported by this server.\nSince reducing this value over time may invalidate ACL entries already written, this value shall NOT decrease across time as software updates occur that could impact this value. If this is a concern for a given implementation, it is recommended to only use the minimum value required and avoid reporting a higher value than the required minimum."
      },
      {
        tag: "attribute",
        name: "TargetsPerAccessControlEntry",
        xref: "core\xA79.10.6.6",
        details: "This attribute shall provide the minimum number of Targets per entry that are supported by this server.\nSince reducing this value over time may invalidate ACL entries already written, this value shall NOT decrease across time as software updates occur that could impact this value. If this is a concern for a given implementation, it is recommended to only use the minimum value required and avoid reporting a higher value than the required minimum."
      },
      {
        tag: "attribute",
        name: "AccessControlEntriesPerFabric",
        xref: "core\xA79.10.6.7",
        details: "This attribute shall provide the minimum number of ACL Entries per fabric that are supported by this server.\nSince reducing this value over time may invalidate ACL entries already written, this value shall NOT decrease across time as software updates occur that could impact this value. If this is a concern for a given implementation, it is recommended to only use the minimum value required and avoid reporting a higher value than the required minimum."
      },
      {
        tag: "attribute",
        name: "CommissioningArl",
        xref: "core\xA79.10.6.8",
        details: 'This attribute shall provide the set of CommissioningAccessRestrictionEntryStruct applied during commissioning on a managed device.\nWhen present, the CommissioningARL attribute shall indicate the access restrictions applying during commissioning.\nAttempts to access data model elements described by an entry in the CommissioningARL attribute during commissioning shall result in an error of ACCESS_RESTRICTED. See Access Control Model for more information about the features related to controlling access to a Node\u2019s Endpoint Clusters ("Targets" hereafter) from other Nodes.\nSee Section 9.10.4.2.1, \u201CManaged Device Feature Usage Restrictions\u201D for limitations on the use of access restrictions.'
      },
      {
        tag: "attribute",
        name: "Arl",
        xref: "core\xA79.10.6.9",
        details: 'This attribute shall provide the set of AccessRestrictionEntryStruct applied to the associated fabric on a managed device.\nWhen present, the ARL attribute shall indicate the access restrictions applying to the accessing fabric. In contrast, the CommissioningARL attribute indicates the accessing restrictions that apply when there is no accessing fabric, such as during commissioning.\nThe access restrictions are externally added/removed based on the particular relationship the device hosting this server has with external entities such as its owner, external service provider, or end-user.\nAttempts to access data model elements described by an entry in the ARL attribute for the accessing fabric shall result in an error of ACCESS_RESTRICTED. See Access Control Model for more information about the features related to controlling access to a Node\u2019s Endpoint Clusters ("Targets" hereafter) from other Nodes.\nSee Section 9.10.4.2.1, \u201CManaged Device Feature Usage Restrictions\u201D for limitations on the use of access restrictions.'
      },
      {
        tag: "event",
        name: "AccessControlEntryChanged",
        xref: "core\xA79.10.9.1",
        details: "The cluster shall generate AccessControlEntryChanged events whenever its ACL attribute data is changed by an Administrator.\n  - Each added entry shall generate an event with ChangeType Added.\n  - Each changed entry shall generate an event with ChangeType Changed.\n  - Each removed entry shall generate an event with ChangeType Removed.",
        children: [
          {
            tag: "field",
            name: "AdminNodeId",
            xref: "core\xA79.10.9.1.1",
            details: "The Node ID of the Administrator that made the change, if the change occurred via a CASE session.\nExactly one of AdminNodeID and AdminPasscodeID shall be set, depending on whether the change occurred via a CASE or PASE session; the other shall be null."
          },
          {
            tag: "field",
            name: "AdminPasscodeId",
            xref: "core\xA79.10.9.1.2",
            details: "The Passcode ID of the Administrator that made the change, if the change occurred via a PASE session. Non-zero values are reserved for future use (see PasscodeId generation in PBKDFParamRequest).\nExactly one of AdminNodeID and AdminPasscodeID shall be set, depending on whether the change occurred via a CASE or PASE session; the other shall be null."
