Remove access control temporary override (#16536)

The "empty" default delegate now denies access.

The delegate can now override the check, or proceed with
the standard check.

The "permissive" example delegate still permits access, by
overriding the check.

The "normal" example delegate still performs a standard check,
by not overriding the check.

Fixes #13867

src/access/AccessControl.cpp

@@ -206,11 +206,14 @@ CHIP_ERROR AccessControl::Check(const SubjectDescriptor & subjectDescriptor, con
     }
 #endif
 
-    // TODO(#13867): this will go away
-    if (mDelegate->TemporaryCheckOverride())
     {
-        ChipLogProgress(DataManagement, "AccessControl: temporary check override (this will go away)");
-        return CHIP_NO_ERROR;
+        CHIP_ERROR result = mDelegate->Check(subjectDescriptor, requestPath, requestPrivilege);
+        if (result != CHIP_ERROR_NOT_IMPLEMENTED)
+        {
+            ChipLogProgress(DataManagement, "AccessControl: %s (delegate)",
+                            (result == CHIP_NO_ERROR) ? "allowed" : (result == CHIP_ERROR_ACCESS_DENIED) ? "denied" : "error");
+            return result;
+        }
     }
 
     // Operational PASE not supported for v1.0, so PASE implies commissioning, which has highest privilege.
@@ -318,6 +321,7 @@ CHIP_ERROR AccessControl::Check(const SubjectDescriptor & subjectDescriptor, con
         }
 
         // Entry passed all checks: access is allowed.
+        ChipLogProgress(DataManagement, "AccessControl: allowed");
         return CHIP_NO_ERROR;
     }
 

src/access/AccessControl.h

@@ -341,13 +341,20 @@ class AccessControl
         // Iteration
         virtual CHIP_ERROR Entries(EntryIterator & iterator, const FabricIndex * fabricIndex) const { return CHIP_NO_ERROR; }
 
+        // Check
+        // Return CHIP_NO_ERROR if allowed, CHIP_ERROR_ACCESS_DENIED if denied,
+        // CHIP_ERROR_NOT_IMPLEMENTED to use the default check algorithm (against entries),
+        // or any other CHIP_ERROR if another error occurred.
+        virtual CHIP_ERROR Check(const SubjectDescriptor & subjectDescriptor, const RequestPath & requestPath,
+                                 Privilege requestPrivilege)
+        {
+            return CHIP_ERROR_ACCESS_DENIED;
+        }
+
         // Listening
         virtual void SetListener(Listener & listener) { mListener = &listener; }
         virtual void ClearListener() { mListener = nullptr; }
 
-        // TODO(#13867): this will go away
-        virtual bool TemporaryCheckOverride() const { return false; }
-
     private:
         Listener * mListener = nullptr;
     };

src/access/examples/ExampleAccessControlDelegate.cpp

@@ -40,6 +40,8 @@ using chip::kUndefinedNodeId;
 using chip::Access::AccessControl;
 using chip::Access::AuthMode;
 using chip::Access::Privilege;
+using chip::Access::RequestPath;
+using chip::Access::SubjectDescriptor;
 
 using Entry         = chip::Access::AccessControl::Entry;
 using EntryIterator = chip::Access::AccessControl::EntryIterator;
@@ -1237,6 +1239,12 @@ class AccessControlDelegate : public AccessControl::Delegate
         return CHIP_ERROR_BUFFER_TOO_SMALL;
     }
 
+    CHIP_ERROR Check(const SubjectDescriptor & subjectDescriptor, const RequestPath & requestPath,
+                     Privilege requestPrivilege) override
+    {
+        return CHIP_ERROR_NOT_IMPLEMENTED;
+    }
+
 public:
     void SetStorageDelegate(chip::PersistentStorageDelegate * storageDelegate) { mStorageDelegate = storageDelegate; }
 

src/access/examples/PermissiveAccessControlDelegate.cpp

@@ -59,8 +59,12 @@ class AccessControlDelegate : public AccessControl::Delegate
     // Iteration
     CHIP_ERROR Entries(EntryIterator & iterator, const FabricIndex * fabricIndex) const override { return CHIP_NO_ERROR; }
 
-    // TODO(#13867): this will go away
-    bool TemporaryCheckOverride() const override { return true; }
+    // Check
+    CHIP_ERROR Check(const SubjectDescriptor & subjectDescriptor, const RequestPath & requestPath,
+                     Privilege requestPrivilege) override
+    {
+        return CHIP_NO_ERROR;
+    }
 };
 
 } // namespace