/**
 * @license
 * Copyright 2022-2026 Matter.js Authors
 * SPDX-License-Identifier: Apache-2.0
 */
import { Resource } from "#models/Resource.js";
Resource.add(
  {
    tag: "cluster",
    name: "AccessControl",
    pics: "ACL",
    xref: "core\xA79.10",
    details: `The Access Control Cluster exposes a data model view of a Node's Access Control List (ACL), which codifies the rules used to manage and enforce Access Control for the Node's endpoints and their associated cluster instances. Access to this Access Control Cluster itself requires a special Administer privilege level, such that only Nodes granted such privilege (hereafter termed "Administrators") can manage the Access Control Cluster.
The Access Control Cluster shall be present on the root node endpoint of each Node, and shall NOT be present on any other Endpoint of any Node.`,
    children: [
      {
        tag: "attribute",
        name: "FeatureMap",
        xref: "core\xA79.10.4",
        children: [
          {
            tag: "field",
            name: "EXTS",
            xref: "core\xA79.10.4.1",
            details: "This feature indicates the device supports ACL Extension attribute."
          },
          {
            tag: "field",
            name: "MNGD",
            xref: "core\xA79.10.4.2",
            details: `This feature is for a device that is managed by a service associated with the device vendor and which imposes default access restrictions upon each new fabric added to it. This could arise, for example, if the device is managed by a service provider under contract to an end-user, in such a way that the manager of the device does not unconditionally grant universal access to all of a device's functionality, even for fabric administrators. For example, many Home Routers are managed by an Internet Service Provider (a service), and these services often have a policy that requires them to obtain user consent before certain administrative functions can be delegated to a third party (e.g., a fabric Administrator). These restrictions are expressed using an Access Restriction List (ARL).
The purpose of this feature on the Access Control cluster is to indicate to a fabric Administrator that access by it to specific attributes, commands and/or events for specific clusters is currently prohibited. Attempts to access these restricted data model elements shall result in an error of ACCESS_RESTRICTED.
A device that implements this feature shall have a mechanism to honor the ReviewFabricRestrictions command, such as user interfaces or service interactions associated with a service provider or the device manufacturer, which allows the owner (or subscriber) to manage access restrictions for each fabric. The user interface design, which includes the way restrictions are organized and presented to the user, is not specified, but SHOULD be usable by non-expert end-users from common mobile devices, personal computers, or an on-device user interface.
Controllers and clients SHOULD incorporate generic handling of the ACCESS_RESTRICTED error code, when it appears in allowed contexts, in order to gracefully handle situations where this feature is encountered. Device vendors that adopt this feature SHOULD be judicious in its use given the risk of unexpected behavior in controllers and clients.
For certification testing, a device that implements this feature shall provide a way for all restrictions to be removed.
The ARL attribute provides the set of restrictions currently applied to this fabric.
The ReviewFabricRestrictions command provides a way for the fabric Administrator to request that the server triggers a review of the current fabric restrictions, by involving external entities such as end-users, or other services associated with the manager of the device hosting the server. This review process may involve communication between external services and the user, and may take an unpredictable amount of time to complete since an end-user may need to visit some resources, such as a mobile application or web site. A FabricRestrictionReviewUpdate event will be generated by the device within a predictable time period of the ReviewFabricRestrictionsResponse (see Section 9.10.8.1, "ReviewFabricRestrictions" for specification of this time period), and this event can be correlated with the ReviewFabricRestrictionsResponse using a token provided in both. The device may provide instructions or a Redirect URL in the FabricRestrictionReviewUpdate event in order to help the user access the features required for managing per-fabric restrictions.
See Section 6.6.2, "Access Control Model" for a description of how access control is impacted by the ARL attribute.`
          }
        ]
      },
      {
        tag: "attribute",
        name: "Acl",
        xref: "core\xA79.10.6.3",
        details: 'An attempt to add an Access Control Entry when no more entries are available shall result in a RESOURCE_EXHAUSTED error being reported and the ACL attribute shall NOT have the entry added to it. See Section 2.11.1.1, "Access Control Limits".\nSee the AccessControlEntriesPerFabric attribute for the actual value of the number of entries per fabric supported by the server.\nEach Access Control Entry codifies a single grant of privilege on this Node, and is used by the Access Control Privilege Granting algorithm to determine if a subject has privilege to interact with targets on the Node.'
      },
      {
        tag: "attribute",
        name: "Extension",
        xref: "core\xA79.10.6.4",
        details: "If present, the Access Control Extensions may be used by Administrators to store arbitrary data related to fabric's Access Control Entries.\nThe Access Control Extension list shall support a single extension entry per supported fabric."