          },
          {
            tag: "field",
            name: "ChangeType",
            xref: "core\xA79.10.9.1.3",
            details: "The type of change as appropriate."
          },
          {
            tag: "field",
            name: "LatestValue",
            xref: "core\xA79.10.9.1.4",
            details: "The latest value of the changed entry.\nThis field SHOULD be set if resources are adequate for it; otherwise it shall be set to NULL if resources are scarce."
          }
        ]
      },
      {
        tag: "event",
        name: "AccessControlExtensionChanged",
        xref: "core\xA79.10.9.2",
        details: "The cluster shall generate AccessControlExtensionChanged events whenever its extension attribute data is changed by an Administrator.\n  - Each added extension shall generate an event with ChangeType Added.\n  - Each changed extension shall generate an event with ChangeType Changed.\n  - Each removed extension shall generate an event with ChangeType Removed.",
        children: [
          {
            tag: "field",
            name: "AdminNodeId",
            xref: "core\xA79.10.9.2.1",
            details: "The Node ID of the Administrator that made the change, if the change occurred via a CASE session.\nExactly one of AdminNodeID and AdminPasscodeID shall be set, depending on whether the change occurred via a CASE or PASE session; the other shall be null."
          },
          {
            tag: "field",
            name: "AdminPasscodeId",
            xref: "core\xA79.10.9.2.2",
            details: "The Passcode ID of the Administrator that made the change, if the change occurred via a PASE session. Non-zero values are reserved for future use (see PasscodeId generation in PBKDFParamRequest).\nExactly one of AdminNodeID and AdminPasscodeID shall be set, depending on whether the change occurred via a CASE or PASE session; the other shall be null."
          },
          {
            tag: "field",
            name: "ChangeType",
            xref: "core\xA79.10.9.2.3",
            details: "The type of change as appropriate."
          },
          {
            tag: "field",
            name: "LatestValue",
            xref: "core\xA79.10.9.2.4",
            details: "The latest value of the changed extension.\nThis field SHOULD be set if resources are adequate for it; otherwise it shall be set to NULL if resources are scarce."
          }
        ]
      },
      {
        tag: "event",
        name: "FabricRestrictionReviewUpdate",
        xref: "core\xA79.10.9.3",
        details: "The cluster shall generate a FabricRestrictionReviewUpdate event to indicate completion of a fabric restriction review. Due to the requirement to generate this event within a bound time frame of successful receipt of the ReviewFabricRestrictions command, this event may include additional steps that the client may present to the user in order to help the user locate the user interface for the Managed Device feature.",
        children: [
          {
            tag: "field",
            name: "Token",
            xref: "core\xA79.10.9.3.1",
            details: "This field shall indicate the Token that can be used to correlate a ReviewFabricRestrictionsResponse with a FabricRestrictionReviewUpdate event."
          },
          {
            tag: "field",
            name: "Instruction",
            xref: "core\xA79.10.9.3.2",
            details: 'This field shall provide human readable text that may be displayed to the user to help them locate the user interface for managing access restrictions for each fabric.\nA device SHOULD implement the Localization Configuration Cluster when it has no other means to determine the locale to use for this text.\nExamples include "Please try again and immediately access device display for further instructions." or "Please check email associated with your Acme account."'
