Enum ScopeFilter 

pub enum ScopeFilter {
    Eq(EqScopeFilter),
    In(InScopeFilter),
    InGroup(InGroupScopeFilter),
    InGroupSubtree(InGroupSubtreeScopeFilter),
}

A single scope filter — a typed predicate on a named resource property.

The property name (e.g., "owner_tenant_id", "id") is an authorization concept. Mapping to DB columns is done by ScopableEntity::resolve_property().

Variants mirror the predicate types from the PDP response:

• ScopeFilter::Eq — equality (property = value)
• ScopeFilter::In — set membership (property IN (values))
• ScopeFilter::InGroup — group membership subquery
• ScopeFilter::InGroupSubtree — group subtree subquery

Variants

Eq(EqScopeFilter)

Equality: property = value.

In(InScopeFilter)

Set membership: property IN (values).

InGroup(InGroupScopeFilter)

Group membership: property IN (SELECT resource_id FROM membership WHERE group_id IN (group_ids)).

InGroupSubtree(InGroupSubtreeScopeFilter)

Group subtree: property IN (SELECT resource_id FROM membership WHERE group_id IN (SELECT descendant_id FROM closure WHERE ancestor_id IN (ancestor_ids))).

Implementations

impl ScopeFilter

pub fn eq(property: impl Into<String>, value: impl Into<ScopeValue>) -> Self

Create an equality filter (property = value).

pub fn in(property: impl Into<String>, values: Vec<ScopeValue>) -> Self

Create a set membership filter (property IN (values)).

pub fn in_uuids(property: impl Into<String>, uuids: Vec<Uuid>) -> Self

Create a set membership filter from UUID values (convenience).

pub fn in_group(property: impl Into<String>, group_ids: Vec<ScopeValue>) -> Self

Create a group membership filter.

pub fn in_group_subtree( property: impl Into<String>, ancestor_ids: Vec<ScopeValue>, ) -> Self

Create a group subtree filter.

pub fn property(&self) -> &str

The authorization property name.

pub fn values(&self) -> ScopeFilterValues<'_>

Collect direct-match values as a slice-like view for iteration.

For Eq, returns a single-element slice; for In, returns the values slice. For InGroup/InGroupSubtree, returns empty — those are subquery parameters, not resource property values. The actual matching happens in SQL via [secure::scope_to_condition].

pub fn uuid_values(&self) -> Vec<Uuid>

Extract filter values as UUIDs, skipping non-UUID entries.

Useful when the caller knows the property holds UUID values (e.g., owner_tenant_id, id).

Trait Implementations

impl Clone for ScopeFilter

fn clone(&self) -> ScopeFilter

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ScopeFilter

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for ScopeFilter

fn eq(&self, other: &ScopeFilter) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Eq for ScopeFilter

impl StructuralPartialEq for ScopeFilter