      },
      {
        tag: "attribute",
        name: "SubjectsPerAccessControlEntry",
        xref: "core\xA79.10.6.5",
        details: "This attribute shall provide the minimum number of Subjects per entry that are supported by this server.\nSince reducing this value over time may invalidate ACL entries already written, this value shall NOT decrease across time as software updates occur that could impact this value. If this is a concern for a given implementation, it is recommended to only use the minimum value required and avoid reporting a higher value than the required minimum."
      },
      {
        tag: "attribute",
        name: "TargetsPerAccessControlEntry",
        xref: "core\xA79.10.6.6",
        details: "This attribute shall provide the minimum number of Targets per entry that are supported by this server.\nSince reducing this value over time may invalidate ACL entries already written, this value shall NOT decrease across time as software updates occur that could impact this value. If this is a concern for a given implementation, it is recommended to only use the minimum value required and avoid reporting a higher value than the required minimum."
      },
      {
        tag: "attribute",
        name: "AccessControlEntriesPerFabric",
        xref: "core\xA79.10.6.7",
        details: "This attribute shall provide the minimum number of ACL Entries per fabric that are supported by this server.\nSince reducing this value over time may invalidate ACL entries already written, this value shall NOT decrease across time as software updates occur that could impact this value. If this is a concern for a given implementation, it is recommended to only use the minimum value required and avoid reporting a higher value than the required minimum."
      },
      {
        tag: "attribute",
        name: "CommissioningArl",
        xref: "core\xA79.10.6.8",
        details: `This attribute shall provide the set of CommissioningAccessRestrictionEntryStruct applied during commissioning on a managed device.
When present, the CommissioningARL attribute shall indicate the access restrictions applying during commissioning.
Attempts to access data model elements described by an entry in the CommissioningARL attribute during commissioning shall result in an error of ACCESS_RESTRICTED. See Section 6.6.2, "Access Control Model" for more information about the features related to controlling access to a Node's Endpoint Clusters ("Targets" hereafter) from other Nodes.
See Section 9.10.4.2.1, "Managed Device Feature Usage Restrictions" for limitations on the use of access restrictions.`
      },
      {
        tag: "attribute",
        name: "Arl",
        xref: "core\xA79.10.6.9",
        details: `This attribute shall provide the set of AccessRestrictionEntryStruct applied to the associated fabric on a managed device.
When present, the ARL attribute shall indicate the access restrictions applying to the accessing fabric. In contrast, the CommissioningARL attribute indicates the accessing restrictions that apply when there is no accessing fabric, such as during commissioning.
The access restrictions are externally added/removed based on the particular relationship the device hosting this server has with external entities such as its owner, external service provider, or end-user.
Attempts to access data model elements described by an entry in the ARL attribute for the accessing fabric shall result in an error of ACCESS_RESTRICTED. See Section 6.6.2, "Access Control Model" for more information about the features related to controlling access to a Node's Endpoint Clusters ("Targets" hereafter) from other Nodes.
See Section 9.10.4.2.1, "Managed Device Feature Usage Restrictions" for limitations on the use of access restrictions.`
      },
      {
        tag: "event",
        name: "AccessControlEntryChanged",
        xref: "core\xA79.10.9.1",
        details: "The server shall generate AccessControlEntryChanged events whenever its ACL attribute data is changed by an Administrator.\n  - Each added entry shall generate an event with ChangeType Added.\n  - Each changed entry shall generate an event with ChangeType Changed.\n  - Each removed entry shall generate an event with ChangeType Removed.",
        children: [
          {
            tag: "field",
            name: "AdminNodeId",
            xref: "core\xA79.10.9.1.1",
            details: "The Node ID of the Administrator that made the change, if the change occurred via a CASE session.\nExactly one of AdminNodeID and AdminPasscodeID shall be set, depending on whether the change occurred via a CASE or PASE session; the other shall be null."
          },
          {
            tag: "field",
            name: "AdminPasscodeId",
            xref: "core\xA79.10.9.1.2",
            details: "The Passcode ID of the Administrator that made the change, if the change occurred via a PASE session. Non-zero values are reserved for future use (see PasscodeId generation in PBKDFParamRequest).\nExactly one of AdminNodeID and AdminPasscodeID shall be set, depending on whether the change occurred via a CASE or PASE session; the other shall be null."
