Function apply 

pub async fn apply(
    pool: &PgPool,
    actor: Actor,
    origin: &Origin,
) -> AppResult<Actor>

The actor as the request may see it: groups whose network or session-age condition the request does not meet are hidden (claims and the last sign-in are already part of the actor’s hidden groups). One query; without conditioned groups nothing changes. A member refused by any condition is recorded once per origin.key.