Struct Disclosure 

pub struct Disclosure {
    pub list_accounts: bool,
    pub list_account_ledgers: bool,
    pub get_account_ledger: bool,
    pub stats: bool,
}

Per-route configuration for every Credential::Disclosure route: open (public) or closed (operator-only), one flag per route rather than one flag for all of them.

Why public is the default

listAccounts, listAccountLedgers, getAccountLedger and stats say which agents this deployment runs and what happened to them. Publishing that is this project’s accountability story, not an afterthought: plan/ownership.md exists so a stranger can ask whether an agent traces to a responsible human, and that question has no answer if the deployment that could answer it is also the one deciding whether to be asked. The same argument this project makes elsewhere for publishing what it is doing — so divergence from what was promised is a comparison somebody outside can make — applies here without modification: an operator who wants a quiet server may close a route, but the field a fresh deployment starts from is true.

Why it is still toggleable

This is a decision for now, not a permanent property. plan/spaces.md names “private means federation off” as an alternative posture a deployment may choose, and disclosure is the same kind of choice at a smaller grain: a deployment running agents on behalf of people who would rather not have every account enumerated by a stranger needs a way to say so. Per-route rather than one switch, because closing the ledger while leaving the roster open — or the reverse — is a plausible posture a single flag cannot express.

The toggle may only narrow

Every field defaults true. A deployment’s configuration may flip a field to false; nothing may flip one to something wider than true, because there is nothing wider than public — narrowing is the only direction this configuration tier is ever allowed to move in, the same rule that governs every other tier below the operator’s own repository.

Closing a route is visible, not silent

The threat this default exists to resist is an operator who cannot be audited, and the configuration tier that closes a route is a tier an on-box attacker also reaches — so closing listAccounts is exactly what that attacker would do to hide what a stranger needed to see. This cannot be prevented from here, but it is made visible: auth::require_disclosure answers a closed route with DisclosureDisabled, never a 404 and never an empty list, so an outsider can tell “this server runs no agents” from “this server is not telling you” — two very different facts, and only one of them is suspicious.

Fields

list_accounts: bool

Whether a stranger may read which accounts this deployment holds.

Every route that names them alike, not bot.did.listAccounts on its own: com.atproto.sync.listRepos pages through the same accounts, and com.atproto.sync.subscribeRepos announces each one as it appears and as it writes. Closing one and leaving the others would answer DisclosureDisabled over a roster still readable two other ways, which is worse than not offering the toggle: it says the accounts are hidden when they are not.

Closing it costs federation. A relay crawls subscribeRepos, and a deployment that refuses it is not indexed — the trade plan/spaces.md names as “private means federation off”, taken at this grain.

list_account_ledgers: bool

bot.did.listAccountLedgers.

get_account_ledger: bool

bot.did.getAccountLedger.

stats: bool

bot.did.stats.

Trait Implementations

impl Clone for Disclosure

fn clone(&self) -> Disclosure

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Disclosure

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Disclosure

fn default() -> Self

Every route open, which is this configuration’s own resting state — see Disclosure’s own documentation for why the default is public rather than closed.

impl PartialEq for Disclosure

fn eq(&self, other: &Disclosure) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Copy for Disclosure

impl Eq for Disclosure

impl StructuralPartialEq for Disclosure