          },
          {
            tag: "field",
            name: "ChangeType",
            xref: "core\xA79.10.9.1.3",
            details: "The type of change as appropriate."
          },
          {
            tag: "field",
            name: "LatestValue",
            xref: "core\xA79.10.9.1.4",
            details: "The latest value of the changed entry.\nThis field SHOULD be set if resources are adequate for it; otherwise it shall be set to NULL if resources are scarce."
          }
        ]
      },
      {
        tag: "event",
        name: "AccessControlExtensionChanged",
        xref: "core\xA79.10.9.2",
        details: "The server shall generate AccessControlExtensionChanged events whenever its extension attribute data is changed by an Administrator.\n  - Each added extension shall generate an event with ChangeType Added.\n  - Each changed extension shall generate an event with ChangeType Changed.\n  - Each removed extension shall generate an event with ChangeType Removed.",
        children: [
          {
            tag: "field",
            name: "AdminNodeId",
            xref: "core\xA79.10.9.2.1",
            details: "The Node ID of the Administrator that made the change, if the change occurred via a CASE session.\nExactly one of AdminNodeID and AdminPasscodeID shall be set, depending on whether the change occurred via a CASE or PASE session; the other shall be null."
          },
          {
            tag: "field",
            name: "AdminPasscodeId",
            xref: "core\xA79.10.9.2.2",
            details: "The Passcode ID of the Administrator that made the change, if the change occurred via a PASE session. Non-zero values are reserved for future use (see PasscodeId generation in PBKDFParamRequest).\nExactly one of AdminNodeID and AdminPasscodeID shall be set, depending on whether the change occurred via a CASE or PASE session; the other shall be null."
          },
          {
            tag: "field",
            name: "ChangeType",
            xref: "core\xA79.10.9.2.3",
            details: "The type of change as appropriate."
          },
          {
            tag: "field",
            name: "LatestValue",
            xref: "core\xA79.10.9.2.4",
            details: "The latest value of the changed extension.\nThis field SHOULD be set if resources are adequate for it; otherwise it shall be set to NULL if resources are scarce."
          }
        ]
      },
      {
        tag: "event",
        name: "FabricRestrictionReviewUpdate",
        xref: "core\xA79.10.9.3",
        details: "The server shall generate a FabricRestrictionReviewUpdate event to indicate completion of a fabric restriction review. Due to the requirement to generate this event within a bound time frame of successful receipt of the ReviewFabricRestrictions command, this event may include additional steps that the client may present to the user in order to help the user locate the user interface for the Managed Device feature.",
        children: [
          {
            tag: "field",
            name: "Token",
            xref: "core\xA79.10.9.3.1",
            details: "This field shall indicate the Token that can be used to correlate a ReviewFabricRestrictionsResponse with a FabricRestrictionReviewUpdate event."
          },
          {
            tag: "field",
            name: "Instruction",
            xref: "core\xA79.10.9.3.2",
            details: 'This field shall provide human readable text that may be displayed to the user to help them locate the user interface for managing access restrictions for each fabric.\nA device SHOULD implement the Localization Configuration Cluster when it has no other means to determine the locale to use for this text.\nExamples include "Please try again and immediately access device display for further instructions." or "Please check email associated with your Acme account."'
          },
          {
            tag: "field",
            name: "ArlRequestFlowUrl",
            xref: "core\xA79.10.9.3.3",
            details: 'This field shall indicate the URL for the service associated with the device maker which the user can visit to manage fabric limitations. The syntax of this field shall follow the syntax as specified in RFC 1738 and shall use the https scheme for internet-hosted URLs.\n  - The URL may embed the token, fabric index, fabric vendor, or other information transparently in order to pass context about the originating ReviewFabricRestrictions command to the service associated with the URL. The service associated with the device vendor may perform vendor ID verification on the fabric from which the ReviewFabricRestrictions command originated.\n  - If the device grants the request, the ARL attribute in the Access Control Cluster shall be updated to reflect the new access rights and a successful response shall be returned to the device making the request using the MTaer field of the callbackUrl. If the request is denied, the ARL attribute shall remain unchanged and a failure response shall be returned to the device making the request using the MTaer field of the callbackUrl.\n  - The device using this mechanism shall provide a service at the URL that can accept requests for additional access and return responses indicating whether the requests were granted or denied.\n  - This URL will typically lead to a server which (e.g. by looking at the User-Agent) redirects the user to allow viewing, downloading, installing or using a manufacturer-provided means for guiding the user through the process to review and approve or deny the request. The device manufacturer may choose to use a constructed URL which is valid in a HTTP GET request (i.e. dedicated for the product) such as, for example, https://domain.example/arl-app?vid=FFF1&pid=1234. If a client follows or launches the ARLRequestFlowUrl, it shall expand it as described in Section 9.10.9.3.4, "ARLRequestFlowUrl format".\n  - A manufacturer contemplating using this flow should realize that\n  - This flow typically requires internet access to access the URL, and access extension may fail when internet connectivity is not available.\n  - If the flow prefers to redirect the user to an app which is available on popular platforms, it SHOULD also provide a fallback option such as a web browser interface to ensure users can complete access extension.\n  - A malicious Administrator could tamper with the URL (including any parameters it contains) in order to reduce restrictions for another Fabric. A well-implemented web service or app SHOULD validate that the VID in flow URL invocations match recent requests for review by comparing with VID and token pairs from recent ReviewFabricRestrictions requests.\n  - An Administrator supporting this flow should realize that if the device serving this cluster is malicious, it could send dangerous URLs to the client which could take the user to malicious     sites. The Administrator SHOULD provide details, such as the VID, to the user about the device sending the event so that the user can make an informed decision about whether to trust the URL.'