          },
          {
            tag: "field",
            name: "ArlRequestFlowUrl",
            xref: "core\xA79.10.9.3.3",
            details: 'This field shall indicate the URL for the service associated with the device maker which the user can visit to manage fabric limitations. The syntax of this field shall follow the syntax as specified in RFC 1738 and shall use the https scheme for internet-hosted URLs.\n  - The URL may embed the token, fabric index, fabric vendor, or other information transparently in order to pass context about the originating ReviewFabricRestrictions command to the service associated with the URL. The service associated with the device vendor may perform vendor ID verification on the fabric from which the ReviewFabricRestrictions command originated.\n  - If the device grants the request, the ARL attribute in the Access Control Cluster shall be updated to reflect the new access rights and a successful response shall be returned to the device making the request using the MTaer field of the callbackUrl. If the request is denied, the ARL attribute shall remain unchanged and a failure response shall be returned to the device making the request using the MTaer field of the callbackUrl.\n  - The device using this mechanism shall provide a service at the URL that can accept requests for additional access and return responses indicating whether the requests were granted or denied.\n  - This URL will typically lead to a server which (e.g. by looking at the User-Agent) redirects the user to allow viewing, downloading, installing or using a manufacturer-provided means for guiding the user through the process to review and approve or deny the request. The device manufacturer may choose to use a constructed URL which is valid in a HTTP GET request (i.e. dedicated for the product) such as, for example, https://domain.example/arl-app?vid=FFF1&pid=1234. If a client follows or launches the ARLRequestFlowUrl, it shall expand it as described in Section 9.10.9.3.4, \u201CARLRequestFlowUrl format\u201D.\n  - A manufacturer contemplating using this flow should realize that\n    - This flow typically requires internet access to access the URL, and access extension may fail when internet connectivity is not available.\n    - If the flow prefers to redirect the user to an app which is available on popular platforms, it SHOULD also provide a fallback option such as a web browser interface to ensure users can complete access extension.\n### ARLRequestFlowUrl format\nThe ARLRequestFlowUrl shall contain a query component (see RFC 3986 section 3.4) composed of one or more key-value pairs:\n  - The query shall use the & delimiter between key/value pairs.\n  - The key-value pairs shall in the format name=<value> where name is the key name, and <value> is the contents of the value encoded with proper URL-encoded escaping.\n  - If key MTcu is present, it shall have a value of "_" (i.e. MTcu=_). This is the "callback URL (CallbackUrl) placeholder".\n  - Any key whose name begins with MT not mentioned in the previous bullets shall be reserved for future use by this specification. Manufacturers shall NOT include query keys starting with MT in the ARLRequestFlowUrl unless they are referenced by a version of this specification.\nAny other element in the ARLRequestFlowUrl query field not covered by the above rules, as well as the fragment field (if present), shall remain including the order of query key/value pairs present.\n### Expansion of ARLRequestFlowUrl by client\nOnce the URL is obtained, it shall be expanded to form a final URL (ExpandedARLRequestFlowUrl) by proceeding with the following substitution algorithm on the original ARLRequestFlowUrl:\n  1. If key MTcu is present, compute the CallbackUrl desired (see Section 9.10.9.3.5, \u201CCallbackUrl format for ARL Request Flow response\u201D), and substitute the placeholder value "_" (i.e. in MTcu=_) in the ARLRequestFlowUrl with the desired contents, encoded with proper URL-encoded escaping (see RFC 3986 section 2).\nThe final URL after expansion (ExpandedARLRequestFlowUrl) shall be the one to follow, rather than the original value obtained from the FabricRestrictionReviewUpdate event.\n### CallbackUrl format for ARL Request Flow response\nIf a CallbackUrl field (i.e. MTcu=) query field placeholder is present in the ARLRequestFlowUrl, the client may replace the placeholder value "_" in the ExpandedARLRequestFlowUrl with a URL that the manufacturer flow can use to make a smooth return to the client when the ARL flow has terminated.\nThis URL field may contain a query component (see RFC 3986 section 3.4).\nIf a query is present, it shall be composed of one or more key-value pairs:\n  - The query shall use the & delimiter between key/value pairs.\n  - The key-value pairs shall follow the format name=<value> where name is the key name, and <value> is the contents of the value encoded with proper URL-encoded escaping.\n  - If key MTaer is present, it shall have a value of "_" (i.e. MTaer=_). This is the placeholder for a "access extension response" provided by the manufacturer flow to the client. The manufacturer flow shall replace this placeholder with the final status of the access extension request, which shall be formatted following Expansion of CallbackUrl by the manufacturer custom flow and encoded with proper URL-encoded escaping.