From 6ea862e65dfb454ef315f2618aba90fe03239980 Mon Sep 17 00:00:00 2001
From: Christian Manivong <christian@manivong.de>
Date: Wed, 15 Jul 2026 23:20:47 +0200
Subject: [PATCH] feat(access-point): add push_mac_acl() abstract method

Write-side counterpart to the existing get_mac_acl() read contract.
Backs the new Global MAC ACL feature in netOrk.
---
 napalm_device_types/access_point.py | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/napalm_device_types/access_point.py b/napalm_device_types/access_point.py
index 1c6c066..8e2c3a8 100644
--- a/napalm_device_types/access_point.py
+++ b/napalm_device_types/access_point.py
@@ -280,6 +280,25 @@ class AccessPointDriver(DeviceTypeDriver):
         """
         raise NotImplementedError
 
+    def push_mac_acl(self, ssid_name: str, mode: str, macs: List[str]) -> None:
+        """
+        Rewrites the MAC-address access control list for a single SSID.
+
+        Full-rebuild semantics: replaces whatever ACL state currently exists
+        for *ssid_name* with *mode* + *macs* — not a diff/patch.
+
+        :param ssid_name: SSID name to apply the ACL to.
+        :param mode: ``"off"`` | ``"whitelist"`` | ``"blacklist"``.
+        :param macs: MAC addresses for the active list. Ignored when ``mode == "off"``.
+        :raises NotImplementedError: If the driver does not support MAC ACL push.
+
+        Example::
+
+            driver.push_mac_acl("CorpWiFi", "whitelist", ["AA:BB:CC:DD:EE:01", "AA:BB:CC:DD:EE:02"])
+            driver.push_mac_acl("GuestNet", "off", [])
+        """
+        raise NotImplementedError
+
     def get_dot1x_config(self) -> Dict[str, Dot1XConfigDict]:
         """
         Returns the 802.1X / WPA-Enterprise (RADIUS) configuration per SSID.