Module scope 

Central, fail-closed scope enforcement for scoped credentials.

Two unrelated credential families carry a scope string:

• Delegated tokens — share links (file:{file_id}:{R|C|W}) and app publishing (apkg:publish), parsed by cloudillo_types::types::TokenScope.
• Capability scopes — the comma-separated carddav:* / caldav:* list a user types into the scopes field of POST /api/auth/api-keys.

scope_permits is the single decision point for both, called from crate::middleware::require_auth on every protected request.

Functions

has_scope

Returns true iff scopes (comma-separated) contains an exact-match token for needed. Whitespace around each token is trimmed.

scope_permits

Whether a credential carrying scope may perform method on path.