\n  - Any key whose name begins with MT not mentioned in the previous bullets shall be reserved for future use by this specification.\nAny other element in the CallbackUrl query field not covered by the above rules, as well as the fragment field (if present), shall remain as provided by the client through embedding within the ExpandedARLRequestFlowUrl, including the order of query key/value pairs present.\nExpansion of CallbackUrl by the manufacturer custom flow Once the CallbackUrl is obtained by the manufacturer flow, it may be expanded to form a final ExpandedARLRequestCallbackUrl URL to be used by proceeding with the following substitution algorithm on the provided CallbackUrl:\n  - If key MTaer is present, the manufacturer custom flow having received the initial query containing the CallbackUrl shall substitute the placeholder value "_" (i.e. in MTaer=_) in the CallbackUrl with the final status of the access extension request flow which shall be one of the     following. Any value returned in the MTaer field not listed above shall be considered an error and shall be treated as GeneralFailure.\n    - Success - The flow completed successfully and the ARL attribute was updated. The client may now read the ARL attribute to determine the new access restrictions.\n    - NoChange - The ARL attribute was already listing minimum restrictions for the requesting fabric.\n    - GeneralFailure - The flow failed for an unspecified reason.\n    - FlowAuthFailure - The user failed to authenticate to the flow.\n    - NotFound - Access extension failed because the target fabric was not found.\nA manufacturer custom flow having received an ExpandedARLRequestFlowUrl SHOULD attempt to open the ExpandedARLRequestCallbackUrl, on completion of the request, if an ExpandedARLRequestCallbackUrl was computed from the CallbackUrl and opening such a URL is supported.\n### Examples of ARLRequestFlowUrl URLs\nBelow are some examples of valid ExpandedARLRequestFlowUrl for several valid values of ARLRequestFlowUrl, as well as some examples of invalid values of ARLRequestFlowUrl:\n  - Invalid URL with no query string: http scheme is not allowed:\n    - http://company.domain.example/matter/arl/vFFF1p1234\n  - Valid URL :\n    - https://company.domain.example/matter/arl/vFFF1p1234\n  - Valid URL, CallbackUrl requested:\n    - Before expansion:\nhttps://company.domain.example/matter/arl?vid=FFF1&pid=1234&MTcu=_\n  - After expansion:\nhttps://company.domain.example/matter/arl?vid=FFF1&pid=1234&MTcu=https%3A%2F%2Fclient.domain.example%2Fcb%3Ftoken%3DmAsJ6_vqbr-vjDiG_w%253D%253D%26MTaer%3D_\n  - The ExpandedARLRequestFlowUrl URL contains:\n    - A CallbackUrl with a client-provided arbitrary token= key/value pair and the MTaer= key/value pair place-holder to indicate support for a return access extension completion status: https://client.domain.example/cb?token=mAsJ6_vqbr-vjDiG_w%3D%3D&MTaer=_\n    - After expansion of the CallbackUrl (MTcu key) into an ExpandedCallbackUrl, with an example return access extension completion status of Success, the ExpandedARLRequestCallbackUrl would be:\nhttps://client.domain.example/cb?token=mAsJ6_vqbr-vjDiG_w%3D%3D&MTaer=Success\nNote that the MTcu key/value pair was initially provided URL-encoded within the ExpandedARLRequestFlowUrl URL and the MTaer=_ key/value pair placeholder now contains a substituted returned completion status.\n  - Invalid URL, due to MTza=79 key/value pair in reserved MT-prefixed keys reserved for future use:\n    - https://company.domain.example/matter/arl?vid=FFF1&pid=1234&MTop=_&MTza=79'
          }
        ]
      },
      {
        tag: "command",
        name: "ReviewFabricRestrictions",
        xref: "core\xA79.10.8.1",
        details: "This command signals to the service associated with the device vendor that the fabric administrator would like a review of the current restrictions on the accessing fabric. This command includes an optional list of ARL entries that the fabric administrator would like removed.\nIn response, a ReviewFabricRestrictionsResponse is sent which contains a token that can be used to correlate a review request with a FabricRestrictionReviewUpdate event.\nWithin 1 hour of the ReviewFabricRestrictionsResponse, the FabricRestrictionReviewUpdate event shall be generated, in order to indicate completion of the review and any additional steps required by the user for the review.\nA review may include obtaining consent from the user, which can take time. For example, the user may need to respond to an email or a push notification.\nThe ARL attribute may change at any time due to actions taken by the user, or the service associated with the device vendor.",
        children: [{
          tag: "field",
          name: "Arl",
          xref: "core\xA79.10.8.1.1",
          details: "When the ARL field is provided, it indicates the specific restrictions that are requested for review. An empty list represents a generic request for review of all restrictions."
