Struct ReadScope 

pub struct ReadScope { /* private fields */ }

High-performance event store with columnar storage What a read credential is allowed to see, enforced inside the store.

A read key is otherwise all-or-nothing: “let this tool read the store” and “let this tool read every credential ever issued” are the same grant. That is not theoretical — auth events carry session tokens whose value IS the entity_id, so a routine query rendered live bearer tokens into an agent’s context (#265). Redacting on write cannot fix it: the token is the lookup key.

Deliberately not Deserialize. This must never be settable from a request body, or a caller widens its own scope by omitting the field.

Allow-list, not deny-list, on purpose: a stream family added later is excluded until someone names it, so the failure mode of forgetting is a missing read rather than a leak.

Implementations

impl ReadScope

pub fn unrestricted() -> Self

Everything in the tenant — the behaviour of every read before scopes.

pub fn allow_entity_prefixes<I, S>(prefixes: I) -> Self

where I: IntoIterator<Item = S>, S: Into<String>,

Only entities whose id starts with one of prefixes.

An empty list denies everything, which is the safe reading of “scoped to nothing” and stops an accidentally-empty config granting full access.

pub fn permits(&self, entity_id: &str) -> bool

Whether this scope can see entity_id.

pub fn is_unrestricted(&self) -> bool

True when this scope restricts nothing.

Trait Implementations

impl Clone for ReadScope

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ReadScope

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ReadScope

fn default() -> Self

Returns the “default value” for a type.