# `Opsmaru.Incus.Gateway.Policy`
[🔗](https://github.com/upmaru/opsmaru-incus/blob/v0.1.0/lib/opsmaru/incus/gateway/policy.ex#L1)

The single admission path shared by every gateway protocol adapter.

`admit/2` runs, in order and before any backend connection:

  1. canonical route and path checks (`/`, `/1.0`, `/1.0/*`; no dot segments,
     NUL or backslash, raw or percent-encoded; an encoded `/` inside a
     segment stays, as image aliases need it);
  2. native selection parsing from the raw query, rejecting duplicate or
     malformed `project`, `target` and `all-projects` values;
  3. bounded admission;
  4. host readiness;
  5. host authorization.

Each host callback runs in its own monitored process under the gateway's
`callback_timeout` and is killed at the deadline, so a slow callback can never
authorize later. Protocols not implemented by this gateway revision fail
after authorization with an explicit `501`.

# `admit`

Admit a request for `holder`. Returns `{:ok, %Admitted{}}` holding one
admission slot, or `{:error, failure}` with no backend contact.

# `recheck`

Shared bounded expiry/revocation check; never obtains another grant.

# `release`

Release an admitted exchange's slot.

# `request`

Build a request from adapter-supplied fields. Returns `{:ok, request}` or
`{:error, failure}` without contacting the host or backend.

---

*Consult [api-reference.md](api-reference.md) for complete listing*