        }]
      },
      {
        tag: "command",
        name: "ReviewFabricRestrictionsResponse",
        xref: "core\xA79.10.8.2",
        details: "Returns the review token for the request, which can be used to correlate with a FabricRestrictionReviewUpdate event.",
        children: [{
          tag: "field",
          name: "Token",
          xref: "core\xA79.10.8.2.1",
          details: "This field shall specify a Token that can be used to correlate a ReviewFabricRestrictionsResponse with a FabricRestrictionReviewUpdate event."
        }]
      },
      {
        tag: "datatype",
        name: "ChangeTypeEnum",
        xref: "core\xA79.10.5.1",
        children: [
          { tag: "field", name: "Changed", description: "Entry or extension was changed" },
          { tag: "field", name: "Added", description: "Entry or extension was added" },
          { tag: "field", name: "Removed", description: "Entry or extension was removed" }
        ]
      },
      {
        tag: "datatype",
        name: "AccessControlEntryPrivilegeEnum",
        xref: "core\xA79.10.5.2",
        children: [
          { tag: "field", name: "View", description: "Can read and observe all (except Access Control Cluster)" },
          {
            tag: "field",
            name: "Operate",
            description: "View privileges, and can perform the primary function of this Node (except Access Control Cluster)",
            xref: "core\xA79.10.5.2.1",
            details: "This value implicitly grants View privileges"
          },
          {
            tag: "field",
            name: "Manage",
            description: "Operate privileges, and can modify persistent configuration of this Node (except Access Control Cluster)",
            xref: "core\xA79.10.5.2.2",
            details: "This value implicitly grants Operate & View privileges"
          },
          {
            tag: "field",
            name: "Administer",
            description: "Manage privileges, and can observe and modify the Access Control Cluster",
            xref: "core\xA79.10.5.2.3",
            details: "This value implicitly grants Manage, Operate & View privileges"
          }
        ]
      },
      {
        tag: "datatype",
        name: "AccessRestrictionTypeEnum",
        xref: "core\xA79.10.5.3",
        children: [
          {
            tag: "field",
            name: "AttributeAccessForbidden",
            description: "Clients on this fabric are currently forbidden from reading and writing an attribute"
          },
          {
            tag: "field",
            name: "AttributeWriteForbidden",
            description: "Clients on this fabric are currently forbidden from writing an attribute"
          },
          {
            tag: "field",
            name: "CommandForbidden",
            description: "Clients on this fabric are currently forbidden from invoking a command"
          },
          {
            tag: "field",
            name: "EventForbidden",
            description: "Clients on this fabric are currently forbidden from reading an event"
          }
        ]
      },
      {
        tag: "datatype",
        name: "AccessControlEntryAuthModeEnum",
        xref: "core\xA79.10.5.4",
        children: [
          { tag: "field", name: "Pase", description: "Passcode authenticated session" },
          { tag: "field", name: "Case", description: "Certificate authenticated session" },
          { tag: "field", name: "Group", description: "Group authenticated session" }
        ]
      },
      { tag: "datatype", name: "AccessControlTargetStruct", xref: "core\xA79.10.5.5" },
      {
        tag: "datatype",
        name: "AccessControlEntryStruct",
        xref: "core\xA79.10.5.6",
        children: [
          {
            tag: "field",
            name: "Privilege",
            xref: "core\xA79.10.5.6.1",
