Enum ReadScope 

pub enum ReadScope {
    Absent,
    Tenant,
    OwnRows,
    None,
    Other(String),
}

The scope the platform computed a role-scoped read under, taken from the X-Axonflow-Read-Scope response header.

Three named variants are the platform’s closed set. Two states are NOT in it and are deliberately distinct from each other and from the three:

• ReadScope::Absent — the response carried no such header. That is what a pre-#2922 platform, a non-scoped route, or a proxy that dropped the header looks like. It means “not stated”, never “none”: treating an absent header as a scope of none would turn every older stack’s perfectly good read into a refusal.

• ReadScope::Other — a scope a newer platform names and this build does not recognise. Its VALUE is preserved rather than folded into one of the three, so a caller can see what it was — trimmed and lower-cased, like the three named ones, because the same normalisation has to apply to every value or the recognised set would depend on a proxy’s header casing. It never triggers a refusal: this header is the platform’s account of a decision it has ALREADY made and applied, so an unrecognised value is a reporting gap on our side, not a licence to invent an outcome.

Variants

Absent

No X-Axonflow-Read-Scope header at all. Distinct from ReadScope::None.

Tenant

Tenant-wide: a tenant-wide role (admin / owner / policy_admin), or a Community / Community-SaaS deployment where the whole tenant is the one operator.

OwnRows

Narrowed to the rows attributed to the identity presented. A miss under this scope means “not among yours”, which is NOT the same statement as “not there” — see ReadScopeRefusal.

None

The platform RESOLVED no per-user identity and the caller holds no tenant-wide authority, so it returned zero rows by construction. Under this scope a read CANNOT have returned data, so its empty answer says nothing about what exists.

“Resolved none” is wider than “presented none”, and the difference is worth knowing before you go looking in the wrong place. A token that validates perfectly still resolves to no identity when its address is one the platform reserves for SHARED, non-personal identities — the whole of @axonflow.local and @axonflow.internal, plus the community and evaluator addresses. Those name a pool of callers rather than a person, and scoping a read to one would return the pool, so the platform deliberately censuses them to nothing. A per-user token minted with an address in one of those domains therefore reads exactly like no token at all. (Easy to hit: the platform’s own generate-jwt.sh defaults to demo-user@axonflow.local.)

Other(String)

A scope this build does not recognise, preserved (trimmed and lower-cased, as every value on this header is).

Implementations

impl ReadScope

pub fn parse(header: Option<&str>) -> Self

The scope a response header names.

Trimmed and lower-cased, for the same reason the platform’s own header helpers are: a proxy that normalises header casing or appends whitespace must not silently change the answer. The cost of getting that wrong is one-sided and quiet — a scope spelled None would fall to ReadScope::Other and the vacuous empty page it describes would come back as data again.

pub fn of(response: &Response) -> Self

The scope a response reports.

Trait Implementations

impl Clone for ReadScope

fn clone(&self) -> ReadScope

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ReadScope

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for ReadScope

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for ReadScope

impl PartialEq for ReadScope

fn eq(&self, other: &ReadScope) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for ReadScope