          }
        ]
      },
      {
        tag: "command",
        name: "ReviewFabricRestrictions",
        xref: "core\xA79.10.8.1",
        details: "This command signals to the service associated with the device vendor that the fabric administrator would like a review of the current restrictions on the accessing fabric. This command includes an optional list of ARL entries that the fabric administrator would like removed.\nIn response, a ReviewFabricRestrictionsResponse is sent which contains a token that can be used to correlate a review request with a FabricRestrictionReviewUpdate event.\nWithin 1 hour of the ReviewFabricRestrictionsResponse, the FabricRestrictionReviewUpdate event shall be generated, in order to indicate completion of the review and any additional steps required by the user for the review.\nA review may include obtaining consent from the user, which can take time. For example, the user may need to respond to an email or a push notification.\nThe ARL attribute may change at any time due to actions taken by the user, or the service associated with the device vendor.\n> [!NOTE]\n> NOTE: A malicious fabric administrator could attempt to create a fabric with a VID that it does not own in order to gain enhanced access. For this reason the device SHOULD perform the Fabric Table Vendor ID Verification Procedure.",
        children: [{
          tag: "field",
          name: "Arl",
          xref: "core\xA79.10.8.1.1",
          details: "When the ARL field is provided, it indicates the specific restrictions that are requested for review. An empty list represents a generic request for review of all restrictions."
        }]
      },
      {
        tag: "command",
        name: "ReviewFabricRestrictionsResponse",
        xref: "core\xA79.10.8.2",
        details: "Returns the review token for the request, which can be used to correlate with a FabricRestrictionReviewUpdate event.",
        children: [{
          tag: "field",
          name: "Token",
          xref: "core\xA79.10.8.2.1",
          details: "This field shall specify a Token that can be used to correlate a ReviewFabricRestrictionsResponse with a FabricRestrictionReviewUpdate event."
        }]
      },
      {
        tag: "datatype",
        name: "ChangeTypeEnum",
        xref: "core\xA79.10.5.1",
        children: [
          { tag: "field", name: "Changed", description: "Entry or extension was changed" },
          { tag: "field", name: "Added", description: "Entry or extension was added" },
          { tag: "field", name: "Removed", description: "Entry or extension was removed" }
        ]
      },
      {
        tag: "datatype",
        name: "AccessControlEntryPrivilegeEnum",
        xref: "core\xA79.10.5.2",
        children: [
          { tag: "field", name: "View", description: "Can read and observe all (except Access Control Cluster)" },
          {
            tag: "field",
            name: "Operate",
            description: "View privileges, and can perform the primary function of this Node (except Access Control Cluster)",
            xref: "core\xA79.10.5.2.1",
            details: "This value implicitly grants View privileges"
          },
          {
            tag: "field",
            name: "Manage",
            description: "Operate privileges, and can modify persistent configuration of this Node (except Access Control Cluster)",
            xref: "core\xA79.10.5.2.2",
            details: "This value implicitly grants Operate & View privileges"
          },
          {
            tag: "field",
            name: "Administer",
            description: "Manage privileges, and can observe and modify the Access Control Cluster",
            xref: "core\xA79.10.5.2.3",
            details: "This value implicitly grants Manage, Operate & View privileges"
          }
        ]
      },
      {
        tag: "datatype",
        name: "AccessRestrictionTypeEnum",
        xref: "core\xA79.10.5.3",
        children: [
          {
            tag: "field",
            name: "AttributeAccessForbidden",