            details: "The privilege field shall specify the level of privilege granted by this Access Control Entry.\nEach privilege builds upon its predecessor, expanding the set of actions that can be performed upon a Node. Administer is the highest privilege, and is special as it pertains to the administration of privileges itself, via the Access Control Cluster.\nWhen a Node is granted a particular privilege, it is also implicitly granted all logically lower privilege levels as well. The following diagram illustrates how the higher privilege levels subsume the lower privilege levels:\nIndividual clusters shall define whether attributes are readable, writable, or both readable and writable. Clusters also shall define which privilege is minimally required to be able to perform a particular read or write action on those attributes, or invoke particular commands. Device type specifications may further restrict the privilege required.\nThe Access Control Cluster shall require the Administer privilege to observe and modify the Access Control Cluster itself. The Administer privilege shall NOT be used on Access Control Entries which use the Group auth mode.\nE.g. A Fan Control Cluster may require Operate privilege to write to a level attribute (low/medium/high), and to configure each level\u2019s RPM setting via a command. The Fan Control Cluster may also expose a current RPM attribute, which requires only View privilege to read. Clients granted Operate privilege will be able to both change the level, and configure each level\u2019s RPM. Clients granted View privilege will be able to read the current RPM, but will not be granted sufficient privilege to change the level or configure each level\u2019s RPM.\nE.g. A Fan Control Cluster may be included in a more industrial device type. To ensure proper operation, this device type may restrict configuration of fan level RPM settings to require Manage privilege. Clients granted Manage privilege will have sufficient privilege to configure each level\u2019s RPM; clients granted Operate privilege will not be able to perform such configuration, but will still be able to change the level. This additional restriction would apply only to the Fan Control Cluster as included in this particular device type; a client granted Operate privilege may still be able to perform configuration in Fan Control Clusters included in other device types on the same Node."
          },
          {
            tag: "field",
            name: "AuthMode",
            xref: "core\xA79.10.5.6.2",
            details: "The AuthMode field shall specify the authentication mode required by this Access Control Entry."
          },
          {
            tag: "field",
            name: "Subjects",
            xref: "core\xA79.10.5.6.3",
            details: "The subjects field shall specify a list of Subject IDs, to which this Access Control Entry grants access.\nDevice types may impose additional constraints on the minimum number of subjects per Access Control Entry.\nAn attempt to create an entry with more subjects than the node can support shall result in a RESOURCE_EXHAUSTED error and the entry shall NOT be created.\nSubject ID shall be of type uint64 with semantics depending on the entry\u2019s AuthMode as follows:\n### Subject Semantics\nAn empty subjects list indicates a wildcard; that is, this entry shall grant access to any Node that successfully authenticates via AuthMode. The subjects list shall NOT be empty if the entry\u2019s AuthMode is PASE.\nThe PASE AuthMode is reserved for future use (see Section 6.6.2.9, \u201CBootstrapping of the Access Control Cluster\u201D). An attempt to write an entry with AuthMode set to PASE shall fail with a status code of CONSTRAINT_ERROR.\nFor PASE authentication, the Passcode ID identifies the required passcode verifier, and shall be 0 for the default commissioning passcode.