ReadAuthorizer

Decides whether a caller may read a model at all, before anything of it is read: a query of any model and any operation (a server-sent stream is its query's), a state read and a trace. Which rows the caller sees is the aggregate's access policy's (me.ahoo.wow.api.access.AccessPolicy), which fields the masks'; this is the role, the application, the entry: whether the caller may read here at all.

An authorizer refuses for who is reading, never for what is asked: a caller without a role or an application, not a query that names a field it may not filter by. A refused caller learns nothing of what it asked for, not even whether an aggregate exists.

Every caller is asked, on every entry: the public port, a peer's read on the internal port, and in-process code reading as a caller (QueryApi.of(caller)); a service is asked as any caller, and the authorizer decides. Trusted in-process code, which reads with no caller, is not asked. A node's authorizers are all asked (allOf): ReadAuthorization.Allowed means this authorizer has no objection, not that the read is allowed whatever the others say. The host asks every bean of this type, in their order.

A refusal is answered by its code, 403 wow.auth.forbidden unless it says otherwise: over HTTP as that problem, in process as the problem thrown.