            description: "Clients on this fabric are currently forbidden from reading and writing an attribute"
          },
          {
            tag: "field",
            name: "AttributeWriteForbidden",
            description: "Clients on this fabric are currently forbidden from writing an attribute"
          },
          {
            tag: "field",
            name: "CommandForbidden",
            description: "Clients on this fabric are currently forbidden from invoking a command"
          },
          {
            tag: "field",
            name: "EventForbidden",
            description: "Clients on this fabric are currently forbidden from reading an event"
          }
        ]
      },
      {
        tag: "datatype",
        name: "AccessControlEntryAuthModeEnum",
        xref: "core\xA79.10.5.4",
        children: [
          { tag: "field", name: "Pase", description: "Passcode authenticated session" },
          { tag: "field", name: "Case", description: "Certificate authenticated session" },
          { tag: "field", name: "Group", description: "Group authenticated session" }
        ]
      },
      { tag: "datatype", name: "AccessControlTargetStruct", xref: "core\xA79.10.5.5" },
      {
        tag: "datatype",
        name: "AccessControlEntryStruct",
        xref: "core\xA79.10.5.6",
        children: [
          {
            tag: "field",
            name: "Privilege",
            xref: "core\xA79.10.5.6.1",
            details: "The privilege field shall specify the level of privilege granted by this Access Control Entry.\nEach privilege builds upon its predecessor, expanding the set of actions that can be performed upon a Node. Administer is the highest privilege, and is special as it pertains to the administration of privileges itself, via the Access Control Cluster.\nWhen a Node is granted a particular privilege, it is also implicitly granted all logically lower privilege levels as well. The following diagram illustrates how the higher privilege levels subsume the lower privilege levels:\n!Diagram\nIndividual clusters shall define whether attributes are readable, writable, or both readable and writable. Clusters also shall define which privilege is minimally required to be able to perform a particular read or write action on those attributes, or invoke particular commands. Device type specifications may further restrict the privilege required.\nThe Access Control Cluster shall require the Administer privilege to observe and modify the Access Control Cluster itself. The Administer privilege shall NOT be used on Access Control Entries which use the Group auth mode.\n> [!NOTE]\n> E.g. A Fan Control Cluster may require Operate privilege to write to a level attribute (low/medium/high), and to configure each level's RPM setting via a command. The Fan Control Cluster may also expose a current RPM attribute, which requires only View privilege to read. Clients granted Operate privilege will be able to both change the level, and configure each level's RPM. Clients granted View privilege will be able to read the current RPM, but will not be granted sufficient privilege to change the level or configure each level's RPM.\n> [!NOTE]\n> E.g. A Fan Control Cluster may be included in a more industrial device type. To ensure proper operation, this device type may restrict configuration of fan level RPM settings to require Manage   privilege. Clients granted Manage privilege will have sufficient privilege to configure each level's RPM; clients granted Operate privilege will not be able to perform such configuration, but will still be able to change the level. This additional restriction would apply only to the Fan Control Cluster as included in this particular device type; a client granted Operate privilege may still be able to perform configuration in Fan Control Clusters included in other device types on the same Node."
          },
          {
            tag: "field",
            name: "AuthMode",
            xref: "core\xA79.10.5.6.2",
            details: "The AuthMode field shall specify the authentication mode required by this Access Control Entry."