\nFor CASE authentication, the Subject ID is a distinguished name within the Operational Certificate shared during CASE session establishment, the type of which is determined by its range to be one of:\n  - a Node ID, which identifies the required source node directly (by ID)\n  - a CASE Authenticated Tag, which identifies the required source node indirectly (by tag)\nE.g. an ACL entry with CASE AuthMode that grants privileges to Subject IDs [ 0x0000_0000_1111_1111, 0x0000_0000_2222_2222, 0x0000_0000_3333_3333 ] (which are Node IDs) will grant access to Nodes with Node ID 0x0000_0000_1111_1111, 0x0000_0000_2222_2222, or 0x0000_0000_3333_3333, but will not grant access to Nodes with Node ID 0x0000_0000_4444_4444 or 0x0000_0000_5555_5555.\nE.g. an ACL entry with CASE AuthMode that grants privileges to Subject IDs [ 0x0000_0000_6666_6666, 0xFFFF_FFFD_ABCD_0002 ] (which are a Node ID and a CASE Authenticated Tag) will grant access to the Node with Node ID 0x0000_0000_6666_6666 and any Nodes with CAT identifier value 0xABCD if the CAT\u2019s version is 0x0002 or higher. It will not grant access to Nodes with other CAT values such as 0x9999_9999. Any node with CAT identifier value of 0xABCD but version less than 0x0002 (for example: 0xFFFF_FFFD_ABCD_0001) will not be granted access.\nFor Group authentication, the Group ID identifies the required group, as defined in the Group Key Management Cluster.\nE.g. an entry with Group AuthMode that grants privileges to Subject IDs [ 0x0000_0000_1111_1111, 0x0000_0000_2222_2222 ] (which are Group IDs) will grant access to Nodes in Group 0x1111_1111 or 0x2222_2222, but will not grant access to Nodes in Group 0x3333_3333, even if they share Operational Group Keys."
          },
          {
            tag: "field",
            name: "Targets",
            xref: "core\xA79.10.5.6.4",
            details: "The targets field shall specify a list of AccessControlTargetStruct, which define the clusters on this Node to which this Access Control Entry grants access.\nDevice types may impose additional constraints on the minimum number of targets per Access Control Entry.\nAn attempt to create an entry with more targets than the node can support shall result in a RESOURCE_EXHAUSTED error and the entry shall NOT be created.\nA single target shall contain at least one field (Cluster, Endpoint, or DeviceType), and shall NOT contain both an Endpoint field and a DeviceType field.\nA target grants access based on the presence of fields as follows:\n### Target Semantics\nAn empty targets list indicates a wildcard: that is, this entry shall grant access to all cluster instances on all endpoints on this Node.\nE.g. an entry that grants privileges to the Color Light Bulb Device Type will grant privileges to any cluster on any endpoint that contains the Color Light Bulb device type (whether that cluster is in the Color Light Bulb device type or not), and will not grant privileges to any other cluster on any other endpoint.\nE.g. an entry that grants privileges to Endpoint 1 will grant privileges to any cluster on Endpoint 1, and will not grant privileges to any other cluster on any other endpoint.\nE.g. an entry that grants privileges to the On/Off Cluster on any endpoint will not grant privileges to any other cluster on any endpoint.\nE.g. an entry that grants privileges to the On/Off Cluster with Color Light Bulb Device Type will grant privileges to just the On/Off Cluster on any endpoint that contains the Color Light Bulb device type, and will not grant privileges to any other cluster on any other endpoint (including other clusters in the Color Light Bulb device type, or the On/Off cluster on endpoints that do not contain the Color Light Bulb device type).\nE.g. an entry that grants privileges to the On/Off Cluster on Endpoint 1 will not grant privileges to any other cluster on Endpoint 1, or to any other cluster (including the On/Off cluster) on any other endpoint."
