Module scope 

Scope-based access control for tools.

Scopes provide a declarative security model where tools declare what scopes they require, and the framework automatically enforces them before execution.

Overview

Unlike role-based access control (which maps users → roles → permissions), scope-based access works at the tool level:

1. Tools declare required scopes via Tool::required_scopes()
2. User scopes are resolved from session state, JWT claims, or a custom provider
3. The ScopeGuard checks that the user has all required scopes

Example

use adk_auth::{ScopeGuard, ContextScopeResolver};

// Tools declare their requirements
let transfer = FunctionTool::new("transfer", "Transfer funds", handler)
    .with_scopes(&["finance:write", "verified"]);

// Guard enforces scopes automatically
let guard = ScopeGuard::new(ContextScopeResolver);
let protected = guard.protect(transfer);

Structs

ContextScopeResolver

Resolves user scopes from the user_scopes() method on ToolContext.

ScopeDenied

Error returned when a user lacks required scopes.

ScopeGuard

Declarative scope enforcement for tools.

ScopedTool

A tool wrapper that enforces scope requirements before execution.

ScopedToolDyn

Dynamic version of ScopedTool for Arc<dyn Tool>.

StaticScopeResolver

A static resolver that always returns a fixed set of scopes.

Traits

ScopeResolver

Resolves the set of scopes granted to the current user.

ScopeToolExt

Extension trait for easily wrapping tools with scope enforcement.

Functions

check_scopes

Checks whether a user’s scopes satisfy a tool’s requirements.