          },
          {
            tag: "field",
            name: "Subjects",
            xref: "core\xA79.10.5.6.3",
            details: "The subjects field shall specify a list of Subject IDs, to which this Access Control Entry grants access.\nDevice types may impose additional constraints on the minimum number of subjects per Access Control Entry.\nAn attempt to create an entry with more subjects than the node can support shall result in a RESOURCE_EXHAUSTED error and the entry shall NOT be created.\nSubject ID shall be of type uint64 with semantics depending on the entry's AuthMode as follows:"
          },
          {
            tag: "field",
            name: "Targets",
            xref: "core\xA79.10.5.6.4",
            details: "The targets field shall specify a list of AccessControlTargetStruct, which define the clusters on this Node to which this Access Control Entry grants access.\nDevice types may impose additional constraints on the minimum number of targets per Access Control Entry.\nAn attempt to create an entry with more targets than the node can support shall result in a RESOURCE_EXHAUSTED error and the entry shall NOT be created.\nA single target shall contain at least one field (Cluster, Endpoint, or DeviceType), and shall NOT contain both an Endpoint field and a DeviceType field.\nA target grants access based on the presence of fields as follows:"
          }
        ]
      },
      {
        tag: "datatype",
        name: "AccessControlExtensionStruct",
        xref: "core\xA79.10.5.7",
        children: [{
          tag: "field",
          name: "Data",
          xref: "core\xA79.10.5.7.1",
          details: "This field may be used by manufacturers to store arbitrary TLV-encoded data related to a fabric's Access Control Entries.\nThe contents shall consist of a top-level anonymous list; each list element shall include a profile-specific tag encoded in fully-qualified form.\nAdministrators may iterate over this list of elements, and interpret selected elements at their discretion. The content of each element is not specified, but may be coordinated among manufacturers at their discretion.\n> [!NOTE]\n> E.g. a manufacturer could use this field to store structured data, including various metadata and cryptographic signatures. The manufacturer could then verify a fabric's Access Control List by generating a canonical bytestream from the Access Control Entries for the fabric, then verifying the signature against it. Such a canonical bytestream could be generated by encoding specific entry fields and sub-fields (such as lists) in specific order and specific format (e.g. TLV)."
        }]
      },
      {
        tag: "datatype",
        name: "AccessRestrictionStruct",
        xref: "core\xA79.10.5.8",
        details: 'This structure describes an access restriction that would be applied to a specific data model element on a given endpoint/cluster pair (see Section 9.10.5.9, "AccessRestrictionEntryStruct").',
        children: [
          {
            tag: "field",
            name: "Type",
            xref: "core\xA79.10.5.8.1",
            details: "This field shall indicate the type of restriction, for example, AttributeAccessForbidden."
          },
          {
            tag: "field",
            name: "Id",
            xref: "core\xA79.10.5.8.2",
            details: "This field shall indicate the element Manufacturer Extensible Identifier (MEI) associated with the element type subject to the access restriction, based upon the AccessRestrictionTypeEnum. When the Type is AttributeAccessForbidden or AttributeWriteForbidden, this value shall be considered of type attrib-id (i.e. an attribute identifier). When the Type is CommandForbidden, this value shall be considered of type command-id (i.e. an attribute identifier). When the Type is EventForbidden, this value shall be considered of type event-id (i.e. an event identifier).\nA null value shall indicate the wildcard value for the given value of Type (i.e. all elements associated with the Type under the associated endpoint and cluster for the containing AccessRestrictionEntryStruct)."
          }
        ]
      },
      {
        tag: "datatype",
        name: "AccessRestrictionEntryStruct",
        xref: "core\xA79.10.5.9",
        details: "This structure describes a current access restriction on the fabric.",
        children: [
          {
            tag: "field",
            name: "Endpoint",
            xref: "core\xA79.10.5.9.1",
            details: "This field shall indicate the endpoint having associated access restrictions scoped to the associated fabric of the list containing the entry."
          },
          {
            tag: "field",
            name: "Cluster",
            xref: "core\xA79.10.5.9.2",
            details: "This field shall indicate the cluster having associated access restrictions under the entry's Endpoint, scoped to the associated fabric of the list containing the entry."
          },
          {
            tag: "field",
            name: "Restrictions",
            xref: "core\xA79.10.5.9.3",
            details: "This field shall indicate the set of restrictions applying to the Cluster under the given Endpoint, scoped to the associated fabric of the list containing the entry.\nThis list shall NOT be empty."
          }
        ]
      },
      {
        tag: "datatype",
        name: "CommissioningAccessRestrictionEntryStruct",
        xref: "core\xA79.10.5.10",
        details: "This structure describes a current access restriction when there is no accessing fabric.",
        children: [
          {
            tag: "field",
            name: "Endpoint",
            xref: "core\xA79.10.5.10.1",
            details: "This field shall indicate the endpoint having associated access restrictions scoped to the associated fabric of the list containing the entry."
          },
          {
            tag: "field",
            name: "Cluster",
            xref: "core\xA79.10.5.10.2",
            details: "This field shall indicate the cluster having associated access restrictions under the entry's Endpoint, scoped to the associated fabric of the list containing the entry."
          },
          {
            tag: "field",
            name: "Restrictions",
            xref: "core\xA79.10.5.10.3",
            details: "This field shall indicate the set of restrictions applying to the Cluster under the given Endpoint, scoped to the associated fabric of the list containing the entry.\nThis list shall NOT be empty."
          }
        ]
      }
    ]
  }
);
//# sourceMappingURL=access-control.resource.js.map