          }
        ]
      },
      {
        tag: "datatype",
        name: "AccessControlExtensionStruct",
        xref: "core\xA79.10.5.7",
        children: [{
          tag: "field",
          name: "Data",
          xref: "core\xA79.10.5.7.1",
          details: "This field may be used by manufacturers to store arbitrary TLV-encoded data related to a fabric\u2019s Access Control Entries.\nThe contents shall consist of a top-level anonymous list; each list element shall include a profile-specific tag encoded in fully-qualified form.\nAdministrators may iterate over this list of elements, and interpret selected elements at their discretion. The content of each element is not specified, but may be coordinated among manufacturers at their discretion.\nE.g. a manufacturer could use this field to store structured data, including various metadata and cryptographic signatures. The manufacturer could then verify a fabric\u2019s Access Control List by generating a canonical bytestream from the Access Control Entries for the fabric, then verifying the signature against it. Such a canonical bytestream could be generated by encoding specific entry fields and sub-fields (such as lists) in specific order and specific format (e.g. TLV)."
        }]
      },
      {
        tag: "datatype",
        name: "AccessRestrictionStruct",
        xref: "core\xA79.10.5.8",
        details: "This structure describes an access restriction that would be applied to a specific data model element on a given endpoint/cluster pair (see AccessRestrictionEntryStruct).",
        children: [
          {
            tag: "field",
            name: "Type",
            xref: "core\xA79.10.5.8.1",
            details: "This field shall indicate the type of restriction, for example, AttributeAccessForbidden."
          },
          {
            tag: "field",
            name: "Id",
            xref: "core\xA79.10.5.8.2",
            details: "This field shall indicate the element Manufacturer Extensible Identifier (MEI) associated with the element type subject to the access restriction, based upon the AccessRestrictionTypeEnum. When the Type is AttributeAccessForbidden or AttributeWriteForbidden, this value shall be considered of type attrib-id (i.e. an attribute identifier). When the Type is CommandForbidden, this value shall be considered of type command-id (i.e. an attribute identifier). When the Type is EventForbidden, this value shall be considered of type event-id (i.e. an event identifier).\nA null value shall indicate the wildcard value for the given value of Type (i.e. all elements associated with the Type under the associated endpoint and cluster for the containing AccessRestrictionEntryStruct)."
          }
        ]
      },
      {
        tag: "datatype",
        name: "AccessRestrictionEntryStruct",
        xref: "core\xA79.10.5.9",
        details: "This structure describes a current access restriction on the fabric.",
        children: [
          {
            tag: "field",
            name: "Endpoint",
            xref: "core\xA79.10.5.9.1",
            details: "This field shall indicate the endpoint having associated access restrictions scoped to the associated fabric of the list containing the entry."
          },
          {
            tag: "field",
            name: "Cluster",
            xref: "core\xA79.10.5.9.2",
            details: "This field shall indicate the cluster having associated access restrictions under the entry\u2019s Endpoint, scoped to the associated fabric of the list containing the entry."
          },
          {
            tag: "field",
            name: "Restrictions",
            xref: "core\xA79.10.5.9.3",
            details: "This field shall indicate the set of restrictions applying to the Cluster under the given Endpoint, scoped to the associated fabric of the list containing the entry.\nThis list shall NOT be empty."
          }
        ]
      },
      {
        tag: "datatype",
        name: "CommissioningAccessRestrictionEntryStruct",
        xref: "core\xA79.10.5.10",
        details: "This structure describes a current access restriction when there is no accessing fabric.",
        children: [
          {
            tag: "field",
            name: "Endpoint",
            xref: "core\xA79.10.5.10.1",
            details: "This field shall indicate the endpoint having associated access restrictions scoped to the associated fabric of the list containing the entry."
          },
          {
            tag: "field",
            name: "Cluster",
            xref: "core\xA79.10.5.10.2",
            details: "This field shall indicate the cluster having associated access restrictions under the entry\u2019s Endpoint, scoped to the associated fabric of the list containing the entry."
          },
          {
            tag: "field",
            name: "Restrictions",
            xref: "core\xA79.10.5.10.3",
            details: "This field shall indicate the set of restrictions applying to the Cluster under the given Endpoint, scoped to the associated fabric of the list containing the entry.\nThis list shall NOT be empty."
          }
        ]
      }
    ]
  }
);
//# sourceMappingURL=access-control.resource.js.map
